403Webshell
Server IP : 192.158.238.246  /  Your IP : 18.117.216.191
Web Server : LiteSpeed
System : Linux uniform.iwebfusion.net 4.18.0-553.27.1.lve.1.el8.x86_64 #1 SMP Wed Nov 20 15:58:00 UTC 2024 x86_64
User : jenniferflocom ( 1321)
PHP Version : 8.1.32
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /usr/lib/python3.6/site-packages/oauthlib/oauth1/rfc5849/__pycache__/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ Back ]     

Current File : /usr/lib/python3.6/site-packages/oauthlib/oauth1/rfc5849/__pycache__/signature.cpython-36.opt-1.pyc
3

,�[A\�
@s$dZddlmZmZddlZddlZddlZddlZddlm	Z	m
Z
mZmZm
Z
ddlmZyddlZWnek
r�ddljZYnXeje�Zdd�Zd(d	d
�Zdgddd
fdd�Zdd�Zdd�Zdd�Zdadd�Zdd�Zdd�Z dd�Z!dd�Z"d)d d!�Z#d"d#�Z$d$d%�Z%d*d&d'�Z&dS)+a�
oauthlib.oauth1.rfc5849.signature
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This module represents a direct implementation of `section 3.4`_ of the spec.

Terminology:
 * Client: software interfacing with an OAuth API
 * Server: the API provider
 * Resource Owner: the user who is granting authorization to the client

Steps for signing a request:

1. Collect parameters from the uri query, auth header, & body
2. Normalize those parameters
3. Normalize the uri
4. Pass the normalized uri, normalized parameters, and http method to
   construct the base string
5. Pass the base string and any keys needed to a signing function

.. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4
�)�absolute_import�unicode_literalsN)�
bytes_type�extract_params�safe_string_equals�unicode_type�	urldecode�)�utilscCs>tj|j��}|d7}|tj|�7}|d7}|tj|�7}|S)aY**String Construction**
    Per `section 3.4.1.1`_ of the spec.

    For example, the HTTP request::

        POST /request?b5=%3D%253D&a3=a&c%40=&a2=r%20b HTTP/1.1
        Host: example.com
        Content-Type: application/x-www-form-urlencoded
        Authorization: OAuth realm="Example",
            oauth_consumer_key="9djdj82h48djs9d2",
            oauth_token="kkk9d7dh3k39sjv7",
            oauth_signature_method="HMAC-SHA1",
            oauth_timestamp="137131201",
            oauth_nonce="7d8f3e4a",
            oauth_signature="bYT5CMsGcbgUdFHObYMEfcx6bsw%3D"

        c2&a3=2+q

    is represented by the following signature base string (line breaks
    are for display purposes only)::

        POST&http%3A%2F%2Fexample.com%2Frequest&a2%3Dr%2520b%26a3%3D2%2520q
        %26a3%3Da%26b5%3D%253D%25253D%26c%2540%3D%26c2%3D%26oauth_consumer_
        key%3D9djdj82h48djs9d2%26oauth_nonce%3D7d8f3e4a%26oauth_signature_m
        ethod%3DHMAC-SHA1%26oauth_timestamp%3D137131201%26oauth_token%3Dkkk
        9d7dh3k39sjv7

    .. _`section 3.4.1.1`: https://tools.ietf.org/html/rfc5849#section-3.4.1.1
    �&)r
�escape�upper)�http_methodZbase_string_uriZ%normalized_encoded_request_parameters�base_string�r�/usr/lib/python3.6/signature.py�construct_base_string+s(rc
Cs�t|t�std��tj|�\}}}}}}|s4|r<td��|sDd}|j�}|j�}|dk	rd|j�}d}d	|kr�|jd	d
�\}}	||	f|kr�|}tj||||ddf�S)aA**Base String URI**
    Per `section 3.4.1.2`_ of the spec.

    For example, the HTTP request::

        GET /r%20v/X?id=123 HTTP/1.1
        Host: EXAMPLE.COM:80

    is represented by the base string URI: "http://example.com/r%20v/X".

    In another example, the HTTPS request::

        GET /?q=1 HTTP/1.1
        Host: www.example.net:8080

    is represented by the base string URI: "https://www.example.net:8080/".

    .. _`section 3.4.1.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.2

    The host argument overrides the netloc part of the uri argument.
    zuri must be a unicode object.z$uri must include a scheme and netloc�/N�http�80�https�443�:r	��rr�rr)rr)�
isinstancer�
ValueError�urlparse�lower�splitZ
urlunparse)
�uri�host�schemeZnetloc�path�paramsZqueryZfragmentZ
default_portsZportrrr�normalize_base_string_urils$
r&rTFcs�|pi}g}|r|jt|��|rhtdd�|j�D��}|jd�}|dk	rh|j�fdd�tj|�D��t|�prg}|j|�g}	x2|D]*\}
}|
jd�r�tj	|�}|	j
|
|f�q�W|r�ttdd	�|	��}	|	S)
a=	**Parameter Sources**

    Parameters starting with `oauth_` will be unescaped.

    Body parameters must be supplied as a dict, a list of 2-tuples, or a
    formencoded query string.

    Headers must be supplied as a dict.

    Per `section 3.4.1.3.1`_ of the spec.

    For example, the HTTP request::

        POST /request?b5=%3D%253D&a3=a&c%40=&a2=r%20b HTTP/1.1
        Host: example.com
        Content-Type: application/x-www-form-urlencoded
        Authorization: OAuth realm="Example",
            oauth_consumer_key="9djdj82h48djs9d2",
            oauth_token="kkk9d7dh3k39sjv7",
            oauth_signature_method="HMAC-SHA1",
            oauth_timestamp="137131201",
            oauth_nonce="7d8f3e4a",
            oauth_signature="djosJKDKJSD8743243%2Fjdk33klY%3D"

        c2&a3=2+q

    contains the following (fully decoded) parameters used in the
    signature base sting::

        +------------------------+------------------+
        |          Name          |       Value      |
        +------------------------+------------------+
        |           b5           |       =%3D       |
        |           a3           |         a        |
        |           c@           |                  |
        |           a2           |        r b       |
        |   oauth_consumer_key   | 9djdj82h48djs9d2 |
        |       oauth_token      | kkk9d7dh3k39sjv7 |
        | oauth_signature_method |     HMAC-SHA1    |
        |     oauth_timestamp    |     137131201    |
        |       oauth_nonce      |     7d8f3e4a     |
        |           c2           |                  |
        |           a3           |        2 q       |
        +------------------------+------------------+

    Note that the value of "b5" is "=%3D" and not "==".  Both "c@" and
    "c2" have empty values.  While the encoding rules specified in this
    specification for the purpose of constructing the signature base
    string exclude the use of a "+" character (ASCII code 43) to
    represent an encoded space character (ASCII code 32), this practice
    is widely used in "application/x-www-form-urlencoded" encoded values,
    and MUST be properly decoded, as demonstrated by one of the "a3"
    parameter instances (the "a3" parameter is used twice in this
    request).

    .. _`section 3.4.1.3.1`: https://tools.ietf.org/html/rfc5849#section-3.4.1.3.1
    css|]\}}|j�|fVqdS)N)r)�.0�k�vrrr�	<genexpr>sz%collect_parameters.<locals>.<genexpr>Z
authorizationNcs g|]}�s|ddkr|�qS)rZrealmr)r'�i)�
with_realmrr�
<listcomp>sz&collect_parameters.<locals>.<listcomp>Zoauth_cSs|ddkS)NrZoauth_signaturer)r+rrr�<lambda>8sz$collect_parameters.<locals>.<lambda>)
�extendr�dict�items�getr
Zparse_authorization_headerr�
startswithZunescape�append�list�filter)Z	uri_queryZbodyZheadersZexclude_oauth_signaturer,r%Z
headers_lowerZauthorization_headerZ
bodyparamsZunescaped_paramsr(r)r)r,r�collect_parameters�s*;




r7cCs.dd�|D�}|j�dd�|D�}dj|�S)a�
**Parameters Normalization**
    Per `section 3.4.1.3.2`_ of the spec.

    For example, the list of parameters from the previous section would
    be normalized as follows:

    Encoded::

    +------------------------+------------------+
    |          Name          |       Value      |
    +------------------------+------------------+
    |           b5           |     %3D%253D     |
    |           a3           |         a        |
    |          c%40          |                  |
    |           a2           |       r%20b      |
    |   oauth_consumer_key   | 9djdj82h48djs9d2 |
    |       oauth_token      | kkk9d7dh3k39sjv7 |
    | oauth_signature_method |     HMAC-SHA1    |
    |     oauth_timestamp    |     137131201    |
    |       oauth_nonce      |     7d8f3e4a     |
    |           c2           |                  |
    |           a3           |       2%20q      |
    +------------------------+------------------+

    Sorted::

    +------------------------+------------------+
    |          Name          |       Value      |
    +------------------------+------------------+
    |           a2           |       r%20b      |
    |           a3           |       2%20q      |
    |           a3           |         a        |
    |           b5           |     %3D%253D     |
    |          c%40          |                  |
    |           c2           |                  |
    |   oauth_consumer_key   | 9djdj82h48djs9d2 |
    |       oauth_nonce      |     7d8f3e4a     |
    | oauth_signature_method |     HMAC-SHA1    |
    |     oauth_timestamp    |     137131201    |
    |       oauth_token      | kkk9d7dh3k39sjv7 |
    +------------------------+------------------+

    Concatenated Pairs::

    +-------------------------------------+
    |              Name=Value             |
    +-------------------------------------+
    |               a2=r%20b              |
    |               a3=2%20q              |
    |                 a3=a                |
    |             b5=%3D%253D             |
    |                c%40=                |
    |                 c2=                 |
    | oauth_consumer_key=9djdj82h48djs9d2 |
    |         oauth_nonce=7d8f3e4a        |
    |   oauth_signature_method=HMAC-SHA1  |
    |      oauth_timestamp=137131201      |
    |     oauth_token=kkk9d7dh3k39sjv7    |
    +-------------------------------------+

    and concatenated together into a single string (line breaks are for
    display purposes only)::

        a2=r%20b&a3=2%20q&a3=a&b5=%3D%253D&c%40=&c2=&oauth_consumer_key=9dj
        dj82h48djs9d2&oauth_nonce=7d8f3e4a&oauth_signature_method=HMAC-SHA1
        &oauth_timestamp=137131201&oauth_token=kkk9d7dh3k39sjv7

    .. _`section 3.4.1.3.2`: https://tools.ietf.org/html/rfc5849#section-3.4.1.3.2
    cSs$g|]\}}tj|�tj|�f�qSr)r
r)r'r(r)rrrr-�sz(normalize_parameters.<locals>.<listcomp>cSsg|]\}}dj||��qS)z{0}={1})�format)r'r(r)rrrr-�sr)�sort�join)r%Z
key_valuesZparameter_partsrrr�normalize_parameters>sPr;cCst||j|j�S)N)�sign_hmac_sha1�
client_secret�resource_owner_secret)r�clientrrr�sign_hmac_sha1_with_client�sr@cCsl|}tj|pd�}|d7}|tj|p&d�7}|jd�}|jd�}tj||tj�}tj|j	��dd�j
d�S)aP**HMAC-SHA1**

    The "HMAC-SHA1" signature method uses the HMAC-SHA1 signature
    algorithm as defined in `RFC2104`_::

        digest = HMAC-SHA1 (key, text)

    Per `section 3.4.2`_ of the spec.

    .. _`RFC2104`: https://tools.ietf.org/html/rfc2104
    .. _`section 3.4.2`: https://tools.ietf.org/html/rfc5849#section-3.4.2
    rrzutf-8Nr	���)r
r�encode�hmac�new�hashlibZsha1�binascii�
b2a_base64Zdigest�decode)rr=r>�text�keyZkey_utf8Z	text_utf8�	signaturerrrr<�s

r<cCs$tdkr ddlj}|j|jj�atS)Nr)�_jwtrs1Zjwt.algorithmsZ
algorithmsZRSAAlgorithmZhashesZSHA1)Zjwtalgorrr�_jwt_rs1_signing_algorithm�s
rMcCsHt|t�r|jd�}t�}t||�}|j||�}tj|�dd�jd�S)ai**RSA-SHA1**

    Per `section 3.4.3`_ of the spec.

    The "RSA-SHA1" signature method uses the RSASSA-PKCS1-v1_5 signature
    algorithm as defined in `RFC3447, Section 8.2`_ (also known as
    PKCS#1), using SHA-1 as the hash function for EMSA-PKCS1-v1_5.  To
    use this method, the client MUST have established client credentials
    with the server that included its RSA public key (in a manner that is
    beyond the scope of this specification).

    .. _`section 3.4.3`: https://tools.ietf.org/html/rfc5849#section-3.4.3
    .. _`RFC3447, Section 8.2`: https://tools.ietf.org/html/rfc3447#section-8.2

    zutf-8Nr	rA)	rrrBrM�_prepare_key_plusZsignrFrGrH)rZrsa_private_key�algrJ�srrr�
sign_rsa_sha1�s


rQcCs|jstd��t||j�S)Nz4rsa_key is required when using RSA signature method.)Zrsa_keyrrQ)rr?rrr�sign_rsa_sha1_with_client�srRcCs,tj|p
d�}|d7}|tj|p"d�7}|S)a�Sign a request using plaintext.

    Per `section 3.4.4`_ of the spec.

    The "PLAINTEXT" method does not employ a signature algorithm.  It
    MUST be used with a transport-layer mechanism such as TLS or SSL (or
    sent over a secure channel with equivalent protections).  It does not
    utilize the signature base string or the "oauth_timestamp" and
    "oauth_nonce" parameters.

    .. _`section 3.4.4`: https://tools.ietf.org/html/rfc5849#section-3.4.4

    rr)r
r)r=r>rKrrr�sign_plaintextsrScCst|j|j�S)N)rSr=r>)rr?rrr�sign_plaintext_with_client$srTcCsNt|j�}t|j�}t|j||�}t|||�}t||j�}|sJt	j
d|�|S)aVerify a HMAC-SHA1 signature.

    Per `section 3.4`_ of the spec.

    .. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4

    To satisfy `RFC2616 section 5.2`_ item 1, the request argument's uri
    attribute MUST be an absolute URI whose netloc part identifies the
    origin server or gateway on which the resource resides. Any Host
    item of the request argument's headers dict attribute will be
    ignored.

    .. _`RFC2616 section 5.2`: https://tools.ietf.org/html/rfc2616#section-5.2

    z,Verify HMAC-SHA1 failed: sig base string: %s)r;r%r&r!rrr<rrK�log�debug)�requestr=r>�norm_paramsr!rrK�matchrrr�verify_hmac_sha1(s

rZcCst|t�r|jd�}|j|�S)Nzutf-8)rrrHZprepare_key)rOZkeystrrrrrNDs

rNc	Cslt|j�}t|j�}t|j||�jd�}tj|j	jd��}t
�}t||�}|j|||�}|sht
jd|�|S)afVerify a RSASSA-PKCS #1 v1.5 base64 encoded signature.

    Per `section 3.4.3`_ of the spec.

    Note this method requires the jwt and cryptography libraries.

    .. _`section 3.4.3`: https://tools.ietf.org/html/rfc5849#section-3.4.3

    To satisfy `RFC2616 section 5.2`_ item 1, the request argument's uri
    attribute MUST be an absolute URI whose netloc part identifies the
    origin server or gateway on which the resource resides. Any Host
    item of the request argument's headers dict attribute will be
    ignored.

    .. _`RFC2616 section 5.2`: https://tools.ietf.org/html/rfc2616#section-5.2
    zutf-8z+Verify RSA-SHA1 failed: sig base string: %s)r;r%r&r!rrrBrFZ
a2b_base64rKrMrNZverifyrUrV)	rWZrsa_public_keyrXr!�messageZsigrOrJZ	verify_okrrr�verify_rsa_sha1Is


r\cCs(t||�}t||j�}|s$tjd�|S)z�Verify a PLAINTEXT signature.

    Per `section 3.4`_ of the spec.

    .. _`section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4
    zVerify PLAINTEXT failed)rSrrKrUrV)rWr=r>rKrYrrr�verify_plaintexths


r])N)NN)NN)'�__doc__Z
__future__rrrFrErCZloggingZoauthlib.commonrrrrrrr
r�ImportErrorZurllib.parse�parseZ	getLogger�__name__rUrr&r7r;r@r<rLrMrQrRrSrTrZrNr\r]rrrr�<module>s<
A
Wzb1#


Youez - 2016 - github.com/yon3zu
LinuXploit