D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
lib
/
python3.6
/
site-packages
/
oauthlib
/
oauth1
/
rfc5849
/
__pycache__
/
Filename :
signature.cpython-36.opt-1.pyc
back
Copy
3 ,�[A\ � @ s$ d Z ddlmZmZ ddlZddlZddlZddlZddlm Z m Z m Z m Z m Z ddlmZ y ddlZW n ek r� ddljZY nX eje�Zdd� Zd(d d �Zd g dd d fdd�Zdd� Zdd� Zdd� Z da dd� Z dd� Z dd� Z d d � Z!d d � Z"d)d d!�Z#d"d#� Z$d$d%� Z%d*d&d'�Z&dS )+a� oauthlib.oauth1.rfc5849.signature ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This module represents a direct implementation of `section 3.4`_ of the spec. Terminology: * Client: software interfacing with an OAuth API * Server: the API provider * Resource Owner: the user who is granting authorization to the client Steps for signing a request: 1. Collect parameters from the uri query, auth header, & body 2. Normalize those parameters 3. Normalize the uri 4. Pass the normalized uri, normalized parameters, and http method to construct the base string 5. Pass the base string and any keys needed to a signing function .. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4 � )�absolute_import�unicode_literalsN)� bytes_type�extract_params�safe_string_equals� unicode_type� urldecode� )�utilsc C s> t j| j� �}|d7 }|t j|�7 }|d7 }|t j|�7 }|S )aY **String Construction** Per `section 3.4.1.1`_ of the spec. For example, the HTTP request:: POST /request?b5=%3D%253D&a3=a&c%40=&a2=r%20b HTTP/1.1 Host: example.com Content-Type: application/x-www-form-urlencoded Authorization: OAuth realm="Example", oauth_consumer_key="9djdj82h48djs9d2", oauth_token="kkk9d7dh3k39sjv7", oauth_signature_method="HMAC-SHA1", oauth_timestamp="137131201", oauth_nonce="7d8f3e4a", oauth_signature="bYT5CMsGcbgUdFHObYMEfcx6bsw%3D" c2&a3=2+q is represented by the following signature base string (line breaks are for display purposes only):: POST&http%3A%2F%2Fexample.com%2Frequest&a2%3Dr%2520b%26a3%3D2%2520q %26a3%3Da%26b5%3D%253D%25253D%26c%2540%3D%26c2%3D%26oauth_consumer_ key%3D9djdj82h48djs9d2%26oauth_nonce%3D7d8f3e4a%26oauth_signature_m ethod%3DHMAC-SHA1%26oauth_timestamp%3D137131201%26oauth_token%3Dkkk 9d7dh3k39sjv7 .. _`section 3.4.1.1`: https://tools.ietf.org/html/rfc5849#section-3.4.1.1 �&)r �escape�upper)� http_methodZbase_string_uriZ%normalized_encoded_request_parameters� base_string� r � /usr/lib/python3.6/signature.py�construct_base_string+ s (r c C s� t | t�std��tj| �\}}}}}}| s4| r<td��|sDd}|j� }|j� }|dk rd|j� }d}d |kr�|jd d �\}} || f|kr�|}tj||||d d f�S )aA **Base String URI** Per `section 3.4.1.2`_ of the spec. For example, the HTTP request:: GET /r%20v/X?id=123 HTTP/1.1 Host: EXAMPLE.COM:80 is represented by the base string URI: "http://example.com/r%20v/X". In another example, the HTTPS request:: GET /?q=1 HTTP/1.1 Host: www.example.net:8080 is represented by the base string URI: "https://www.example.net:8080/". .. _`section 3.4.1.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.2 The host argument overrides the netloc part of the uri argument. z uri must be a unicode object.z$uri must include a scheme and netloc�/N�http�80�https�443�:r � �r r �r r )r r )� isinstancer � ValueError�urlparse�lower�splitZ urlunparse) �uri�host�schemeZnetloc�path�paramsZqueryZfragmentZ default_portsZportr r r �normalize_base_string_uril s$ r& r TFc s� |pi }g }| r |j t| �� |rhtdd� |j� D ��}|jd�}|dk rh|j � fdd�tj|�D �� t|�prg }|j |� g } x2|D ]*\} } | jd�r�tj | �} | j | | f� q�W |r�t t dd � | ��} | S ) a= **Parameter Sources** Parameters starting with `oauth_` will be unescaped. Body parameters must be supplied as a dict, a list of 2-tuples, or a formencoded query string. Headers must be supplied as a dict. Per `section 3.4.1.3.1`_ of the spec. For example, the HTTP request:: POST /request?b5=%3D%253D&a3=a&c%40=&a2=r%20b HTTP/1.1 Host: example.com Content-Type: application/x-www-form-urlencoded Authorization: OAuth realm="Example", oauth_consumer_key="9djdj82h48djs9d2", oauth_token="kkk9d7dh3k39sjv7", oauth_signature_method="HMAC-SHA1", oauth_timestamp="137131201", oauth_nonce="7d8f3e4a", oauth_signature="djosJKDKJSD8743243%2Fjdk33klY%3D" c2&a3=2+q contains the following (fully decoded) parameters used in the signature base sting:: +------------------------+------------------+ | Name | Value | +------------------------+------------------+ | b5 | =%3D | | a3 | a | | c@ | | | a2 | r b | | oauth_consumer_key | 9djdj82h48djs9d2 | | oauth_token | kkk9d7dh3k39sjv7 | | oauth_signature_method | HMAC-SHA1 | | oauth_timestamp | 137131201 | | oauth_nonce | 7d8f3e4a | | c2 | | | a3 | 2 q | +------------------------+------------------+ Note that the value of "b5" is "=%3D" and not "==". Both "c@" and "c2" have empty values. While the encoding rules specified in this specification for the purpose of constructing the signature base string exclude the use of a "+" character (ASCII code 43) to represent an encoded space character (ASCII code 32), this practice is widely used in "application/x-www-form-urlencoded" encoded values, and MUST be properly decoded, as demonstrated by one of the "a3" parameter instances (the "a3" parameter is used twice in this request). .. _`section 3.4.1.3.1`: https://tools.ietf.org/html/rfc5849#section-3.4.1.3.1 c s s | ]\}}|j � |fV qd S )N)r )�.0�k�vr r r � <genexpr> s z%collect_parameters.<locals>.<genexpr>Z authorizationNc s g | ]}� s|d dkr|�qS )r Zrealmr )r' �i)� with_realmr r � <listcomp> s z&collect_parameters.<locals>.<listcomp>Zoauth_c S s | d dkS )Nr Zoauth_signaturer )r+ r r r �<lambda>8 s z$collect_parameters.<locals>.<lambda>) �extendr �dict�items�getr Zparse_authorization_headerr � startswithZunescape�append�list�filter) Z uri_queryZbodyZheadersZexclude_oauth_signaturer, r% Z headers_lowerZauthorization_headerZ bodyparamsZunescaped_paramsr( r) r )r, r �collect_parameters� s* ; r7 c C s. dd� | D �}|j � dd� |D �}dj|�S )a� **Parameters Normalization** Per `section 3.4.1.3.2`_ of the spec. For example, the list of parameters from the previous section would be normalized as follows: Encoded:: +------------------------+------------------+ | Name | Value | +------------------------+------------------+ | b5 | %3D%253D | | a3 | a | | c%40 | | | a2 | r%20b | | oauth_consumer_key | 9djdj82h48djs9d2 | | oauth_token | kkk9d7dh3k39sjv7 | | oauth_signature_method | HMAC-SHA1 | | oauth_timestamp | 137131201 | | oauth_nonce | 7d8f3e4a | | c2 | | | a3 | 2%20q | +------------------------+------------------+ Sorted:: +------------------------+------------------+ | Name | Value | +------------------------+------------------+ | a2 | r%20b | | a3 | 2%20q | | a3 | a | | b5 | %3D%253D | | c%40 | | | c2 | | | oauth_consumer_key | 9djdj82h48djs9d2 | | oauth_nonce | 7d8f3e4a | | oauth_signature_method | HMAC-SHA1 | | oauth_timestamp | 137131201 | | oauth_token | kkk9d7dh3k39sjv7 | +------------------------+------------------+ Concatenated Pairs:: +-------------------------------------+ | Name=Value | +-------------------------------------+ | a2=r%20b | | a3=2%20q | | a3=a | | b5=%3D%253D | | c%40= | | c2= | | oauth_consumer_key=9djdj82h48djs9d2 | | oauth_nonce=7d8f3e4a | | oauth_signature_method=HMAC-SHA1 | | oauth_timestamp=137131201 | | oauth_token=kkk9d7dh3k39sjv7 | +-------------------------------------+ and concatenated together into a single string (line breaks are for display purposes only):: a2=r%20b&a3=2%20q&a3=a&b5=%3D%253D&c%40=&c2=&oauth_consumer_key=9dj dj82h48djs9d2&oauth_nonce=7d8f3e4a&oauth_signature_method=HMAC-SHA1 &oauth_timestamp=137131201&oauth_token=kkk9d7dh3k39sjv7 .. _`section 3.4.1.3.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.3.2 c S s$ g | ] \}}t j|�t j|�f�qS r )r r )r' r( r) r r r r- � s z(normalize_parameters.<locals>.<listcomp>c S s g | ]\}}d j ||��qS )z{0}={1})�format)r' r( r) r r r r- � s r )�sort�join)r% Z key_valuesZparameter_partsr r r �normalize_parameters> s Pr; c C s t | |j|j�S )N)�sign_hmac_sha1� client_secret�resource_owner_secret)r �clientr r r �sign_hmac_sha1_with_client� s r@ c C sl | }t j|pd�}|d7 }|t j|p&d�7 }|jd�}|jd�}tj||tj�}tj|j � �dd� j d�S )aP **HMAC-SHA1** The "HMAC-SHA1" signature method uses the HMAC-SHA1 signature algorithm as defined in `RFC2104`_:: digest = HMAC-SHA1 (key, text) Per `section 3.4.2`_ of the spec. .. _`RFC2104`: https://tools.ietf.org/html/rfc2104 .. _`section 3.4.2`: https://tools.ietf.org/html/rfc5849#section-3.4.2 r r zutf-8Nr ���) r r �encode�hmac�new�hashlibZsha1�binascii� b2a_base64Zdigest�decode)r r= r> �text�keyZkey_utf8Z text_utf8� signaturer r r r< � s r< c C s$ t d kr dd lj} | j| jj�a t S )Nr )�_jwtrs1Zjwt.algorithmsZ algorithmsZ RSAAlgorithmZhashesZSHA1)Zjwtalgor r r �_jwt_rs1_signing_algorithm� s rM c C sH t | t�r| jd�} t� }t||�}|j| |�}tj|�dd� jd�S )ai **RSA-SHA1** Per `section 3.4.3`_ of the spec. The "RSA-SHA1" signature method uses the RSASSA-PKCS1-v1_5 signature algorithm as defined in `RFC3447, Section 8.2`_ (also known as PKCS#1), using SHA-1 as the hash function for EMSA-PKCS1-v1_5. To use this method, the client MUST have established client credentials with the server that included its RSA public key (in a manner that is beyond the scope of this specification). .. _`section 3.4.3`: https://tools.ietf.org/html/rfc5849#section-3.4.3 .. _`RFC3447, Section 8.2`: https://tools.ietf.org/html/rfc3447#section-8.2 zutf-8Nr rA ) r r rB rM �_prepare_key_plusZsignrF rG rH )r Zrsa_private_key�algrJ �sr r r � sign_rsa_sha1� s rQ c C s |j std��t| |j �S )Nz4rsa_key is required when using RSA signature method.)Zrsa_keyr rQ )r r? r r r �sign_rsa_sha1_with_client� s rR c C s, t j| p d�}|d7 }|t j|p"d�7 }|S )a� Sign a request using plaintext. Per `section 3.4.4`_ of the spec. The "PLAINTEXT" method does not employ a signature algorithm. It MUST be used with a transport-layer mechanism such as TLS or SSL (or sent over a secure channel with equivalent protections). It does not utilize the signature base string or the "oauth_timestamp" and "oauth_nonce" parameters. .. _`section 3.4.4`: https://tools.ietf.org/html/rfc5849#section-3.4.4 r r )r r )r= r> rK r r r �sign_plaintext s rS c C s t |j|j�S )N)rS r= r> )r r? r r r �sign_plaintext_with_client$ s rT c C sN t | j�}t| j�}t| j||�}t|||�}t|| j�}|sJt j d|� |S )a Verify a HMAC-SHA1 signature. Per `section 3.4`_ of the spec. .. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4 To satisfy `RFC2616 section 5.2`_ item 1, the request argument's uri attribute MUST be an absolute URI whose netloc part identifies the origin server or gateway on which the resource resides. Any Host item of the request argument's headers dict attribute will be ignored. .. _`RFC2616 section 5.2`: https://tools.ietf.org/html/rfc2616#section-5.2 z,Verify HMAC-SHA1 failed: sig base string: %s) r; r% r& r! r r r< r rK �log�debug)�requestr= r> � norm_paramsr! r rK �matchr r r �verify_hmac_sha1( s rZ c C s t |t�r|jd�}| j|�S )Nzutf-8)r r rH Z prepare_key)rO Zkeystrr r r rN D s rN c C sl t | j�}t| j�}t| j||�jd�}tj| j jd��}t � }t ||�}|j |||�}|sht jd|� |S )af Verify a RSASSA-PKCS #1 v1.5 base64 encoded signature. Per `section 3.4.3`_ of the spec. Note this method requires the jwt and cryptography libraries. .. _`section 3.4.3`: https://tools.ietf.org/html/rfc5849#section-3.4.3 To satisfy `RFC2616 section 5.2`_ item 1, the request argument's uri attribute MUST be an absolute URI whose netloc part identifies the origin server or gateway on which the resource resides. Any Host item of the request argument's headers dict attribute will be ignored. .. _`RFC2616 section 5.2`: https://tools.ietf.org/html/rfc2616#section-5.2 zutf-8z+Verify RSA-SHA1 failed: sig base string: %s)r; r% r& r! r r rB rF Z a2b_base64rK rM rN ZverifyrU rV ) rW Zrsa_public_keyrX r! �messageZsigrO rJ Z verify_okr r r �verify_rsa_sha1I s r\ c C s( t ||�}t|| j�}|s$tjd� |S )z�Verify a PLAINTEXT signature. Per `section 3.4`_ of the spec. .. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4 zVerify PLAINTEXT failed)rS r rK rU rV )rW r= r> rK rY r r r �verify_plaintexth s r] )N)NN)NN)'�__doc__Z __future__r r rF rE rC ZloggingZoauthlib.commonr r r r r r r r � ImportErrorZ urllib.parse�parseZ getLogger�__name__rU r r& r7 r; r@ r< rL rM rQ rR rS rT rZ rN r\ r] r r r r �<module> s< A Wzb1#