o Tih%@s>dZddlZddlZddlZddlZddlZddlZddlmZddl m Z m Z ddl m Z ddlmZddlmZddlmZed Zd ZGd d d eZGd ddeZddZddZddZddZd+ddZddZd,ddZGdd d Z dd!e d"fd#d$Z!dd!e ddfd%d&Z"Gd'd(d(Z#Gd)d*d*e#Z$dS)-a_ Functions for creating and restoring url-safe signed JSON objects. The format used looks like this: >>> signing.dumps("hello") 'ImhlbGxvIg:1QaUZC:YIye-ze3TTx7gtSv422nZA4sgmk' There are two components here, separated by a ':'. The first component is a URLsafe base64 encoded JSON of the object passed to dumps(). The second component is a base64 encoded hmac/SHA-256 hash of "$first_component:$secret" signing.loads(s) checks the signature and returns the deserialized object. If the signature fails, a BadSignature exception is raised. >>> signing.loads("ImhlbGxvIg:1QaUZC:YIye-ze3TTx7gtSv422nZA4sgmk") 'hello' >>> signing.loads("ImhlbGxvIg:1QaUZC:YIye-ze3TTx7gtSv42-modified") ... BadSignature: Signature "ImhlbGxvIg:1QaUZC:YIye-ze3TTx7gtSv42-modified" does not match You can optionally compress the JSON prior to base64 encoding it to save space, using the compress=True argument. This checks if compression actually helps and only applies compression if the result is a shorter string: >>> signing.dumps(list(range(1, 20)), compress=True) '.eJwFwcERACAIwLCF-rCiILN47r-GyZVJsNgkxaFxoDgxcOHGxMKD_T7vhAml:1QaUaL:BA0thEZrp4FQVXIXuOvYJtLJSrQ' The fact that the string is compressed is signalled by the prefixed '.' at the start of the base64 JSON. There are 65 url-safe characters: the 64 used by url-safe base64 and the ':'. These functions make use of all of them. N)settings)constant_time_compare salted_hmac)RemovedInDjango51Warning force_bytes) import_string)_lazy_re_compilez^[A-z0-9-_=]*$Z>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzc@eZdZdZdS) BadSignaturezSignature does not match.N__name__ __module__ __qualname____doc__rrS/var/www/html/evchargy.com/venv/lib/python3.10/site-packages/django/core/signing.pyr 6r c@r )SignatureExpiredz3Signature timestamp is older than required max_age.Nr rrrrr<rrcCsZ|dkrdS|dkr dnd}t|}d}|dkr)t|d\}}t||}|dks||S)Nr0->)absdivmodBASE62_ALPHABET)ssignencoded remainderrrr b62_encodeBs r cCsT|dkrdSd}|ddkr|dd}d}d}|D] }|dt|}q||S)Nrrrr)rindex)rrdecodeddigitrrr b62_decodeNs  r&cCst|dS)N=)base64urlsafe_b64encodestrip)rrrr b64_encode[r+cCs dt| d}t||S)Nr')lenr(urlsafe_b64decode)rpadrrr b64_decode_sr1sha1cCstt||||dS)N algorithm)r+rdigestdecode)saltvaluekeyr4rrr base64_hmacds r:cCs dt|S)Nsdjango.http.cookiesr)r9rrr_cookie_signer_keyjs r;%django.core.signing.get_cookie_signercCs&ttj}|ttjtttj|dS)N)r9 fallback_keysr7)rrZSIGNING_BACKENDr; SECRET_KEYmapSECRET_KEY_FALLBACKS)r7Signerrrrget_cookie_signeros  rBc@s eZdZdZddZddZdS)JSONSerializerzW Simple wrapper around json to be used in signing.dumps and signing.loads. cCstj|dddS)N),:) separatorslatin-1)jsondumpsencode)selfobjrrrrI~szJSONSerializer.dumpscCst|dS)NrG)rHloadsr6)rKdatarrrrMr,zJSONSerializer.loadsN)r rrrrIrMrrrrrCxs rCzdjango.core.signingFcCst||dj|||dS)a Return URL-safe, hmac signed base64 compressed JSON string. If key is None, use settings.SECRET_KEY instead. The hmac algorithm is the default Signer algorithm. If compress is True (not the default), check if compressing using zlib can save some space. Prepend a '.' to signify compression. This is included in the signature, to protect against zip bombs. Salt can be used to namespace the hash, so that a signed string is only valid for a given namespace. Leaving this at the default value or re-using a salt value across different parts of your application without good cause is a security risk. The serializer is expected to return a bytestring. )r9r7) serializercompress)TimestampSigner sign_object)rLr9r7rOrPrrrrIs rIcCst|||dj|||dS)z| Reverse of dumps(), raise BadSignature if signature fails. The serializer is expected to accept a bytestring. )r9r7r=)rOmax_age)rQ unsign_object)rr9r7rOrSr=rrrrMs rMc@sVeZdZddddddddZdddZdd Zd d Zed fd dZefddZ dS)rANrEr9sepr7r4r=c Gs|ptj|_|dur |ntj|_||_|pd|jj|jjf|_ |p#d|_ |rMt j d|jjdt ddt|gdD]\}}|sF|dkrLt|||qr9r@r=rV __class__rr r7r4warningswarnrzipsetattr _SEP_UNSAFEmatch ValueError) rKr9rVr7r4r=argsargattrrrr__init__s<     zSigner.__init__cCs"|p|j}t|jd|||jdS)NZsignerr3)r9r:r7r4)rKr8r9rrr signatures zSigner.signaturecCsd||j||fSNz%s%s%s)rVrfrKr8rrrrsz Signer.signcCsd|j|vr td|j||jd\}}|jg|jD]}t||||r+|Sqtd|)NzNo "%s" found in valuer!zSignature "%s" does not match)rVr rsplitr9r=rrf)rKZ signed_valuer8sigr9rrrunsigns  z Signer.unsignFcCs\||}d}|rt|}t|t|dkr|}d}t|}|r)d|}||S)ae Return URL-safe, hmac signed base64 compressed JSON string. If compress is True (not the default), check if compressing using zlib can save some space. Prepend a '.' to signify compression. This is included in the signature, to protect against zip bombs. The serializer is expected to return a bytestring. Fr!T.)rIzlibrPr.r+r6r)rKrLrOrPrNZ is_compressed compressedbase64drrrrRs    zSigner.sign_objectcKsX|j|fi|}|dddk}|r|dd}t|}|r&t|}||S)Nr!.)rkrJr1rm decompressrM)rKZ signed_objrOkwargsrorqrNrrrrT s   zSigner.unsign_objectN) r rrrerfrrkrCrRrTrrrrrAs ( rAcs2eZdZddZfddZdfdd ZZS) rQcCstttSrs)r inttime)rKrrr timestampr,zTimestampSigner.timestampcs d||j|f}t|Srg)rVrvsuperrrhrZrrrs zTimestampSigner.signNcsjt|}||jd\}}t|}|dur3t|tjr!|}t |}||kr3t d||f|S)zk Retrieve original value and check it wasn't signed more than max_age seconds ago. r!NzSignature age %s > %s seconds) rwrkrirVr& isinstancedatetime timedelta total_secondsrur)rKr8rSresultrvZagerxrrrks   zTimestampSigner.unsignrs)r rrrvrrk __classcell__rrrxrrQs rQ)r2)r<)%rr(rzrHrur[rmZ django.confrZdjango.utils.cryptorrZdjango.utils.deprecationrZdjango.utils.encodingrZdjango.utils.module_loadingrZdjango.utils.regex_helperr r_r Exceptionr rr r&r+r1r:r;rBrCrIrMrArQrrrrsF#            d