U
|
ß=®d+ ã @ sð d dl Z d dlZddlmZ ddlmZ ddlmZ ddlm Z ddlm
|
Z
|
ej e e f Zeje Zeje ejf Zeje Zeje
|
Zejej eejeef ef Zejeejf Zej ej e ef Z ejedd d
|
Z G d d d Z dS ) é Né )Ú
|
want_bytes)Ú
|
BadPayload)Ú BadSignature)Ú_make_keys_list)ÚSigner)Ú
|
serializerÚreturnc C s t | i ¡tS )z5Checks whether a serializer generates text or binary.)Ú
|
isinstanceÚdumpsÚstr)r © r úNd:\z\workplace\vscode\pyvenv\venv\Lib\site-packages\itsdangerous/serializer.pyÚis_text_serializer s r c @ sr e Zd ZU dZeZejed< e Z
|
e ed< g Z e ed< d,eeejeeje eeje ddd Zeed
|
d d Zd-eejej ejd ddZejedddZd.ee dddZd/eeje dddZd0ejeedddZ d1ejej eddd d Z d2eeejejd d d Z d3ej eejd!d"d#Z d4eee!d$d%d&Z"d5eeeee!d'd(d)Z#d6ej ee!d!d*d+Z$dS )7Ú
|
Serializera: A serializer wraps a :class:`~itsdangerous.signer.Signer` to
|
enable serializing and securely signing data other than bytes. It
|
can unsign to verify that the data hasn't been changed.
|
|
The serializer provides :meth:`dumps` and :meth:`loads`, similar to
|
:mod:`json`, and by default uses :mod:`json` internally to serialize
|
the data to bytes.
|
|
The secret key should be a random string of ``bytes`` and should not
|
be saved to code or version control. Different salts should be used
|
to distinguish signing in different contexts. See :doc:`/concepts`
|
for information about the security of the secret key and salt.
|
|
:param secret_key: The secret key to sign and verify with. Can be a
|
list of keys, oldest to newest, to support key rotation.
|
:param salt: Extra key to combine with ``secret_key`` to distinguish
|
signatures in different contexts.
|
:param serializer: An object that provides ``dumps`` and ``loads``
|
methods for serializing data to a string. Defaults to
|
:attr:`default_serializer`, which defaults to :mod:`json`.
|
:param serializer_kwargs: Keyword arguments to pass when calling
|
``serializer.dumps``.
|
:param signer: A ``Signer`` class to instantiate when signing data.
|
Defaults to :attr:`default_signer`, which defaults to
|
:class:`~itsdangerous.signer.Signer`.
|
:param signer_kwargs: Keyword arguments to pass when instantiating
|
the ``Signer`` class.
|
:param fallback_signers: List of signer parameters to try when
|
unsigning with the default signer fails. Each item can be a dict
|
of ``signer_kwargs``, a ``Signer`` class, or a tuple of
|
``(signer, signer_kwargs)``. Defaults to
|
:attr:`default_fallback_signers`.
|
|
.. versionchanged:: 2.0
|
Added support for key rotation by passing a list to
|
``secret_key``.
|
|
.. versionchanged:: 2.0
|
Removed the default SHA-512 fallback signer from
|
``default_fallback_signers``.
|
|
.. versionchanged:: 1.1
|
Added support for ``fallback_signers`` and configured a default
|
SHA-512 fallback. This fallback is for users who used the yanked
|
1.0.0 release which defaulted to SHA-512.
|
|
.. versionchanged:: 0.14
|
The ``signer`` and ``signer_kwargs`` parameters were added to
|
the constructor.
|
Údefault_serializerÚdefault_signerÚdefault_fallback_signersó itsdangerousN)Ú
|
secret_keyÚsaltr Úserializer_kwargsÚsignerÚ signer_kwargsÚfallback_signersc C s t || _|d k rt|}|| _|d kr.| j}|| _t|| _|d krL| j}|| _|pXi | _ |d krrt
|
| j pnd}|| _ |p~i | _ d S )Nr )r Ú secret_keysr r r r r r r r Úlistr r r )Úselfr r r r r r r r r r Ú__init__Y s
|
|
|
zSerializer.__init__)r c C s
|
| j d S )zThe newest (last) entry in the :attr:`secret_keys` list. This
|
is for compatibility from before key rotation support was added.
|
éÿÿÿÿ)r )r r r r r s zSerializer.secret_key)Úpayloadr r c
|
C sv |dkr| j }| j}nt|}z"|r6| | d¡¡W S | |¡W S tk
|
rp } ztd|d|W 5 d}~X Y nX dS )a Loads the encoded object. This function raises
|
:class:`.BadPayload` if the payload is not valid. The
|
``serializer`` parameter can be used to override the serializer
|
stored on the class. The encoded ``payload`` should always be
|
bytes.
|
Núutf-8zSCould not load the payload because an exception occurred on unserializing the data.)Úoriginal_error)r r ÚloadsÚdecodeÚ Exceptionr )r r r Zis_textÚer r r Ú load_payload s ýüzSerializer.load_payload)Úobjr c C s t | jj|f| jS )z¡Dumps the encoded object. The return value is always bytes.
|
If the internal serializer returns text, the value will be
|
encoded as UTF-8.
|
)r r r r )r r( r r r Ú dump_payload¤ s zSerializer.dump_payload)r r c C s( |dkr| j }| j| jfd|i| jS )zCreates a new instance of the signer to be used. The default
|
implementation uses the :class:`.Signer` base class.
|
Nr )r r r r )r r r r r Ú make_signer« s zSerializer.make_signerc c s| |dkr| j }| |¡V | jD ]V}t|tr:|}| j}nt|trN|\}}n| j}| jD ]}||fd|i|V qZq dS )z¯Iterates over all signers to be tried for unsigning. Starts
|
with the configured signer, then constructs each signer
|
specified in ``fallback_signers``.
|
Nr ) r r* r r
|
Údictr Útupler r )r r ÚfallbackÚkwargsr r r r Úiter_unsigners´ s
|
|
|
|
|
zSerializer.iter_unsigners)r( r r c C s2 t | |¡}| |¡ |¡}| jr.| d¡S |S )zÅReturns a signed string serialized with the internal
|
serializer. The return value can be either a byte or unicode
|
string depending on the format of the internal serializer.
|
r! )r r) r* Úsignr r$ )r r( r r Úrvr r r r Ê s
|
|
zSerializer.dumps)r( Úfr r c C s | | ||¡¡ dS )zLike :meth:`dumps` but dumps into a file. The file handle has
|
to be compatible with what the internal serializer expects.
|
N)Úwriter )r r( r2 r r r r Údump× s zSerializer.dump)Úsr r. r c K sj t |}d}| |¡D ]B}z| | |¡¡W S tk
|
rV } z|}W 5 d}~X Y qX qt t|¡dS )ziReverse of :meth:`dumps`. Raises :exc:`.BadSignature` if the
|
signature validation fails.
|
N)r r/ r' Zunsignr Ú_tÚcast)r r5 r r. Zlast_exceptionr Úerrr r r r# Ý s zSerializer.loads)r2 r r c C s | | ¡ |¡S )z)Like :meth:`loads` but loads from a file.)r# Úread©r r2 r r r r Úloadî s zSerializer.load)r5 r r c C s | ||¡S )a9 Like :meth:`loads` but without verifying the signature. This
|
is potentially very dangerous to use depending on how your
|
serializer works. The return value is ``(signature_valid,
|
payload)`` instead of just the payload. The first item will be a
|
boolean that indicates if the signature is valid. This function
|
never fails.
|
|
Use it for debugging only and if you know that your serializer
|
module is not exploitable (for example, do not use it with a
|
pickle serializer).
|
|
.. versionadded:: 0.15
|
)Ú_loads_unsafe_impl)r r5 r r r r Ú loads_unsafeò s zSerializer.loads_unsafe)r5 r Ú load_kwargsÚload_payload_kwargsr c C s¬ |dkr i }z d| j |fd|i|fW S tk
|
r¦ } z`|jdkrNW Y ¢PdS |dkrZi }z d| j|jf|fW W Y ¢"S tk
|
r Y W Y ¢
|
dS X W 5 d}~X Y nX dS )zfLow level helper function to implement :meth:`loads_unsafe`
|
in serializer subclasses.
|
NTr )FNF)r# r r r' r )r r5 r r> r? r& r r r r< s
|
|
|
þz Serializer._loads_unsafe_implc C s | j | ¡ |dS )zYLike :meth:`loads_unsafe` but loads from a file.
|
|
.. versionadded:: 0.15
|
)r )r= r9 r: r r r Ú load_unsafe" s zSerializer.load_unsafe)r NNNNN)N)N)N)N)N)N)N)N)NN)N)%Ú__name__Ú
|
__module__Ú __qualname__Ú__doc__Újsonr r6 ÚAnyÚ__annotations__r r Ú _t_signerr Ú _t_fallbacksÚ _t_secret_keyÚ_t_opt_str_bytesÚ _t_opt_kwargsÚOptionalr ÚpropertyÚbytesr r' r) r* ÚIteratorr/ Ú _t_str_bytesr ÚIOr4 r# r; Ú_t_load_unsafer= r< r@ r r r r r sp
|
6 øø ) ÿ
|
þ ÿ þ ÿ þ ûú r ) rE Útypingr6 Úencodingr Úexcr r r r r ÚUnionr rO rQ rM rK ÚDictrF Z _t_kwargsrL ÚTyperH ÚListÚTuplerI ÚboolrS ÚIterablerJ r r r r r r Ú<module> s
|
|
|
|
