B CVvg@sdZddlZddlZddlZddlZddlZddlmZddlm Z ddl m Z m Z ddl mZddlmZddlmZed ZGd d d eZGd d d eZddZddZd$ddZd%ddZGdddZddedfddZddedfddZGd d!d!ZGd"d#d#eZdS)&ae Functions for creating and restoring url-safe signed JSON objects. The format used looks like this: >>> signing.dumps("hello") 'ImhlbGxvIg:1QaUZC:YIye-ze3TTx7gtSv422nZA4sgmk' There are two components here, separated by a ':'. The first component is a URLsafe base64 encoded JSON of the object passed to dumps(). The second component is a base64 encoded hmac/SHA1 hash of "$first_component:$secret" signing.loads(s) checks the signature and returns the deserialized object. If the signature fails, a BadSignature exception is raised. >>> signing.loads("ImhlbGxvIg:1QaUZC:YIye-ze3TTx7gtSv422nZA4sgmk") 'hello' >>> signing.loads("ImhlbGxvIg:1QaUZC:YIye-ze3TTx7gtSv422nZA4sgmk-modified") ... BadSignature: Signature failed: ImhlbGxvIg:1QaUZC:YIye-ze3TTx7gtSv422nZA4sgmk-modified You can optionally compress the JSON prior to base64 encoding it to save space, using the compress=True argument. This checks if compression actually helps and only applies compression if the result is a shorter string: >>> signing.dumps(list(range(1, 20)), compress=True) '.eJwFwcERACAIwLCF-rCiILN47r-GyZVJsNgkxaFxoDgxcOHGxMKD_T7vhAml:1QaUaL:BA0thEZrp4FQVXIXuOvYJtLJSrQ' The fact that the string is compressed is signalled by the prefixed '.' at the start of the base64 JSON. There are 65 url-safe characters: the 64 used by url-safe base64 and the ':'. These functions make use of all of them. N)settings)baseconv)constant_time_compare salted_hmac) force_bytes) import_string)_lazy_re_compilez^[A-z0-9-_=]*$c@seZdZdZdS) BadSignaturezSignature does not match.N)__name__ __module__ __qualname____doc__rr7/tmp/pip-install-o3oxmrkh/Django/django/core/signing.pyr 4sr c@seZdZdZdS)SignatureExpiredz3Signature timestamp is older than required max_age.N)r r r r rrrrr9srcCst|dS)N=)base64urlsafe_b64encodestrip)srrr b64_encode>srcCs dt| d}t||S)Nr)lenrurlsafe_b64decode)rpadrrr b64_decodeBsrsha1cCstt||||dS)N) algorithm)rrdigestdecode)saltvaluekeyrrrr base64_hmacGsr#%django.core.signing.get_cookie_signercCs$ttj}ttj}|d||dS)Nsdjango.http.cookies)r )rrZSIGNING_BACKENDr SECRET_KEY)r Signerr"rrrget_cookie_signerKs  r'c@s eZdZdZddZddZdS)JSONSerializerzW Simple wrapper around json to be used in signing.dumps and signing.loads. cCstj|dddS)N),:) separatorszlatin-1)jsondumpsencode)selfobjrrrr-VszJSONSerializer.dumpscCst|dS)Nzlatin-1)r,loadsr)r/datarrrr1YszJSONSerializer.loadsN)r r r r r-r1rrrrr(Qsr(zdjango.core.signingFcCst||dj|||dS)a Return URL-safe, hmac signed base64 compressed JSON string. If key is None, use settings.SECRET_KEY instead. The hmac algorithm is the default Signer algorithm. If compress is True (not the default), check if compressing using zlib can save some space. Prepend a '.' to signify compression. This is included in the signature, to protect against zip bombs. Salt can be used to namespace the hash, so that a signed string is only valid for a given namespace. Leaving this at the default value or re-using a salt value across different parts of your application without good cause is a security risk. The serializer is expected to return a bytestring. )r ) serializercompress)TimestampSigner sign_object)r0r"r r3r4rrrr-]sr-cCst||dj|||dS)z| Reverse of dumps(), raise BadSignature if signature fails. The serializer is expected to accept a bytestring. )r )r3max_age)r5 unsign_object)rr"r r3r7rrrr1qsr1c@sTeZdZdZdddZddZdd Zd d Zd d Ze dfddZ e fddZ dS)r&rNr*cCsT|ptj|_||_t|jr*td||p@d|jj|jj f|_ |pLtj |_ dS)NzJUnsafe Signer separator: %r (cannot be empty or consist of only A-z0-9-_=)z%s.%s) rr%r"sep _SEP_UNSAFEmatch ValueError __class__r r r ZDEFAULT_HASHING_ALGORITHMr)r/r"r9r rrrr__init__~s  zSigner.__init__cCst|jd||j|jdS)Nsigner)r)r#r r"r)r/r!rrr signatureszSigner.signaturecCst|jd||j|jdS)Nr?)r)r#r r"legacy_algorithm)r/r!rrr_legacy_signatureszSigner._legacy_signaturecCsd||j||fS)Nz%s%s%s)r9r@)r/r!rrrsignsz Signer.signcCsd|j|krtd|j||jd\}}t|||sP|jrTt|||rT|Std|dS)NzNo "%s" found in valuezSignature "%s" does not match)r9r rsplitrr@rArB)r/Z signed_valuer!sigrrrunsigns z Signer.unsignFcCs\||}d}|r:t|}t|t|dkr:|}d}t|}|rRd|}||S)ae Return URL-safe, hmac signed base64 compressed JSON string. If compress is True (not the default), check if compressing using zlib can save some space. Prepend a '.' to signify compression. This is included in the signature, to protect against zip bombs. The serializer is expected to return a bytestring. FrDT.)r-zlibr4rrrrC)r/r0r3r4r2Z is_compressed compressedbase64drrrr6s   zSigner.sign_objectcKsT|j|f|}|dddk}|r2|dd}t|}|rHt|}||S)NrD.)rGr.rrI decompressr1)r/Z signed_objr3kwargsrKrMr2rrrr8s  zSigner.unsign_object)Nr*NN) r r r rAr>r@rBrCrGr(r6r8rrrrr&zs  r&cs2eZdZddZfddZdfdd ZZS) r5cCstjttS)N)rbase62r.inttime)r/rrr timestampszTimestampSigner.timestampcs d||j|f}t|S)Nz%s%s%s)r9rRsuperrC)r/r!)r=rrrCszTimestampSigner.signNcsnt|}||jd\}}tj|}|dk rjt|tj rF| }t |}||krjt d||f|S)zk Retrieve original value and check it wasn't signed more than max_age seconds ago. rDNzSignature age %s > %s seconds) rSrGrEr9rrOr isinstancedatetime timedelta total_secondsrQr)r/r!r7resultrRZage)r=rrrGs    zTimestampSigner.unsign)N)r r r rRrCrG __classcell__rr)r=rr5s r5)r)r$) r rrUr,rQrIZ django.confrZ django.utilsrZdjango.utils.cryptorrZdjango.utils.encodingrZdjango.utils.module_loadingrZdjango.utils.regex_helperrr: Exceptionr rrrr#r'r(r-r1r&r5rrrr"s.         O