| Server IP : 15.235.198.142 / Your IP : 216.73.216.190 Web Server : Apache/2.4.58 (Ubuntu) System : Linux ballsack 6.8.0-45-generic #45-Ubuntu SMP PREEMPT_DYNAMIC Fri Aug 30 12:02:04 UTC 2024 x86_64 User : www-data ( 33) PHP Version : 8.3.6 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : OFF Directory : /lib/python3/dist-packages/oauthlib/oauth1/rfc5849/__pycache__/ |
Upload File : |
�
�McL} � �� � d Z ddlZddlZddlZddlZddlZddlmZ ddl Z ddl
m Z m Z m
Z
ddlmZ ej e� Zdededed efd
�Zd.d ed ed efd
�Z d/d�Zd efd�Zdedededefd�Z d0defd�Zd� Zd0d�Zd� Z d� Z d0d�Z d� Z defd �Z d0dedefd �Z!i Z"defd �Z#d � Z$deded efd!�Z%ded"efd#�Z&d$� Z'd"efd%�Z(d&� Z)defd'�Z*d"efd(�Z+defd)�Z,d"efd*�Z-d+� Z.d,� Z/d0d-�Z0y)1a�
This module is an implementation of `section 3.4`_ of RFC 5849.
**Usage**
Steps for signing a request:
1. Collect parameters from the request using ``collect_parameters``.
2. Normalize those parameters using ``normalize_parameters``.
3. Create the *base string URI* using ``base_string_uri``.
4. Create the *signature base string* from the above three components
using ``signature_base_string``.
5. Pass the *signature base string* and the client credentials to one of the
sign-with-client functions. The HMAC-based signing functions needs
client credentials with secrets. The RSA-based signing functions needs
client credentials with an RSA private key.
To verify a request, pass the request and credentials to one of the verify
functions. The HMAC-based signing functions needs the shared secrets. The
RSA-based verify functions needs the RSA public key.
**Scope**
All of the functions in this module should be considered internal to OAuthLib,
since they are not imported into the "oauthlib.oauth1" module. Programs using
OAuthLib should not use directly invoke any of the functions in this module.
**Deprecated functions**
The "sign_" methods that are not "_with_client" have been deprecated. They may
be removed in a future release. Since they are all internal functions, this
should have no impact on properly behaving programs.
.. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4
� N)�extract_params�safe_string_equals� urldecode� )�utils� http_method� base_str_uri�%normalized_encoded_request_parameters�returnc � � t j | j � � }|dz
}|t j |� z
}|dz
}|t j |� z
}|S )a�
Construct the signature base string.
The *signature base string* is the value that is calculated and signed by
the client. It is also independently calculated by the server to verify
the signature, and therefore must produce the exact same value at both
ends or the signature won't verify.
The rules for calculating the *signature base string* are defined in
section 3.4.1.1`_ of RFC 5849.
.. _`section 3.4.1.1`: https://tools.ietf.org/html/rfc5849#section-3.4.1.1
�&)r �escape�upper)r r r
� base_strings �C/usr/lib/python3/dist-packages/oauthlib/oauth1/rfc5849/signature.py�signature_base_stringr 6 sd � �4 �,�,�{� 0� 0� 2�3�K� �3��K� �5�<�<� �-�-�K� �3��K� �5�<�<� E�F�F�K� �� �uri�hostc �x � t | t � s t d� �t j | � }|j }|j
}|j }|j }|j }|s t d� �|sd}|j � }|�|j � }|�D|j � }|� d|� �}t j |� }|j
}|j }|� t d� � t j |� }t |t j � rd|� d�}n t |t j � r|� }|�"d|cxk rd k st d
� � t d
� �||fd v r|}n |r|� d |� �}n|}t j ||||d
d
f� } | j dd� S # t $ r Y ��w xY w)a�
Calculates the _base string URI_.
The *base string URI* is one of the components that make up the
*signature base string*.
The ``host`` is optional. If provided, it is used to override any host and
port values in the ``uri``. The value for ``host`` is usually extracted from
the "Host" request header from the HTTP request. Its value may be just the
hostname, or the hostname followed by a colon and a TCP/IP port number
(hostname:port). If a value for the``host`` is provided but it does not
contain a port number, the default port number is used (i.e. if the ``uri``
contained a port number, it will be discarded).
The rules for calculating the *base string URI* are defined in
section 3.4.1.2`_ of RFC 5849.
.. _`section 3.4.1.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.2
:param uri: URI
:param host: hostname with optional port number, separated by a colon
:return: base string URI
zuri must be a string.zmissing scheme�/z://z missing host�[�]r i�� zport out of range))�http�P )�httpsi� �:� � z%20)�
isinstance�str�
ValueError�urlparse�scheme�hostname�port�path�params�lower� ipaddress�
ip_address� IPv6Address� IPv4Address�
urlunparse�replace)
r r �outputr$ r% r& r' r( �netloc�vs
r �base_string_urir3 i s� � �2 �c�3� ��0�1�1� �
�
�s�
#�F�
�]�]�F����H� �;�;�D� �;�;�D�
�]�]�F� ��)�*�*� ��� �\�\�^�F����>�>�#�� ��
�z�z�|�����T�F�#���"�"�4�(���?�?���{�{�� ��� �(�(�
� �'�'��1�� �(�I� 1� 1�2��x�j��?�� �H�i� 3� 3� 4� �Z�� ���T�!2�U�!2��,�-�-� "3��,�-�-���~�7�7���
� �:�Q�t�f�%�������V�V�T�6�2�r� B�C�A�0
�9�9�S�%� � ��S �
� �
�s �4F- �- F9�8F9c �j � |�g }|xs i }g }| r|j t | � � |r�|j � D ��ci c] \ }}|j � |�� }}}|j d� } | �<|j t j | � D �
cg c] }
|s|
d dk7 r|
�� c}
� t |� xs g } |j | � g } |D ]> \ }}|j d� rt j |� }| j ||f� �@ |rt t d� | � � } | S c c}}w c c}
w )a�
Gather the request parameters from all the parameter sources.
This function is used to extract all the parameters, which are then passed
to ``normalize_parameters`` to produce one of the components that make up
the *signature base string*.
Parameters starting with `oauth_` will be unescaped.
Body parameters must be supplied as a dict, a list of 2-tuples, or a
form encoded query string.
Headers must be supplied as a dict.
The rules where the parameters must be sourced from are defined in
`section 3.4.1.3.1`_ of RFC 5849.
.. _`Sec 3.4.1.3.1`: https://tools.ietf.org/html/rfc5849#section-3.4.1.3.1
�
authorizationr �realm�oauth_c � � | d dk7 S )Nr �oauth_signature� )�is r �<lambda>z$collect_parameters.<locals>.<lambda>> s � ��1��9J�1J� r )
�extendr �itemsr) �getr �parse_authorization_headerr �
startswith�unescape�append�list�filter)
� uri_query�body�headers�exclude_oauth_signature�
with_realmr( �kr2 �
headers_lower�authorization_headerr; �
bodyparams�unescaped_paramss
r �collect_parametersrP � sI � �* �|����m��G�
�F� ��
�
�i� �*�+� �29�-�-�/�B�$�!�Q�����A� �B�
�B� ,� 0� 0� � A� � � +� �M�M�e�&F�&F�$�'&� H��)3�q��t�w�� � H�
I�" ��%�+��J�
�M�M�*� � ��� (���1� �<�<�� !����q�!�A�� � ��A��'�(� � ��'J�'7�!9� :�� ���I C��Hs �D*�D0c � � | D ��cg c]/ \ }}t j |� t j |� f��1 }}}|j � |D ��cg c] \ }}dj ||� �� }}}dj |� S c c}}w c c}}w )aV
Calculate the normalized request parameters.
The *normalized request parameters* is one of the components that make up
the *signature base string*.
The rules for parameter normalization are defined in `section 3.4.1.3.2`_ of
RFC 5849.
.. _`Sec 3.4.1.3.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.3.2
z{}={}r
)r r �sort�format�join)r( rK r2 �
key_values�parameter_partss r �normalize_parametersrW D s� � �, BH�H���A�5�<�<��?�E�L�L��O�4�H�J�H�
�O�O��
9C�C���1�w�~�~�a��+�C�O�C�
�8�8�O� $�$�� I�� Ds �4B� B�hash_algorithm_name� sig_base_str�
client_secret�resource_owner_secretc � � |}t j |xs d� }|dz
}|t j |xs d� z
}t j t j t j
d�}|| }|j
d� }|j
d� } t j || |� }
t j |
j � � dd j d� S )a]
**HMAC-SHA256**
The "HMAC-SHA256" signature method uses the HMAC-SHA256 signature
algorithm as defined in `RFC4634`_::
digest = HMAC-SHA256 (key, text)
Per `section 3.4.2`_ of the spec.
.. _`RFC4634`: https://tools.ietf.org/html/rfc4634
.. _`section 3.4.2`: https://tools.ietf.org/html/rfc5849#section-3.4.2
r r
��SHA-1�SHA-256�SHA-512�utf-8N���)
r r �hashlib�sha1�sha256�sha512�encode�hmac�new�binascii�
b2a_base64�digest�decode) rX rY rZ r[ �text�key�m�hash_alg�key_utf8� text_utf8� signatures r �
_sign_hmacru n s� � �0 �D� �,�,�}�*��
+�C� �3�J�C�
�5�<�<�-�3�� 4�4�C�
� � ��>�>��>�>� �A�
�$�%�H�
�z�z�'�"�H�� � �G�$�I�����9�h�7�I� � � �y� /� /� 1� 2�3�B� 7� >� >�w� G�Gr c � � t |j � }t |j � }t |j
||� }t
| |||� }t ||j � }|st j d|� |S )a Verify a HMAC-SHA1 signature.
Per `section 3.4`_ of the spec.
.. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4
To satisfy `RFC2616 section 5.2`_ item 1, the request argument's uri
attribute MUST be an absolute URI whose netloc part identifies the
origin server or gateway on which the resource resides. Any Host
item of the request argument's headers dict attribute will be
ignored.
.. _`RFC2616 section 5.2`: https://tools.ietf.org/html/rfc2616#section-5.2
z-Verify HMAC failed: signature base string: %s) rW r( r3 r r r ru r rt �log�debug) rX �requestrZ r[ � norm_params�bs_urirY rt �matchs r � _verify_hmacr} � sv � �& '�w�~�~�6�K�
�W�[�[�
)�F�(��)<�)<�f�)4�6�L��.� �(�*?�A�I� �y�'�*;�*;� <�E� � � � �A�<�P� �Lr c �F � t d| |j |j � S �Nr^ �ru rZ r[ �rY �clients r �sign_hmac_sha1_with_clientr� � s& � � �g�|� �*�*�F�,H�,H� J� Jr c � � t d| ||� S r �r} �ry rZ r[ s r �verify_hmac_sha1r� � s � � ���-�9N� O�Or c � � t j dt � t | t � r| j d� n| } t
d| ||� S )aU
Deprecated function for calculating a HMAC-SHA1 signature.
This function has been replaced by invoking ``sign_hmac`` with "SHA-1"
as the hash algorithm name.
This function was invoked by sign_hmac_sha1_with_client and
test_signatures.py, but does any application invoke it directly? If not,
it can be removed.
z8use sign_hmac_sha1_with_client instead of sign_hmac_sha1�asciir^ ��warnings�warn�DeprecationWarningr �bytesrm ru �r rZ r[ s r �sign_hmac_sha1r� � sS � �
�M�M�L�$�&� �k�5� )� �$�$�W�-�/:� � �g�{�#�%:� <� <r c �F � t d| |j |j � S �Nr_ r� r� s r � sign_hmac_sha256_with_clientr� � s& � � �i� � �*�*�F�,H�,H� J� Jr c � � t d| ||� S r� r� r� s r �verify_hmac_sha256r� � s � � � �7�%�'<� >� >r c � � t j dt � t | t � r| j d� n| } t
d| ||� S )a[
Deprecated function for calculating a HMAC-SHA256 signature.
This function has been replaced by invoking ``sign_hmac`` with "SHA-256"
as the hash algorithm name.
This function was invoked by sign_hmac_sha256_with_client and
test_signatures.py, but does any application invoke it directly? If not,
it can be removed.
z<use sign_hmac_sha256_with_client instead of sign_hmac_sha256r� r_ r� r� s r �sign_hmac_sha256r� � sS � �
�M�M�F�� � �k�5� )� �$�$�W�-�/:� � �i��#�%:� <� <r c �F � t d| |j |j � S �Nr` r� r� s r � sign_hmac_sha512_with_clientr� s& � � �i� � �*�*�F�,H�,H� J� Jr c � � t d| ||� S r� r� r� s r �verify_hmac_sha512r� s � � � �7�%�'<� >� >r c �� � | t v r t | S ddlm} |j j |j j
|j j d�}|j || � }|t | < |S )z�
Obtains an RSAAlgorithm object that implements RSA with the hash algorithm.
This method maintains the ``_jwt_rsa`` cache.
Returns a jwt.algorithm.RSAAlgorithm.
r Nr] )�_jwt_rsa�jwt.algorithms�
algorithms�hashes�SHA1�SHA256�SHA512� RSAAlgorithm)rX �jwt_algorithmsrp r2 s r �_get_jwt_rsa_algorithmr� , sy � � �h�&��+�,�,�
0�#�*�*�/�/�%�,�,�3�3�%�,�,�3�3�
��
� '� '��*=�(>� ?��()��$�%��r c �f � t |t � r|j d� }| j |� S )a$
Prepare a PEM encoded key (public or private), by invoking the `prepare_key`
method on alg with the keystr.
The keystr should be a string or bytes. If the keystr is bytes, it is
decoded as UTF-8 before being passed to prepare_key. Otherwise, it
is passed directly.
ra )r r� rm � prepare_key)�alg�keystrs r �_prepare_key_plusr� H s+ � � �&�%� �� � �w�'�� �?�?�6� "�"r �rsa_private_keyc � � t | � }|s%t d|j j z dz � �|j d� }t ||� }|j
||� }t j |� dd j d� S )a
Calculate the signature for an RSA-based signature method.
The ``alg`` is used to calculate the digest over the signature base string.
For the "RSA_SHA1" signature method, the alg must be SHA-1. While OAuth 1.0a
only defines the RSA-SHA1 signature method, this function can be used for
other non-standard signature methods that only differ from RSA-SHA1 by the
digest algorithm.
Signing for the RSA-SHA1 signature method is defined in
`section 3.4.3`_ of RFC 5849.
The RSASSA-PKCS1-v1_5 signature algorithm used defined by
`RFC3447, Section 8.2`_ (also known as PKCS#1), with the `alg` as the
hash function for EMSA-PKCS1-v1_5. To
use this method, the client MUST have established client credentials
with the server that included its RSA public key (in a manner that is
beyond the scope of this specification).
.. _`section 3.4.3`: https://tools.ietf.org/html/rfc5849#section-3.4.3
.. _`RFC3447, Section 8.2`: https://tools.ietf.org/html/rfc3447#section-8.2
z&rsa_private_key required for RSA with z signature methodr� Nrb )
r� r" rq �namerg r� �signrj rk rm )rX rY r� r� rp ro �ss r � _sign_rsar� V s� � �8 !�!4�
5�C� ��A� � � �*�*�+�-@�A� B� B� ���G�$�A� �C� �
1�C� ����C��A� � � �q� !�#�2� &� -� -�g� 6�6r �rsa_public_keyc �� � t |j � }t |j � }t |j
||� }t
j |j j d� � }t | � }t ||� }|j |j d� ||� } | s2t j d|j j z dz |z � | S # t" $ r Y yw xY w)a�
Verify a base64 encoded signature for a RSA-based signature method.
The ``alg`` is used to calculate the digest over the signature base string.
For the "RSA_SHA1" signature method, the alg must be SHA-1. While OAuth 1.0a
only defines the RSA-SHA1 signature method, this function can be used for
other non-standard signature methods that only differ from RSA-SHA1 by the
digest algorithm.
Verification for the RSA-SHA1 signature method is defined in
`section 3.4.3`_ of RFC 5849.
.. _`section 3.4.3`: https://tools.ietf.org/html/rfc5849#section-3.4.3
To satisfy `RFC2616 section 5.2`_ item 1, the request argument's uri
attribute MUST be an absolute URI whose netloc part identifies the
origin server or gateway on which the resource resides. Any Host
item of the request argument's headers dict attribute will be
ignored.
.. _`RFC2616 Sec 5.2`: https://tools.ietf.org/html/rfc2616#section-5.2
r� zVerify failed: RSA with z: signature base string=%sF)rW r( r3 r r r rj �
a2b_base64rt rg r� r� �verifyrw rx rq r� � UnicodeError)
rX ry r� rz r{ rY �sigr� ro � verify_oks
r � _verify_rsar� � s� � �42� +�7�>�>�:� � ����-��,� � � ���6� �
�!�!�'�"3�"3�":�":�7�"C�D�� %�%8�9�� ��^�4�� �J�J�|� 2� 2�7� ;�S�#�F� �� �I�I�0�3�<�<�3D�3D�D�2�3�5A�B�
C���� � � � �s �C C � C,�+C,c �v � t | t � r| j d� n| } t d| |j � S )Nr� r^ )r r� rm r� �rsa_keyr� s r �sign_rsa_sha1_with_clientr� � s; � � �l�E� *� �&�&�w�/�0<� � �W�l�F�N�N� ;�;r c � � t d| |� S r �r� �ry r� s r �verify_rsa_sha1r� � s � � �w�� � 8�8r c � � t j dt � t | t � r| j d� } t
d| |� S )aR
Deprecated function for calculating a RSA-SHA1 signature.
This function has been replaced by invoking ``sign_rsa`` with "SHA-1"
as the hash algorithm name.
This function was invoked by sign_rsa_sha1_with_client and
test_signatures.py, but does any application invoke it directly? If not,
it can be removed.
z4use _sign_rsa("SHA-1", ...) instead of sign_rsa_sha1r� r^ )r� r� r� r r� rm r� )r r� s r �
sign_rsa_sha1r� � sA � �
�M�M�H�$�&� �+�u�%�!�(�(��1� � �W�k�?� ;�;r c �0 � t d| |j � S r� �r� r� r� s r �sign_rsa_sha256_with_clientr� � � � �Y� �f�n�n� =�=r c � � t d| |� S r� r� r� s r �verify_rsa_sha256r� � � � �y�'�>� :�:r c �0 � t d| |j � S r� r� r� s r �sign_rsa_sha512_with_clientr� r� r c � � t d| |� S r� r� r� s r �verify_rsa_sha512r� r� r c �B � t |j |j � S �N)�sign_plaintextrZ r[ )�_signature_base_stringr� s r �sign_plaintext_with_clientr� s � � �&�.�.��0L�0L� M�Mr c �z � t j | xs d� }|dz
}|t j |xs d� z
}|S )a� Sign a request using plaintext.
Per `section 3.4.4`_ of the spec.
The "PLAINTEXT" method does not employ a signature algorithm. It
MUST be used with a transport-layer mechanism such as TLS or SSL (or
sent over a secure channel with equivalent protections). It does not
utilize the signature base string or the "oauth_timestamp" and
"oauth_nonce" parameters.
.. _`section 3.4.4`: https://tools.ietf.org/html/rfc5849#section-3.4.4
r r
)r r )rZ r[ rt s r r� r� & sD � �* � � �]� 0�b�1�I� ���I�
�� � � 3� 9�r�:�:�I� �r c �x � t ||� }t || j � }|st j d� |S )z�Verify a PLAINTEXT signature.
Per `section 3.4`_ of the spec.
.. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4
zVerify PLAINTEXT failed)r� r rt rw rx )ry rZ r[ rt r| s r �verify_plaintextr� I s8 � � �}�.C�D�I� �y�'�*;�*;� <�E� � � � �+�,� �Lr r� )r NNTF)NN)1�__doc__rj rc rh r* �logging� urllib.parse�parser# r� �oauthlib.commonr r r r r � getLogger�__name__rw r! r r3 rP rW ru r} r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r: r r �<module>r� s� ��"�H � � � � � � � I� I� ��g����!��
0��0��0� 03�0� 8;�0�fA!�� A!�C� A!�3� A!�H 9=�@E�T �n%%�C� %%�T>H�C� >H� �>H� !�>H� '*�>H�F $�'+� �c� �BJ�
P�<�6J�
>�
<�8J�s� J� -1�48�>�&)�>�.1�>� ���� �8 #� ;7�3� ;7� �;7� "�;7�|L�S� L� #�L�b
<�9�S� 9�<�,>�c� >�;�s� ;� >�c� >�;�s� ;� N� �F r