text: """
  Cross Site Request Forgery Middleware.
  
  This module provides a middleware that implements protection
  against request forgeries from other sites.
  """
  import logging
  import re
  import string
  from collections import defaultdict
  from urllib.parse import urlparse
  
  from django.conf import settings
  from django.core.exceptions import DisallowedHost, ImproperlyConfigured
  from django.urls import get_callable
  from django.utils.cache import patch_vary_headers
  from django.utils.crypto import constant_time_compare, get_random_string
  from django.utils.deprecation import MiddlewareMixin
  from django.utils.functional import cached_property
  from django.utils.http import is_same_domain
  from django.utils.log import log_response
  
  logger = logging.getLogger('django.security.csrf')
  
  REASON_BAD_ORIGIN = "Origin checking failed - %s does not match any trusted origins."
  REASON_NO_REFERER = "Referer checking failed - no Referer."
  REASON_BAD_REFERER = "Referer checking failed - %s does not match any trusted origins."
  REASON_NO_CSRF_COOKIE = "CSRF cookie not set."
  REASON_BAD_TOKEN = "CSRF token missing or incorrect."
  REASON_MALFORMED_REFERER = "Referer checking failed - Referer is malformed."
  REASON_INSECURE_REFERER = "Referer checking failed - Referer is insecure while host is secure."
  
  CSRF_SECRET_LENGTH = 32
  CSRF_TOKEN_LENGTH = 2 * CSRF_SECRET_LENGTH
  CSRF_ALLOWED_CHARS = string.ascii_letters + string.digits
  CSRF_SESSION_KEY = '_csrftoken'
  
  
  def _get_failure_view():
      """Return the view to be used for CSRF rejections."""
      return get_callable(settings.CSRF_FAILURE_VIEW)
  
  
  def _get_new_csrf_string():
      return get_random_string(CSRF_SECRET_LENGTH, allowed_chars=CSRF_ALLOWED_CHARS)
  
  
  def _mask_cipher_secret(secret):
      """
      Given a secret (assumed to be a string of CSRF_ALLOWED_CHARS), generate a
      token by adding a mask and applying it to the secret.
      """
      mask = _get_new_csrf_string()
      chars = CSRF_ALLOWED_CHARS
      pairs = zip((chars.index(x) for x in secret), (chars.index(x) for x in mask))
      cipher = ''.join(chars[(x + y) % len(chars)] for x, y in pairs)
      return mask + cipher
  
  
  def _unmask_cipher_token(token):
      """
      Given a token (assumed to be a string of CSRF_ALLOWED_CHARS, of length
      CSRF_TOKEN_LENGTH, and that its first half is a mask), use it to decrypt
      the second half to produce the original secret.
      """
      mask = token[:CSRF_SECRET_LENGTH]
      token = token[CSRF_SECRET_LENGTH:]
      chars = CSRF_ALLOWED_CHARS
      pairs = zip((chars.index(x) for x in token), (chars.index(x) for x in mask))
      return ''.join(chars[x - y] for x, y in pairs)  # Note negative values are ok
  
  
  def _get_new_csrf_token():
      return _mask_cipher_secret(_get_new_csrf_string())
  
  
  def get_token(request):
      """
      Return the CSRF token required for a POST form. The token is an
      alphanumeric value. A new token is created if one is not already set.
  
      A side effect of calling this function is to make the csrf_protect
      decorator and the CsrfViewMiddleware add a CSRF cookie and a 'Vary: Cookie'
      header to the outgoing response.  For this reason, you may need to use this
      function lazily, as is done by the csrf context processor.
      """
      if "CSRF_COOKIE" not in request.META:
          csrf_secret = _get_new_csrf_string()
          request.META["CSRF_COOKIE"] = _mask_cipher_secret(csrf_secret)
      else:
          csrf_secret = _unmask_cipher_token(request.META["CSRF_COOKIE"])
      request.META["CSRF_COOKIE_USED"] = True
      return _mask_cipher_secret(csrf_secret)
  
  
  def rotate_token(request):
      """
      Change the CSRF token in use for a request - should be done on login
      for security purposes.
      """
      request.META.update({
          "CSRF_COOKIE_USED": True,
          "CSRF_COOKIE": _get_new_csrf_token(),
      })
      request.csrf_cookie_needs_reset = True
  
  
  def _sanitize_token(token):
      # Allow only ASCII alphanumerics
      if re.search('[^a-zA-Z0-9]', token):
          return _get_new_csrf_token()
      elif len(token) == CSRF_TOKEN_LENGTH:
          return token
      elif len(token) == CSRF_SECRET_LENGTH:
          # Older Django versions set cookies to values of CSRF_SECRET_LENGTH
          # alphanumeric characters. For backwards compatibility, accept
          # such values as unmasked secrets.
          # It's easier to mask here and be consistent later, rather than add
          # different code paths in the checks, although that might be a tad more
          # efficient.
          return _mask_cipher_secret(token)
      return _get_new_csrf_token()
  
  
  def _compare_masked_tokens(request_csrf_token, csrf_token):
      # Assume both arguments are sanitized -- that is, strings of
      # length CSRF_TOKEN_LENGTH, all CSRF_ALLOWED_CHARS.
      return constant_time_compare(
          _unmask_cipher_token(request_csrf_token),
          _unmask_cipher_token(csrf_token),
      )
  
  
  class CsrfViewMiddleware(MiddlewareMixin):
      """
      Require a present and correct csrfmiddlewaretoken for POST requests that
      have a CSRF cookie, and set an outgoing CSRF cookie.
  
      This middleware should be used in conjunction with the {% csrf_token %}
      template tag.
      """
      @cached_property
      def csrf_trusted_origins_hosts(self):
          return [
              urlparse(origin).netloc.lstrip('*')
              for origin in settings.CSRF_TRUSTED_ORIGINS
          ]
  
      @cached_property
      def allowed_origins_exact(self):
          return {
              origin for origin in settings.CSRF_TRUSTED_ORIGINS
              if '*' not in origin
          }
  
      @cached_property
      def allowed_origin_subdomains(self):
          """
          A mapping of allowed schemes to list of allowed netlocs, where all
          subdomains of the netloc are allowed.
          """
          allowed_origin_subdomains = defaultdict(list)
          for parsed in (urlparse(origin) for origin in settings.CSRF_TRUSTED_ORIGINS if '*' in origin):
              allowed_origin_subdomains[parsed.scheme].append(parsed.netloc.lstrip('*'))
          return allowed_origin_subdomains
  
      # The _accept and _reject methods currently only exist for the sake of the
      # requires_csrf_token decorator.
      def _accept(self, request):
          # Avoid checking the request twice by adding a custom attribute to
          # request.  This will be relevant when both decorator and middleware
          # are used.
          request.csrf_processing_done = True
          return None
  
      def _reject(self, request, reason):
          response = _get_failure_view()(request, reason=reason)
          log_response(
              'Forbidden (%s): %s', reason, request.path,
              response=response,
              request=request,
              logger=logger,
          )
          return response
  
      def _get_token(self, request):
          if settings.CSRF_USE_SESSIONS:
              try:
                  return request.session.get(CSRF_SESSION_KEY)
              except AttributeError:
                  raise ImproperlyConfigured(
                      'CSRF_USE_SESSIONS is enabled, but request.session is not '
                      'set. SessionMiddleware must appear before CsrfViewMiddleware '
                      'in MIDDLEWARE.'
                  )
          else:
              try:
                  cookie_token = request.COOKIES[settings.CSRF_COOKIE_NAME]
              except KeyError:
                  return None
  
              csrf_token = _sanitize_token(cookie_token)
              if csrf_token != cookie_token:
                  # Cookie token needed to be replaced;
                  # the cookie needs to be reset.
                  request.csrf_cookie_needs_reset = True
              return csrf_token
  
      def _set_token(self, request, response):
          if settings.CSRF_USE_SESSIONS:
              if request.session.get(CSRF_SESSION_KEY) != request.META['CSRF_COOKIE']:
                  request.session[CSRF_SESSION_KEY] = request.META['CSRF_COOKIE']
          else:
              response.set_cookie(
                  settings.CSRF_COOKIE_NAME,
                  request.META['CSRF_COOKIE'],
                  max_age=settings.CSRF_COOKIE_AGE,
                  domain=settings.CSRF_COOKIE_DOMAIN,
                  path=settings.CSRF_COOKIE_PATH,
                  secure=settings.CSRF_COOKIE_SECURE,
                  httponly=settings.CSRF_COOKIE_HTTPONLY,
                  samesite=settings.CSRF_COOKIE_SAMESITE,
              )
              # Set the Vary header since content varies with the CSRF cookie.
              patch_vary_headers(response, ('Cookie',))
  
      def _origin_verified(self, request):
          request_origin = request.META['HTTP_ORIGIN']
          good_origin = '%s://%s' % (
              'https' if request.is_secure() else 'http',
              request.get_host(),
          )
          if request_origin == good_origin:
              return True
          if request_origin in self.allowed_origins_exact:
              return True
          try:
              parsed_origin = urlparse(request_origin)
          except ValueError:
              return False
          request_scheme = parsed_origin.scheme
          request_netloc = parsed_origin.netloc
          return any(
              is_same_domain(request_netloc, host)
              for host in self.allowed_origin_subdomains.get(request_scheme, ())
          )
  
      def process_request(self, request):
          csrf_token = self._get_token(request)
          if csrf_token is not None:
              # Use same token next time.
              request.META['CSRF_COOKIE'] = csrf_token
  
      def process_view(self, request, callback, callback_args, callback_kwargs):
          if getattr(request, 'csrf_processing_done', False):
              return None
  
          # Wait until request.META["CSRF_COOKIE"] has been manipulated before
          # bailing out, so that get_token still works
          if getattr(callback, 'csrf_exempt', False):
              return None
  
          # Assume that anything not defined as 'safe' by RFC7231 needs protection
          if request.method not in ('GET', 'HEAD', 'OPTIONS', 'TRACE'):
              if getattr(request, '_dont_enforce_csrf_checks', False):
                  # Mechanism to turn off CSRF checks for test suite.
                  # It comes after the creation of CSRF cookies, so that
                  # everything else continues to work exactly the same
                  # (e.g. cookies are sent, etc.), but before any
                  # branches that call reject().
                  return self._accept(request)
  
              # Reject the request if the Origin header doesn't match an allowed
              # value.
              if 'HTTP_ORIGIN' in request.META:
                  if not self._origin_verified(request):
                      return self._reject(request, REASON_BAD_ORIGIN % request.META['HTTP_ORIGIN'])
              elif request.is_secure():
                  # If the Origin header wasn't provided, reject HTTPS requests
                  # if the Referer header doesn't match an allowed value.
                  #
                  # Suppose user visits http://example.com/
                  # An active network attacker (man-in-the-middle, MITM) sends a
                  # POST form that targets https://example.com/detonate-bomb/ and
                  # submits it via JavaScript.
                  #
                  # The attacker will need to provide a CSRF cookie and token, but
                  # that's no problem for a MITM and the session-independent
                  # secret we're using. So the MITM can circumvent the CSRF
                  # protection. This is true for any HTTP connection, but anyone
                  # using HTTPS expects better! For this reason, for
                  # https://example.com/ we need additional protection that treats
                  # http://example.com/ as completely untrusted. Under HTTPS,
                  # Barth et al. found that the Referer header is missing for
                  # same-domain requests in only about 0.2% of cases or less, so
                  # we can use strict Referer checking.
                  referer = request.META.get('HTTP_REFERER')
                  if referer is None:
                      return self._reject(request, REASON_NO_REFERER)
  
                  try:
                      referer = urlparse(referer)
                  except ValueError:
                      return self._reject(request, REASON_MALFORMED_REFERER)
  
                  # Make sure we have a valid URL for Referer.
                  if '' in (referer.scheme, referer.netloc):
                      return self._reject(request, REASON_MALFORMED_REFERER)
  
                  # Ensure that our Referer is also secure.
                  if referer.scheme != 'https':
                      return self._reject(request, REASON_INSECURE_REFERER)
  
                  # If there isn't a CSRF_COOKIE_DOMAIN, require an exact match
                  # match on host:port. If not, obey the cookie rules (or those
                  # for the session cookie, if CSRF_USE_SESSIONS).
                  good_referer = (
                      settings.SESSION_COOKIE_DOMAIN
                      if settings.CSRF_USE_SESSIONS
                      else settings.CSRF_COOKIE_DOMAIN
                  )
                  if good_referer is not None:
                      server_port = request.get_port()
                      if server_port not in ('443', '80'):
                          good_referer = '%s:%s' % (good_referer, server_port)
                  else:
                      try:
                          # request.get_host() includes the port.
                          good_referer = request.get_host()
                      except DisallowedHost:
                          pass
  
                  # Create a list of all acceptable HTTP referers, including the
                  # current host if it's permitted by ALLOWED_HOSTS.
                  good_hosts = list(self.csrf_trusted_origins_hosts)
                  if good_referer is not None:
                      good_hosts.append(good_referer)
  
                  if not any(is_same_domain(referer.netloc, host) for host in good_hosts):
                      reason = REASON_BAD_REFERER % referer.geturl()
                      return self._reject(request, reason)
  
              # Access csrf_token via self._get_token() as rotate_token() may
              # have been called by an authentication middleware during the
              # process_request() phase.
              csrf_token = self._get_token(request)
              if csrf_token is None:
                  # No CSRF cookie. For POST requests, we insist on a CSRF cookie,
                  # and in this way we can avoid all CSRF attacks, including login
                  # CSRF.
                  return self._reject(request, REASON_NO_CSRF_COOKIE)
  
              # Check non-cookie token for match.
              request_csrf_token = ""
              if request.method == "POST":
                  try:
                      request_csrf_token = request.POST.get('csrfmiddlewaretoken', '')
                  except OSError:
                      # Handle a broken connection before we've completed reading
                      # the POST data. process_view shouldn't raise any
                      # exceptions, so we'll ignore and serve the user a 403
                      # (assuming they're still listening, which they probably
                      # aren't because of the error).
                      pass
  
              if request_csrf_token == "":
                  # Fall back to X-CSRFToken, to make things easier for AJAX,
                  # and possible for PUT/DELETE.
                  request_csrf_token = request.META.get(settings.CSRF_HEADER_NAME, '')
  
              request_csrf_token = _sanitize_token(request_csrf_token)
              if not _compare_masked_tokens(request_csrf_token, csrf_token):
                  return self._reject(request, REASON_BAD_TOKEN)
  
          return self._accept(request)
  
      def process_response(self, request, response):
          if not getattr(request, 'csrf_cookie_needs_reset', False):
              if getattr(response, 'csrf_cookie_set', False):
                  return response
  
          if not request.META.get("CSRF_COOKIE_USED", False):
              return response
  
          # Set the CSRF cookie even if it's already set, so we renew
          # the expiry timer.
          self._set_token(request, response)
          response.csrf_cookie_set = True
          return response
  