136 lines
15 KiB
Plaintext
136 lines
15 KiB
Plaintext
|
Ë
|
|||
|
|
êÅÙjñ< ã ó¦ — d dl mZ d dlmZ d dlZd dlZddlm Z ddl
|
|||
|
|
m Z ddl
|
|||
|
|
m Z ddl
|
|||
|
|
mZ ddl
|
|||
|
|
mZ ej r8d dlZ ej& d ej( eef ej( eef ¬
|
|||
|
|
« Zn# ej& d ej( eef ¬ « Z G d „ d
|
|||
|
|
ej0 e « Z dd„Z G d„ dej6 e « Z y)é )Ú annotationsNé )Ú
|
|||
|
|
want_bytes)Ú
|
|||
|
|
BadPayload)Ú BadSignature)Ú_make_keys_list)ÚSignerÚ _TSerialized)ÚboundÚdefault)r c ó — e Zd Zdd„Zdd„Zy)Ú_PDataSerializerc ó — y ©N© )ÚselfÚpayloads ú[C:\Users\30997\AppData\Local\Temp\pip-target-6g32zz5s\lib\python\itsdangerous/serializer.pyÚloadsz_PDataSerializer.loads s € ¸ó c ó — y r r ©r Úobjs r Údumpsz_PDataSerializer.dumps s € °Cr N)r r
|
|||
|
|
Úreturnút.Any)r r r r
|
|||
|
|
)Ú__name__Ú
|
|||
|
|
__module__Ú __qualname__r r r r r r r s
|
|||
|
|
„ Û;ô 8r r c ó@ — t | j i « t « S )z5Checks whether a serializer generates text or binary.)Ú
|
|||
|
|
isinstancer Ústr)Ú
|
|||
|
|
serializers r Úis_text_serializerr$ # s € ô �j×&Ñ& rÓ*¬CÓ 0Ð0r c óÂ — e Zd ZU dZeZded< eZded< g Z ded< e
|
|||
|
|
j d d d „« Z e
|
|||
|
|
j d d d
|
|||
|
|
„« Z e
|
|||
|
|
j d ddddd œ d d „« Z e
|
|||
|
|
j d d!d
|
|||
|
|
„« Z e
|
|||
|
|
j d ddddd œ d!d„« Z d d"d„Z e
|
|||
|
|
d#d„« Z d$ d%d„Zd&d„Zd$d'd„Zd$d(d„Zd$d)d„Zd$d*d„Z d$ d+d„Zd$d,d„Z d$ d-d„Z d. d/d„Z d$ d0d„Zy)1Ú
|
|||
|
|
Serializera: A serializer wraps a :class:`~itsdangerous.signer.Signer` to
|
|||
|
|
enable serializing and securely signing data other than bytes. It
|
|||
|
|
can unsign to verify that the data hasn't been changed.
|
|||
|
|
|
|||
|
|
The serializer provides :meth:`dumps` and :meth:`loads`, similar to
|
|||
|
|
:mod:`json`, and by default uses :mod:`json` internally to serialize
|
|||
|
|
the data to bytes.
|
|||
|
|
|
|||
|
|
The secret key should be a random string of ``bytes`` and should not
|
|||
|
|
be saved to code or version control. Different salts should be used
|
|||
|
|
to distinguish signing in different contexts. See :doc:`/concepts`
|
|||
|
|
for information about the security of the secret key and salt.
|
|||
|
|
|
|||
|
|
:param secret_key: The secret key to sign and verify with. Can be a
|
|||
|
|
list of keys, oldest to newest, to support key rotation.
|
|||
|
|
:param salt: Extra key to combine with ``secret_key`` to distinguish
|
|||
|
|
signatures in different contexts.
|
|||
|
|
:param serializer: An object that provides ``dumps`` and ``loads``
|
|||
|
|
methods for serializing data to a string. Defaults to
|
|||
|
|
:attr:`default_serializer`, which defaults to :mod:`json`.
|
|||
|
|
:param serializer_kwargs: Keyword arguments to pass when calling
|
|||
|
|
``serializer.dumps``.
|
|||
|
|
:param signer: A ``Signer`` class to instantiate when signing data.
|
|||
|
|
Defaults to :attr:`default_signer`, which defaults to
|
|||
|
|
:class:`~itsdangerous.signer.Signer`.
|
|||
|
|
:param signer_kwargs: Keyword arguments to pass when instantiating
|
|||
|
|
the ``Signer`` class.
|
|||
|
|
:param fallback_signers: List of signer parameters to try when
|
|||
|
|
unsigning with the default signer fails. Each item can be a dict
|
|||
|
|
of ``signer_kwargs``, a ``Signer`` class, or a tuple of
|
|||
|
|
``(signer, signer_kwargs)``. Defaults to
|
|||
|
|
:attr:`default_fallback_signers`.
|
|||
|
|
|
|||
|
|
.. versionchanged:: 2.0
|
|||
|
|
Added support for key rotation by passing a list to
|
|||
|
|
``secret_key``.
|
|||
|
|
|
|||
|
|
.. versionchanged:: 2.0
|
|||
|
|
Removed the default SHA-512 fallback signer from
|
|||
|
|
``default_fallback_signers``.
|
|||
|
|
|
|||
|
|
.. versionchanged:: 1.1
|
|||
|
|
Added support for ``fallback_signers`` and configured a default
|
|||
|
|
SHA-512 fallback. This fallback is for users who used the yanked
|
|||
|
|
1.0.0 release which defaulted to SHA-512.
|
|||
|
|
|
|||
|
|
.. versionchanged:: 0.14
|
|||
|
|
The ``signer`` and ``signer_kwargs`` parameters were added to
|
|||
|
|
the constructor.
|
|||
|
|
ú_PDataSerializer[t.Any]Údefault_serializerz type[Signer]Údefault_signerzMlist[dict[str, t.Any] | tuple[type[Signer], dict[str, t.Any]] | type[Signer]]Údefault_fallback_signersNc ó — y r r ©r Ú
|
|||
|
|
secret_keyÚsaltr# Úserializer_kwargsÚsignerÚ
|
|||
|
|
signer_kwargsÚfallback_signerss r Ú__init__zSerializer.__init__m ó € ð r c ó — y r r r, s r r3 zSerializer.__init__} r4 r )r/ r0 r1 r2 c ó — y r r r, s r r3 zSerializer.__init__� ó € ð r c ó — y r r r, s r r3 zSerializer.__init__ r4 r c ó — y r r r, s r r3 zSerializer.__init__° r7 r c ó( — t |« | _ |� t |« }|| _ |€ | j }|| _ t
|
|||
|
|
|« | _ |€ | j }|| _ |xs i | _ |€t | j « }|| _ |xs i | _
|
|||
|
|
y r )r Ú secret_keysr r. r( r# r$ r) r0 r1 Úlistr* r2 r/ r, s r r3 zSerializer.__init__À s§ € ô$ )8¸
|
|||
|
|
Ó(CˆÔà Ð Ü ˜dÓ#ˆD𠈌 à Ð Ø ×0Ñ0ˆJà:DˆŒÜ(:¸:Ó(FˆÔ à ˆ>Ø×(Ñ(ˆFà$*ˆŒ Ø/<Ò/BÀˆÔà Ð #Ü # D×$AÑ$AÓ BÐ ð
|
|||
|
|
ð
|
|||
|
|
Ô ð 4EÒ3JÈˆÕ r c ó — | j d S )z�The newest (last) entry in the :attr:`secret_keys` list. This
|
|||
|
|
is for compatibility from before key rotation support was added.
|
|||
|
|
éÿÿÿÿ)r; )r s r r- zSerializer.secret_keyî s € ð
|
|||
|
|
× Ñ Ñ#Ð#r c óø — |€| j }| j }n
|
|||
|
|
|}t |« } |r |j |j d« « S |j |« S # t $ r}t d|¬« |‚d}~ww xY w)a Loads the encoded object. This function raises
|
|||
|
|
:class:`.BadPayload` if the payload is not valid. The
|
|||
|
|
``serializer`` parameter can be used to override the serializer
|
|||
|
|
stored on the class. The encoded ``payload`` should always be
|
|||
|
|
bytes.
|
|||
|
|
Núutf-8zSCould not load the payload because an exception occurred on unserializing the data.)Úoriginal_error)r# r$ r ÚdecodeÚ Exceptionr )r r r# Úuse_serializerÚis_textÚes r Ú load_payloadzSerializer.load_payloadõ sŠ € ð Ð Ø !Ÿ_™_ˆNØ×-Ñ-‰Gà 'ˆNÜ(¨Ó4ˆGð
|
|||
|
|
ÙØ%×+Ñ+¨G¯N©N¸7Ó,CÓDÐDà!×'Ñ'¨Ó0Ð 0øÜò Ü ð7à ôð ð
|
|||
|
|
ûð ús ª!A Á A Á A9Á&A4Á4A9c ób — t | j j |fi | j ¤Ž« S )z¡Dumps the encoded object. The return value is always bytes.
|
|||
|
|
If the internal serializer returns text, the value will be
|
|||
|
|
encoded as UTF-8.
|
|||
|
|
)r r# r r/ r s r Ú dump_payloadzSerializer.dump_payload s, € ô
|
|||
|
|
Ð/˜$Ÿ/™/×/Ñ/°ÑN°t×7MÑ7MÑNÓOÐOr c óp — |€ | j } | j | j fd|i| j ¤ŽS )z‚Creates a new instance of the signer to be used. The default
|
|||
|
|
implementation uses the :class:`.Signer` base class.
|
|||
|
|
r. )r. r0 r; r1 )r r. s r Ú make_signerzSerializer.make_signer s9 € ð ˆ<Ø—9‘9ˆDàˆt�{‰{˜4×+Ñ+ÑM°$ÐM¸$×:LÑ:LÑMÐMr c # ó. K — |€ | j }| j |« –— | j D ]a }t |t « r|}| j
|
|||
|
|
}n"t |t « r|\ }}n | j }| j D ] } ||fd|i|¤Ž–— Œ Œc yw)z¯Iterates over all signers to be tried for unsigning. Starts
|
|||
|
|
with the configured signer, then constructs each signer
|
|||
|
|
specified in ``fallback_signers``.
|
|||
|
|
Nr. ) r. rK r2 r! Údictr0 Útupler1 r; )r r. ÚfallbackÚkwargsr- s r Úiter_unsignerszSerializer.iter_unsigners! s“ è ø€ ð
|
|||
|
|
ˆ<Ø—9‘9ˆDà× Ñ ˜tÓ$Ò$à ×-Ô-ˆHܘ(¤DÔ)Ø!�Ø Ÿ;™;‘ܘH¤eÔ,Ø#+Ñ �™&à ×+Ñ+�à "× .Ô .�
|
|||
|
|
Ù ˜zÑ?°Ð?¸Ñ?Ó?ñ /ñ .ùs ‚BBc ó´ — t | j |« « }| j |« j |« }| j r|j d« S |S )zÅReturns a signed string serialized with the internal
|
|||
|
|
serializer. The return value can be either a byte or unicode
|
|||
|
|
string depending on the format of the internal serializer.
|
|||
|
|
r@ )r rI rK Úsignr$ rB )r r r. r Úrvs r r zSerializer.dumps7 sQ € ô
|
|||
|
|
˜T× .Ñ .¨sÓ 3Ó4ˆØ
|
|||
|
|
×
|
|||
|
|
Ñ
|
|||
|
|
˜dÓ
|
|||
|
|
#×
|
|||
|
|
(Ñ
|
|||
|
|
(¨Ó
|
|||
|
|
1ˆà × "Ò "Ø—9‘9˜WÓ%Ð %àˆ r c óF — |j | j ||« « y)zŠLike :meth:`dumps` but dumps into a file. The file handle has
|
|||
|
|
to be compatible with what the internal serializer expects.
|
|||
|
|
N)Úwriter )r r Úfr. s r ÚdumpzSerializer.dumpD s € ð
|
|||
|
|
�‰�—
|
|||
|
|
‘
|
|||
|
|
˜3 Ó%Õ&r c óð — t |« }d}| j |« D ]$ } | j |j |« « c S t j t |« ‚# t $ r }|}Y d}~ŒQd}~ww xY w)ziReverse of :meth:`dumps`. Raises :exc:`.BadSignature` if the
|
|||
|
|
signature validation fails.
|
|||
|
|
N)r rQ rG Úunsignr ÚtÚcast)r Úsr. rP Úlast_exceptionr0 Úerrs r r zSerializer.loadsJ sp € ô
|
|||
|
|
�q‹MˆØ ˆà×)Ñ)¨$Ö/ˆFð
|
|||
|
|
%Ø×(Ñ(¨¯ © °qÓ)9Ó:Ò:ð 0ô �f‰f”\ >Ó2Ð2øô ò
|
|||
|
|
%Ø!$•ûð
|
|||
|
|
%ús £ A Á A5Á)A0Á0A5c óB — | j |j « |« S )z)Like :meth:`loads` but loads from a file.)r Úread©r rW r. s r ÚloadzSerializer.load[ s € à�z‰z˜!Ÿ&™&›( DÓ)Ð)r c ó& — | j ||« S )a9 Like :meth:`loads` but without verifying the signature. This
|
|||
|
|
is potentially very dangerous to use depending on how your
|
|||
|
|
serializer works. The return value is ``(signature_valid,
|
|||
|
|
payload)`` instead of just the payload. The first item will be a
|
|||
|
|
boolean that indicates if the signature is valid. This function
|
|||
|
|
never fails.
|
|||
|
|
|
|||
|
|
Use it for debugging only and if you know that your serializer
|
|||
|
|
module is not exploitable (for example, do not use it with a
|
|||
|
|
pickle serializer).
|
|||
|
|
|