a OcT"@s*dZddlZddlZddlZddlZddlZddlmZddlm Z m Z ddl m Z ddl mZddlmZedZd ZGd d d eZGd d d eZddZddZddZddZd*ddZddZd+ddZGdddZdd ed!fd"d#Zdd eddfd$d%ZGd&d'd'Z Gd(d)d)e Z!dS),a_ Functions for creating and restoring url-safe signed JSON objects. The format used looks like this: >>> signing.dumps("hello") 'ImhlbGxvIg:1QaUZC:YIye-ze3TTx7gtSv422nZA4sgmk' There are two components here, separated by a ':'. The first component is a URLsafe base64 encoded JSON of the object passed to dumps(). The second component is a base64 encoded hmac/SHA-256 hash of "$first_component:$secret" signing.loads(s) checks the signature and returns the deserialized object. If the signature fails, a BadSignature exception is raised. >>> signing.loads("ImhlbGxvIg:1QaUZC:YIye-ze3TTx7gtSv422nZA4sgmk") 'hello' >>> signing.loads("ImhlbGxvIg:1QaUZC:YIye-ze3TTx7gtSv42-modified") ... BadSignature: Signature "ImhlbGxvIg:1QaUZC:YIye-ze3TTx7gtSv42-modified" does not match You can optionally compress the JSON prior to base64 encoding it to save space, using the compress=True argument. This checks if compression actually helps and only applies compression if the result is a shorter string: >>> signing.dumps(list(range(1, 20)), compress=True) '.eJwFwcERACAIwLCF-rCiILN47r-GyZVJsNgkxaFxoDgxcOHGxMKD_T7vhAml:1QaUaL:BA0thEZrp4FQVXIXuOvYJtLJSrQ' The fact that the string is compressed is signalled by the prefixed '.' at the start of the base64 JSON. There are 65 url-safe characters: the 64 used by url-safe base64 and the ':'. These functions make use of all of them. N)settings)constant_time_compare salted_hmac force_bytes) import_string)_lazy_re_compilez^[A-z0-9-_=]*$Z>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzc@seZdZdZdS) BadSignaturezSignature does not match.N__name__ __module__ __qualname____doc__rrJ/var/www/html/gsl.tools/lib/python3.9/site-packages/django/core/signing.pyr 4sr c@seZdZdZdS)SignatureExpiredz3Signature timestamp is older than required max_age.Nr rrrrr:srcCsT|dkr dS|dkrdnd}t|}d}|dkrLt|d\}}t||}q(||S)Nr0->)absdivmodBASE62_ALPHABET)ssignencoded remainderrrr b62_encode@srcCsT|dkr dSd}|ddkr,|dd}d}d}|D]}|dt|}q4||S)Nrrrr)rindex)rrdecodeddigitrrr b62_decodeLs  r#cCst|dS)N=)base64urlsafe_b64encodestrip)rrrr b64_encodeYsr(cCs dt| d}t||S)Nr$)lenr%urlsafe_b64decode)rpadrrr b64_decode]sr-sha1cCstt||||dS)N algorithm)r(rdigestdecode)saltvaluekeyr0rrr base64_hmacbsr6cCs dt|S)Nsdjango.http.cookiesr)r5rrr_cookie_signer_keyhsr7%django.core.signing.get_cookie_signercCs&ttj}|ttjtttj|dS)N)r5 fallback_keysr3)rrZSIGNING_BACKENDr7 SECRET_KEYmapSECRET_KEY_FALLBACKS)r3Signerrrrget_cookie_signerms   r>c@s eZdZdZddZddZdS)JSONSerializerzW Simple wrapper around json to be used in signing.dumps and signing.loads. cCstj|dddS)N),:) separatorslatin-1)jsondumpsencode)selfobjrrrrE|szJSONSerializer.dumpscCst|dS)NrC)rDloadsr2)rGdatarrrrIszJSONSerializer.loadsN)r r r rrErIrrrrr?vsr?zdjango.core.signingFcCst||dj|||dS)a Return URL-safe, hmac signed base64 compressed JSON string. If key is None, use settings.SECRET_KEY instead. The hmac algorithm is the default Signer algorithm. If compress is True (not the default), check if compressing using zlib can save some space. Prepend a '.' to signify compression. This is included in the signature, to protect against zip bombs. Salt can be used to namespace the hash, so that a signed string is only valid for a given namespace. Leaving this at the default value or re-using a salt value across different parts of your application without good cause is a security risk. The serializer is expected to return a bytestring. )r3) serializercompress)TimestampSigner sign_object)rHr5r3rKrLrrrrEs rEcCst|||dj|||dS)z| Reverse of dumps(), raise BadSignature if signature fails. The serializer is expected to accept a bytestring. )r3r9)rKmax_age)rM unsign_object)rr5r3rKrOr9rrrrIs rIc@sJeZdZdddZdddZddZd d Zed fd d ZefddZ dS)r=NrAcCsf|ptj|_|dur|ntj|_||_t|jr>td||pTd|j j |j j f|_ |p^d|_ dS)NzJUnsafe Signer separator: %r (cannot be empty or consist of only A-z0-9-_=)z%s.%ssha256)rr:r5r<r9sep _SEP_UNSAFEmatch ValueError __class__r r r3r0)rGr5rRr3r0r9rrr__init__s"  zSigner.__init__cCs"|p|j}t|jd|||jdS)NZsignerr/)r5r6r3r0)rGr4r5rrr signatures zSigner.signaturecCsd||j||fSNz%s%s%s)rRrXrGr4rrrrsz Signer.signcCsh|j|vrtd|j||jd\}}|jg|jD]}t||||r8|Sq8td|dS)NzNo "%s" found in valuerzSignature "%s" does not match)rRr rsplitr5r9rrX)rGZ signed_valuer4sigr5rrrunsigns  z Signer.unsignFcCs\||}d}|r:t|}t|t|dkr:|}d}t|}|rRd|}||S)ae Return URL-safe, hmac signed base64 compressed JSON string. If compress is True (not the default), check if compressing using zlib can save some space. Prepend a '.' to signify compression. This is included in the signature, to protect against zip bombs. The serializer is expected to return a bytestring. FrT.)rEzlibrLr*r(r2r)rGrHrKrLrJZ is_compressed compressedbase64drrrrNs   zSigner.sign_objectcKsX|j|fi|}|dddk}|r6|dd}t|}|rLt|}||S)Nr.)r]rFr-r_ decompressrI)rGZ signed_objrKkwargsrarcrJrrrrPs  zSigner.unsign_object)NrANNN)N) r r r rWrXrr]r?rNrPrrrrr=s   r=cs2eZdZddZfddZdfdd ZZS) rMcCstttS)N)rinttime)rGrrr timestampszTimestampSigner.timestampcs d||j|f}t|SrY)rRrgsuperrrZrVrrrszTimestampSigner.signNcsjt|}||jd\}}t|}|durft|tjrB|}t |}||krft d||f|S)zk Retrieve original value and check it wasn't signed more than max_age seconds ago. rNzSignature age %s > %s seconds) rhr]r[rRr# isinstancedatetime timedelta total_secondsrfr)rGr4rOresultrgZagerirrr] s   zTimestampSigner.unsign)N)r r r rgrr] __classcell__rrrirrMs rM)r.)r8)"rr%rkrDrfr_Z django.confrZdjango.utils.cryptorrZdjango.utils.encodingrZdjango.utils.module_loadingrZdjango.utils.regex_helperrrSr Exceptionr rrr#r(r-r6r7r>r?rErIr=rMrrrrs@#          R