Marketplace Allowlist Redirect Handler (marketplace/__init__.py)

A security utility that restricts HTTP redirects to a predefined set of allowed hosts. Use this to prevent SSRF or unauthorized redirection in marketplace plugin systems.

# Source: https://github.com/razzant/ouroboros | License: MIT | Copyright 2026 Anton Razzhigaev
# Provided via justclaw.it.com; keep this notice with the code.
"""Marketplace clients, staging, provenance, and install orchestration.

Node/TypeScript OpenClaw plugins are intentionally unsupported: UI filters them
from search and install refuses them explicitly.
"""

import urllib.parse
import urllib.request
from typing import Callable, Iterable


class AllowlistRedirectHandler(urllib.request.HTTPRedirectHandler):
    """Refuse redirects to hosts outside a marketplace client's allowlist."""

    def __init__(self, allowed_hosts: Iterable[str], error_factory: Callable[[str], Exception]) -> None:
        super().__init__()
        self._allowed = frozenset(allowed_hosts)
        self._error = e

... (truncated -- full source via MCP)