D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
lib
/
python3.9
/
site-packages
/
oauthlib
/
oauth1
/
rfc5849
/
__pycache__
/
Filename :
signature.cpython-39.opt-1.pyc
back
Copy
a �#/d|y � @ s� d Z ddlZddlZddlZddlZddlZddlZddlmZm Z m Z ddl m Z ddlmZ e�e�Zeeeed�dd�ZdKeeed �d d �ZdLdd�Zed�dd�Zeeeed�dd�ZdMed�dd�Zdd� ZdNd d �Zd d � Z d d!� Z dOd"d#�Z d$d%� Z ed&�d'd(�Z dPeed)�d*d+�Z!i Z"ed�d,d-�Z#d.d/� Z$eeed0�d1d2�Z%eed3�d4d5�Z&d6d7� Z'ed8�d9d:�Z(d;d<� Z)ed&�d=d>�Z*ed8�d?d@�Z+ed&�dAdB�Z,ed8�dCdD�Z-dEdF� Z.dGdH� Z/dQdIdJ�Z0dS )Ra� This module is an implementation of `section 3.4`_ of RFC 5849. **Usage** Steps for signing a request: 1. Collect parameters from the request using ``collect_parameters``. 2. Normalize those parameters using ``normalize_parameters``. 3. Create the *base string URI* using ``base_string_uri``. 4. Create the *signature base string* from the above three components using ``signature_base_string``. 5. Pass the *signature base string* and the client credentials to one of the sign-with-client functions. The HMAC-based signing functions needs client credentials with secrets. The RSA-based signing functions needs client credentials with an RSA private key. To verify a request, pass the request and credentials to one of the verify functions. The HMAC-based signing functions needs the shared secrets. The RSA-based verify functions needs the RSA public key. **Scope** All of the functions in this module should be considered internal to OAuthLib, since they are not imported into the "oauthlib.oauth1" module. Programs using OAuthLib should not use directly invoke any of the functions in this module. **Deprecated functions** The "sign_" methods that are not "_with_client" have been deprecated. They may be removed in a future release. Since they are all internal functions, this should have no impact on properly behaving programs. .. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4 � N)�extract_params�safe_string_equals� urldecode� )�utils)� http_method� base_str_uri�%normalized_encoded_request_parameters�returnc C s> t �| �� �}|d7 }|t �|�7 }|d7 }|t �|�7 }|S )a� Construct the signature base string. The *signature base string* is the value that is calculated and signed by the client. It is also independently calculated by the server to verify the signature, and therefore must produce the exact same value at both ends or the signature won't verify. The rules for calculating the *signature base string* are defined in section 3.4.1.1`_ of RFC 5849. .. _`section 3.4.1.1`: https://tools.ietf.org/html/rfc5849#section-3.4.1.1 �&)r �escape�upper)r r r � base_string� r �E/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/signature.py�signature_base_string7 s r )�uri�hostr c C st t | t�std��t�| �}|j}|j}|j}|j}|j}|sFtd��|sNd}|� � }|durf|� � }|dur�|� � }|� d|� �}t�|�}|j}|j}|du r�td��zt � |�}W n ty� Y n0 t |t j �r�d|� d�}nt |t j �r�|� }|du�r$d | k �rd k�s$n td ��||fd v �r8|}n|�rN|� d |� �}n|}t�||||ddf�} | �dd�S )a� Calculates the _base string URI_. The *base string URI* is one of the components that make up the *signature base string*. The ``host`` is optional. If provided, it is used to override any host and port values in the ``uri``. The value for ``host`` is usually extracted from the "Host" request header from the HTTP request. Its value may be just the hostname, or the hostname followed by a colon and a TCP/IP port number (hostname:port). If a value for the``host`` is provided but it does not contain a port number, the default port number is used (i.e. if the ``uri`` contained a port number, it will be discarded). The rules for calculating the *base string URI* are defined in section 3.4.1.2`_ of RFC 5849. .. _`section 3.4.1.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.2 :param uri: URI :param host: hostname with optional port number, separated by a colon :return: base string URI zuri must be a string.zmissing scheme�/Nz://z missing host�[�]r i�� zport out of range))�http�P )�httpsi� �:� � z%20)� isinstance�str� ValueError�urlparse�scheme�hostname�port�path�params�lower� ipaddressZ ip_addressZ IPv6AddressZ IPv4Address� urlunparse�replace) r r �outputr! r" r# r$ r% �netloc�vr r r �base_string_urij sP $r- r TFc s� |du r g }|pi }g }| r*|� t| �� |rpdd� |�� D �}|�d�}|durp|� � fdd�t�|�D �� t|�pzg }|� |� g } |D ]*\} } | �d�r�t�| �} | � | | f� q�|r�t t dd � | ��} | S ) a� Gather the request parameters from all the parameter sources. This function is used to extract all the parameters, which are then passed to ``normalize_parameters`` to produce one of the components that make up the *signature base string*. Parameters starting with `oauth_` will be unescaped. Body parameters must be supplied as a dict, a list of 2-tuples, or a form encoded query string. Headers must be supplied as a dict. The rules where the parameters must be sourced from are defined in `section 3.4.1.3.1`_ of RFC 5849. .. _`Sec 3.4.1.3.1`: https://tools.ietf.org/html/rfc5849#section-3.4.1.3.1 Nc S s i | ]\}}|� � |�qS r )r& ��.0�kr, r r r � <dictcomp> � z&collect_parameters.<locals>.<dictcomp>Z authorizationc s g | ]}� s|d dkr|�qS )r Zrealmr )r/ �i�� with_realmr r � <listcomp>! s �z&collect_parameters.<locals>.<listcomp>Zoauth_c S s | d dkS )Nr Zoauth_signaturer )r3 r r r �<lambda>? r2 z$collect_parameters.<locals>.<lambda>) �extendr �items�getr Zparse_authorization_headerr � startswithZunescape�append�list�filter) Z uri_query�bodyZheadersZexclude_oauth_signaturer5 r% Z headers_lowerZauthorization_headerZ bodyparamsZunescaped_paramsr0 r, r r4 r �collect_parameters� s2 � �r@ )r c C s. dd� | D �}|� � dd� |D �}d�|�S )aV Calculate the normalized request parameters. The *normalized request parameters* is one of the components that make up the *signature base string*. The rules for parameter normalization are defined in `section 3.4.1.3.2`_ of RFC 5849. .. _`Sec 3.4.1.3.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.3.2 c S s$ g | ] \}}t �|�t �|�f�qS r �r r r. r r r r6 [ r2 z(normalize_parameters.<locals>.<listcomp>c S s g | ]\}}d � ||��qS )z{}={})�formatr. r r r r6 e r2 r )�sort�join)r% Z key_valuesZparameter_partsr r r �normalize_parametersE s rE )�hash_algorithm_name� sig_base_str� client_secret�resource_owner_secretc C s� |}t �|pd�}|d7 }|t �|p&d�7 }tjtjtjd�}|| }|�d�}|�d�} t�|| |�} t � | � � �dd� � d�S )a] **HMAC-SHA256** The "HMAC-SHA256" signature method uses the HMAC-SHA256 signature algorithm as defined in `RFC4634`_:: digest = HMAC-SHA256 (key, text) Per `section 3.4.2`_ of the spec. .. _`RFC4634`: https://tools.ietf.org/html/rfc4634 .. _`section 3.4.2`: https://tools.ietf.org/html/rfc5849#section-3.4.2 r r )�SHA-1�SHA-256�SHA-512�utf-8N���) r r �hashlibZsha1Zsha256Zsha512�encode�hmac�new�binascii� b2a_base64�digest�decode) rF rG rH rI �text�key�m�hash_algZkey_utf8Z text_utf8� signaturer r r � _sign_hmaco s � r\ �rF c C sP t |j�}t|j�}t|j||�}t| |||�}t||j�}|sLt � d|� |S )a Verify a HMAC-SHA1 signature. Per `section 3.4`_ of the spec. .. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4 To satisfy `RFC2616 section 5.2`_ item 1, the request argument's uri attribute MUST be an absolute URI whose netloc part identifies the origin server or gateway on which the resource resides. Any Host item of the request argument's headers dict attribute will be ignored. .. _`RFC2616 section 5.2`: https://tools.ietf.org/html/rfc2616#section-5.2 z-Verify HMAC failed: signature base string: %s) rE r% r- r r r r\ r r[ �log�debug) rF �requestrH rI � norm_params�bs_urirG r[ �matchr r r � _verify_hmac� s �� rd c C s t d| |j|j�S �NrJ �r\ rH rI �rG �clientr r r �sign_hmac_sha1_with_client� s �ri c C s t d| ||�S re �rd �r` rH rI r r r �verify_hmac_sha1� s rl c C s2 t �dt� t| t�r | �d�n| } td| ||�S )aU Deprecated function for calculating a HMAC-SHA1 signature. This function has been replaced by invoking ``sign_hmac`` with "SHA-1" as the hash algorithm name. This function was invoked by sign_hmac_sha1_with_client and test_signatures.py, but does any application invoke it directly? If not, it can be removed. z8use sign_hmac_sha1_with_client instead of sign_hmac_sha1�asciirJ ��warnings�warn�DeprecationWarningr �bytesrV r\ �r rH rI r r r �sign_hmac_sha1� s �� ��rt c C s t d| |j|j�S �NrK rf rg r r r � sign_hmac_sha256_with_client� s �rv c C s t d| ||�S ru rj rk r r r �verify_hmac_sha256� s �rw c C s2 t �dt� t| t�r | �d�n| } td| ||�S )a[ Deprecated function for calculating a HMAC-SHA256 signature. This function has been replaced by invoking ``sign_hmac`` with "SHA-256" as the hash algorithm name. This function was invoked by sign_hmac_sha256_with_client and test_signatures.py, but does any application invoke it directly? If not, it can be removed. z<use sign_hmac_sha256_with_client instead of sign_hmac_sha256rm rK rn rs r r r �sign_hmac_sha256� s � � ��rx )rG c C s t d| |j|j�S �NrL rf rg r r r � sign_hmac_sha512_with_client s �rz )rH rI c C s t d| ||�S ry rj rk r r r �verify_hmac_sha512! s �r{ c C s | t v rt | S dS dS )z� Obtains an RSAAlgorithm object that implements RSA with the hash algorithm. This method maintains the ``_jwt_rsa`` cache. Returns a jwt.algorithm.RSAAlgorithm. N)�_jwt_rsar] r r r �_get_jwt_rsa_algorithm- s r} c C s t |t�r|�d�}| �|�S )a$ Prepare a PEM encoded key (public or private), by invoking the `prepare_key` method on alg with the keystr. The keystr should be a string or bytes. If the keystr is bytes, it is decoded as UTF-8 before being passed to prepare_key. Otherwise, it is passed directly. rM )r rr rV Z prepare_key)�algZkeystrr r r �_prepare_key_plusI s r )rF rG �rsa_private_keyc C s` t d��t| �}|s(t d|jj d ��|�d�}t||�}|�||�}t�|�dd� � d�S )a Calculate the signature for an RSA-based signature method. The ``alg`` is used to calculate the digest over the signature base string. For the "RSA_SHA1" signature method, the alg must be SHA-1. While OAuth 1.0a only defines the RSA-SHA1 signature method, this function can be used for other non-standard signature methods that only differ from RSA-SHA1 by the digest algorithm. Signing for the RSA-SHA1 signature method is defined in `section 3.4.3`_ of RFC 5849. The RSASSA-PKCS1-v1_5 signature algorithm used defined by `RFC3447, Section 8.2`_ (also known as PKCS#1), with the `alg` as the hash function for EMSA-PKCS1-v1_5. To use this method, the client MUST have established client credentials with the server that included its RSA public key (in a manner that is beyond the scope of this specification). .. _`section 3.4.3`: https://tools.ietf.org/html/rfc5849#section-3.4.3 .. _`RFC3447, Section 8.2`: https://tools.ietf.org/html/rfc3447#section-8.2 zInvalid signature method.z&rsa_private_key required for RSA with z signature methodrm NrN ) r r} rZ �namerP r �signrS rT rV )rF rG r� r~ rY rX �sr r r � _sign_rsaW s �� r� )rF �rsa_public_keyc C s� z~t |j�}t|j�}t|j||�}t�|j� d��}t | �}t ||�}|� |� d�||�} | szt �d|jj d | � | W S ty� Y dS 0 dS )a� Verify a base64 encoded signature for a RSA-based signature method. The ``alg`` is used to calculate the digest over the signature base string. For the "RSA_SHA1" signature method, the alg must be SHA-1. While OAuth 1.0a only defines the RSA-SHA1 signature method, this function can be used for other non-standard signature methods that only differ from RSA-SHA1 by the digest algorithm. Verification for the RSA-SHA1 signature method is defined in `section 3.4.3`_ of RFC 5849. .. _`section 3.4.3`: https://tools.ietf.org/html/rfc5849#section-3.4.3 To satisfy `RFC2616 section 5.2`_ item 1, the request argument's uri attribute MUST be an absolute URI whose netloc part identifies the origin server or gateway on which the resource resides. Any Host item of the request argument's headers dict attribute will be ignored. .. _`RFC2616 Sec 5.2`: https://tools.ietf.org/html/rfc2616#section-5.2 rm zVerify failed: RSA with z: signature base string=%sFN)rE r% r- r r r rS Z a2b_base64r[ rP r} r Zverifyr^ r_ rZ r� � UnicodeError) rF r` r� ra rb rG Zsigr~ rX Z verify_okr r r � _verify_rsa� s& � �� r� c C s t d��d S �Nz8RSA-SHA1 is deprecated, use a stronger hash or HMAC-SHA1�r rg r r r �sign_rsa_sha1_with_client� s r� )r� c C s t d��d S r� r� �r` r� r r r �verify_rsa_sha1� s r� c C s t d��d S r� r� )r r� r r r � sign_rsa_sha1� s r� c C s t d| |j�S ru �r� Zrsa_keyrg r r r �sign_rsa_sha256_with_client� s r� c C s t d| |�S ru �r� r� r r r �verify_rsa_sha256� s r� c C s t d| |j�S ry r� rg r r r �sign_rsa_sha512_with_client� s r� c C s t d| |�S ry r� r� r r r �verify_rsa_sha512 s r� c C s t |j|j�S )N)�sign_plaintextrH rI )Z_signature_base_stringrh r r r �sign_plaintext_with_client s r� c C s, t �| p d�}|d7 }|t �|p"d�7 }|S )a� Sign a request using plaintext. Per `section 3.4.4`_ of the spec. The "PLAINTEXT" method does not employ a signature algorithm. It MUST be used with a transport-layer mechanism such as TLS or SSL (or sent over a secure channel with equivalent protections). It does not utilize the signature base string or the "oauth_timestamp" and "oauth_nonce" parameters. .. _`section 3.4.4`: https://tools.ietf.org/html/rfc5849#section-3.4.4 r r rA )rH rI r[ r r r r� s r� c C s( t ||�}t|| j�}|s$t�d� |S )z�Verify a PLAINTEXT signature. Per `section 3.4`_ of the spec. .. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4 zVerify PLAINTEXT failed)r� r r[ r^ r_ )r` rH rI r[ rc r r r �verify_plaintext/ s r� )N)r NNTF)NN)NN)NN)NN)NN)1�__doc__rS rO rQ r' Zloggingro Zoauthlib.commonr r r � urllib.parse�parser r r Z getLogger�__name__r^ r r r- r@ rE r\ rd ri rl rt rv rw rx rz r{ r| r} r r� r� r� r� r� r� r� r� r� r� r� r� r r r r �<module> sz $ � 3 � W*� C �! �� � ?� Q#