shell bypass 403
a
�#/d�* � @ sr d Z ddlZddlmZmZmZ ddlmZmZm Z m
Z
m Z m Z m
Z
mZmZmZmZmZmZmZ G dd� d�ZdS )z�
oauthlib.oauth1.rfc5849.endpoints.base
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This module is an implementation of various logic needed
for signing and checking OAuth 1.0 RFC 5849 requests.
� N)�CaseInsensitiveDict�Request�generate_token� )� CONTENT_TYPE_FORM_URLENCODED�SIGNATURE_HMAC_SHA1�SIGNATURE_HMAC_SHA256�SIGNATURE_HMAC_SHA512�SIGNATURE_RSA_SHA1�SIGNATURE_RSA_SHA256�SIGNATURE_RSA_SHA512�SIGNATURE_PLAINTEXT�SIGNATURE_TYPE_AUTH_HEADER�SIGNATURE_TYPE_BODY�SIGNATURE_TYPE_QUERY�errors� signature�utilsc @ s@ e Zd Zddd�Zdd� Zdd� Zdd � Zd
d � Zdd
d�ZdS )� BaseEndpointNc C s || _ |p t| _d S )N)�request_validatorr �token_generator)�selfr r � r �J/usr/lib/python3.9/site-packages/oauthlib/oauth1/rfc5849/endpoints/base.py�__init__ s zBaseEndpoint.__init__c
C s� t j|jddd�}t j|jdd�}t j|jdd�}g }|�|� |�|� |�|� ttdd� t|t �
|�ft |t �
|�ft |t �
|�ff��}t
|�dkr�d d
� |D �}tjd d �|�fd
��z|d \}}} W n ty� tjdd
��Y n0 ||| fS )z�Extracts parameters from query, headers and body. Signature type
is set to the source in which parameters were found.
FT)�headers�exclude_oauth_signatureZ
with_realm)�bodyr )� uri_queryr c S s | d S )Nr r )�sr r r �<lambda>- � z=BaseEndpoint._get_signature_type_and_params.<locals>.<lambda>� c S s g | ] }|d �qS )r r )�.0r r r r �
<listcomp>7 r! z?BaseEndpoint._get_signature_type_and_params.<locals>.<listcomp>zFoauth_ params must come from only 1 signaturetype but were found in %sz, �� descriptionr �#Missing mandatory OAuth parameters.)r Zcollect_parametersr r r �extend�list�filterr r Zfilter_oauth_paramsr r �lenr �InvalidRequestError�join�
IndexError)
r �requestZ
header_paramsZ body_paramsZ query_params�paramsZ!signature_types_with_oauth_paramsZ found_types�signature_type� oauth_paramsr r r � _get_signature_type_and_params sP ���
���� ��� � z+BaseEndpoint._get_signature_type_and_paramsc C s& t |pi �}d|v r0t|d v r0t||||�}nt||d|�}| �|�\}}}tt|��t|�krntjdd��t|�}|�d�|_ |�d�|_
|�d�|_ |�d�|_ |�d �|_
|�d
�|_|�d �|_|�d �|_t|��d
�|_||_dd� |D �|_d
|j�dd�v �r"dd� |jD �|_|S )Nz Content-Type� zDuplicate OAuth1 entries.r% �oauth_signatureZoauth_consumer_keyZ oauth_tokenZ oauth_nonceZoauth_timestampZoauth_callbackZoauth_verifierZoauth_signature_method�realmc S s g | ]\}}|d kr||f�qS )r5 r �r# �k�vr r r r$ f r! z0BaseEndpoint._create_request.<locals>.<listcomp>Z
Authorizationc S s g | ]\}}|d kr||f�qS )r6 r r7 r r r r$ i s �)r r r r3 r+ �dictr r, �getr �
client_key�resource_owner_key�nonce� timestampZ redirect_uriZverifier�signature_methodr6 r2 r0 r ) r �uriZ http_methodr r r/ r1 r0 r2 r r r �_create_requestF s:
��� �z BaseEndpoint._create_requestc C s$ | j jr |j�� �d�s t�� �d S )Nzhttps://)r Z enforce_sslrA �lower�
startswithr ZInsecureTransportError)r r/ r r r �_check_transport_securityn s �z&BaseEndpoint._check_transport_securityc C s$ t |j|j|j|j|jf�s(tjdd��|j| jj vrPtj
d� |j| jj �d��d|j v rt|j d dkrttjdd��t
|j�dkr�tjdd��zt|j�}W n ty� tjd d��Y n.0 tt�� | �| jjkr�tjd
| jj d��| j�|j��stjd d��| j�|j��s tjd d��d S )
Nr' r% z"Invalid signature, {} not in {!r}.Z
oauth_versionz1.0zInvalid OAuth version.�
zInvalid timestamp sizez Timestamp must be an integer.zCTimestamp given is invalid, differ from allowed by over %s seconds.zInvalid client key format.zInvalid nonce format.)�allr r< r> r? r@ r r, r Zallowed_signature_methodsZInvalidSignatureMethodError�formatr2 r+ �int�
ValueError�abs�timeZtimestamp_lifetimeZcheck_client_keyZ check_nonce)r r/ �tsr r r �_check_mandatory_parameterst s\
�� ���
��� � ����z(BaseEndpoint._check_mandatory_parametersFc C s� |j tttfv rtd��n�| j�|j|�}d }|jrb|rN| j� |j|j|�}n| j�
|j|j|�}|j t kr|t �
|||�}nR|j tkr�t �|||�}n8|j tkr�t �|||�}n |j tkr�t �|||�}nd}|S )Nz)Using RSA-SHA is deprecated, use HMAC-SHAF)r@ r
r r rJ r Zget_client_secretr< r= Zget_request_token_secretZget_access_token_secretr r Zverify_hmac_sha1r Zverify_hmac_sha256r Zverify_hmac_sha512r
Zverify_plaintext)r r/ Zis_token_requestZ
client_secretZresource_owner_secretZvalid_signaturer r r �_check_signature� sN �
�����
�
�
�
�z BaseEndpoint._check_signature)N)F) �__name__�
__module__� __qualname__r r3 rB rE rN rO r r r r r s
*(Br )�__doc__rL Zoauthlib.commonr r r r4 r r r r r
r r r
r r r r r r r r r r r �<module> s @