OwlCyberSecurity - MANAGER
Edit File: csrf.cpython-39.pyc
a kH�f M � @ s� d Z ddlZddlZddlmZ ddlmZ ddlmZ ddl m Z m Z ddl m Z mZ ddlmZ dd lmZ dd lmZmZ dd lmZ dd lmZ dd lmZ ddl m Z ddl m Z e� d�Z!e d�Z"dZ#dZ$dZ%dZ&dZ'dZ(dZ)dZ*dZ+dZ,d e, Z-ej.ej/ Z0d Z1d d � Z2d d!� Z3d"d#� Z4d$d%� Z5d&d'� Z6d(d)� Z7d*d+� Z8G d,d-� d-e9�Z:d.d/� Z;d0d1� Z<G d2d3� d3e9�Z=G d4d5� d5e�Z>dS )6z� Cross Site Request Forgery Middleware. This module provides a middleware that implements protection against request forgeries from other sites. � N)� defaultdict��urlparse)�settings)�DisallowedHost�ImproperlyConfigured)� HttpHeaders�UnreadablePostError)� get_callable)�patch_vary_headers)�constant_time_compare�get_random_string)�MiddlewareMixin)�cached_property��is_same_domain)� log_response)�_lazy_re_compilezdjango.security.csrfz [^a-zA-Z0-9]z?Origin checking failed - %s does not match any trusted origins.z%Referer checking failed - no Referer.z@Referer checking failed - %s does not match any trusted origins.zCSRF cookie not set.zCSRF token missing.z/Referer checking failed - Referer is malformed.zCReferer checking failed - Referer is insecure while host is secure.zhas incorrect lengthzhas invalid characters� � Z _csrftokenc C s t tj�S )z/Return the view to be used for CSRF rejections.)r r ZCSRF_FAILURE_VIEW� r r �X/home/gouroczh/virtualenv/test/3.9/lib/python3.9/site-packages/django/middleware/csrf.py�_get_failure_view1 s r c C s t ttd�S )N)� allowed_chars)r �CSRF_SECRET_LENGTH�CSRF_ALLOWED_CHARSr r r r �_get_new_csrf_string6 s r c sP t � }t� t� fdd�| D �� fdd�|D ��}d�� fdd�|D ��}|| S )z� Given a secret (assumed to be a string of CSRF_ALLOWED_CHARS), generate a token by adding a mask and applying it to the secret. c 3 s | ]}� � |�V qd S �N��index��.0�x��charsr r � <genexpr>A � z&_mask_cipher_secret.<locals>.<genexpr>� c 3 s& | ] \}}� || t � � V qd S r )�len�r! r" �yr# r r r% B r& )r r �zip�join)�secret�mask�pairs�cipherr r# r �_mask_cipher_secret: s &r1 c sZ | dt � }| t d� } t� t� fdd�| D �� fdd�|D ��}d�� fdd�|D ��S )z� Given a token (assumed to be a string of CSRF_ALLOWED_CHARS, of length CSRF_TOKEN_LENGTH, and that its first half is a mask), use it to decrypt the second half to produce the original secret. Nc 3 s | ]}� � |�V qd S r r r r# r r r% O r& z'_unmask_cipher_token.<locals>.<genexpr>r' c 3 s | ]\}}� || V qd S r r r) r# r r r% P r& )r r r+ r, )�tokenr. r/ r r# r �_unmask_cipher_tokenF s &r3 c C s* t � }| j�tjrt|�n|dd�� |S )zDGenerate a new random CSRF_COOKIE value, and add it to request.META.T)� CSRF_COOKIE�CSRF_COOKIE_NEEDS_UPDATE)r �META�updater ZCSRF_COOKIE_MASKEDr1 ��request� csrf_secretr r r �_add_new_csrf_cookieS s � �� r; c C s0 d| j v r | j d }d| j d< nt| �}t|�S )a� Return the CSRF token required for a POST form. The token is an alphanumeric value. A new token is created if one is not already set. A side effect of calling this function is to make the csrf_protect decorator and the CsrfViewMiddleware add a CSRF cookie and a 'Vary: Cookie' header to the outgoing response. For this reason, you may need to use this function lazily, as is done by the csrf context processor. r4 Tr5 )r6 r; r1 r8 r r r � get_tokene s r< c C s t | � dS )zi Change the CSRF token in use for a request - should be done on login for security purposes. N)r; )r9 r r r � rotate_tokenz s r= c @ s e Zd Zdd� ZdS )�InvalidTokenFormatc C s || _ d S r ��reason��selfr@ r r r �__init__� s zInvalidTokenFormat.__init__N��__name__� __module__� __qualname__rC r r r r r> � s r> c C s. t | �ttfvrtt��t�| �r*tt��dS )z� Raise an InvalidTokenFormat error if the token has an invalid length or characters that aren't allowed. The token argument can be a CSRF cookie secret or non-cookie CSRF token, and either masked or unmasked. N)r( �CSRF_TOKEN_LENGTHr r> �REASON_INCORRECT_LENGTH�invalid_token_chars_re�search�REASON_INVALID_CHARACTERS)r2 r r r �_check_token_format� s rM c C s. t | �tkrt| �} t | �tks$J �t| |�S )a� Return whether the given CSRF token matches the given CSRF secret, after unmasking the token if necessary. This function assumes that the request_csrf_token argument has been validated to have the correct length (CSRF_SECRET_LENGTH or CSRF_TOKEN_LENGTH characters) and allowed characters, and that if it has length CSRF_TOKEN_LENGTH, it is a masked secret. )r( rH r3 r r )�request_csrf_tokenr: r r r �_does_token_match� s rO c @ s e Zd Zdd� ZdS )� RejectRequestc C s || _ d S r r? rA r r r rC � s zRejectRequest.__init__NrD r r r r rP � s rP c @ s� e Zd ZdZedd� �Zedd� �Zedd� �Zdd � Zd d � Z d d � Z dd� Z dd� Z dd� Z dd� Zdd� Zdd� Zdd� Zd d � Zd S ) �CsrfViewMiddlewarez� Require a present and correct csrfmiddlewaretoken for POST requests that have a CSRF cookie, and set an outgoing CSRF cookie. This middleware should be used in conjunction with the {% csrf_token %} template tag. c C s dd� t jD �S )Nc S s g | ]}t |�j�d ��qS ��*)r �netloc�lstrip�r! �originr r r � <listcomp>� s �zACsrfViewMiddleware.csrf_trusted_origins_hosts.<locals>.<listcomp>�r �CSRF_TRUSTED_ORIGINS�rB r r r �csrf_trusted_origins_hosts� s �z-CsrfViewMiddleware.csrf_trusted_origins_hostsc C s dd� t jD �S )Nc S s h | ]}d |vr|�qS rR r rV r r r � <setcomp>� r& z;CsrfViewMiddleware.allowed_origins_exact.<locals>.<setcomp>rY r[ r r r �allowed_origins_exact� s z(CsrfViewMiddleware.allowed_origins_exactc C s: t t�}dd� tjD �D ] }||j �|j�d�� q|S )z� A mapping of allowed schemes to list of allowed netlocs, where all subdomains of the netloc are allowed. c s s | ]}d |v rt |�V qdS )rS Nr rV r r r r% � s �z?CsrfViewMiddleware.allowed_origin_subdomains.<locals>.<genexpr>rS )r �listr rZ �scheme�appendrT rU )rB �allowed_origin_subdomains�parsedr r r rb � s � z,CsrfViewMiddleware.allowed_origin_subdomainsc C s d|_ d S )NT)�csrf_processing_done)rB r9 r r r �_accept� s zCsrfViewMiddleware._acceptc C s( t � ||d�}td||j||td� |S )Nr? zForbidden (%s): %s)�responser9 �logger)r r �pathrg )rB r9 r@ rf r r r �_reject� s �zCsrfViewMiddleware._rejectc C s� t jr4z|j�t�}W qd ty0 td��Y qd0 n0z|jt j }W n t yZ d}Y n 0 t |� |du rpdS t |�t kr�t |�}|S )a Return the CSRF secret originally associated with the request, or None if it didn't have one. If the CSRF_USE_SESSIONS setting is false, raises InvalidTokenFormat if the request's secret has invalid characters or an invalid length. z�CSRF_USE_SESSIONS is enabled, but request.session is not set. SessionMiddleware must appear before CsrfViewMiddleware in MIDDLEWARE.N)r �CSRF_USE_SESSIONS�session�get�CSRF_SESSION_KEY�AttributeErrorr ZCOOKIES�CSRF_COOKIE_NAME�KeyErrorrM r( rH r3 �rB r9 r: r r r � _get_secret� s" � z CsrfViewMiddleware._get_secretc C sj t jr.|j�t�|jd krf|jd |jt< n8|jt j|jd t jt j t j t j t j t j d� t|d� d S )Nr4 )�max_age�domainrh �secure�httponly�samesite)�Cookie)r rj rk rl rm r6 � set_cookiero ZCSRF_COOKIE_AGE�CSRF_COOKIE_DOMAINZCSRF_COOKIE_PATHZCSRF_COOKIE_SECUREZCSRF_COOKIE_HTTPONLYZCSRF_COOKIE_SAMESITEr �rB r9 rf r r r �_set_csrf_cookie s � z#CsrfViewMiddleware._set_csrf_cookiec s� |j d }z |�� }W n ty( Y n&0 d|�� r8dnd|f }||krNdS || jv r\dS z t|�}W n ty| Y dS 0 |j}|j� t � fdd�| j � |d �D ��S ) N� HTTP_ORIGINz%s://%s�https�httpTFc 3 s | ]}t � |�V qd S r r �r! �host�Zrequest_netlocr r r% ) s �z6CsrfViewMiddleware._origin_verified.<locals>.<genexpr>r ) r6 �get_hostr � is_securer^ r � ValueErrorr` rT �anyrb rl )rB r9 Zrequest_originZ good_hostZ good_originZ parsed_originZrequest_schemer r� r �_origin_verified s, � �z#CsrfViewMiddleware._origin_verifiedc s |j �d�� � d u r tt��z t� �� W n tyB tt��Y n0 d� j� jfv r\tt��� jdkrntt ��t � fdd�| j D ��r�d S t j r�t jnt j}|d u r�z |�� }W q� ty� tt� �� ��Y q�0 n |�� }|dvr�d||f }t� j|��stt� �� ��d S )NZ HTTP_REFERERr' r~ c 3 s | ]}t � j|�V qd S r )r rT r� �Zrefererr r r% @ s �z4CsrfViewMiddleware._check_referer.<locals>.<genexpr>)�443�80z%s:%s)r6 rl rP �REASON_NO_REFERERr r� �REASON_MALFORMED_REFERERr` rT �REASON_INSECURE_REFERERr� r\ r rj ZSESSION_COOKIE_DOMAINrz r� r �REASON_BAD_REFERER�geturlZget_portr )rB r9 Z good_refererZ server_portr r� r �_check_referer. s: ��� z!CsrfViewMiddleware._check_refererc C s0 |dkr t �|�}d|�d�}d|� d|� d�S )N�POSTzthe z HTTP headerzCSRF token from � �.)r Zparse_header_name)rB r@ � token_source� header_namer r r �_bad_token_message[ s z%CsrfViewMiddleware._bad_token_messagec C s8 z| � |�}W n6 tyD } z td|j� d���W Y d }~n d }~0 0 |d u rVtt��d}|jdkr�z|j�dd�}W n ty� Y n0 |dkr�z|j t j }W n t y� tt ��Y n0 t j }nd}z t|� W n< t�y } z"| �|j|�}t|��W Y d }~n d }~0 0 t||��s4| �d|�}t|��d S )Nz CSRF cookie r� r' r� ZcsrfmiddlewaretokenZ incorrect)rr r> rP r@ �REASON_NO_CSRF_COOKIE�methodr� rl r r6 r ZCSRF_HEADER_NAMErp �REASON_CSRF_TOKEN_MISSINGrM r� rO )rB r9 r: �excrN r� r@ r r r � _check_tokenb s6 ( z CsrfViewMiddleware._check_tokenc C s@ z| � |�}W n ty( t|� Y n0 |d ur<||jd< d S )Nr4 )rr r> r; r6 rq r r r �process_request� s z"CsrfViewMiddleware.process_requestc C s t |dd�rd S t |dd�r d S |jdv r4| �|�S t |dd�rJ| �|�S d|jv rv| �|�s�| �|t|jd �S nJ|�� r�z| �|� W n2 t y� } z| �||j �W Y d }~S d }~0 0 z| � |� W n4 t �y } z| �||j �W Y d }~S d }~0 0 | �|�S )Nrd FZ csrf_exempt)�GET�HEAD�OPTIONS�TRACEZ_dont_enforce_csrf_checksr} ) �getattrr� re r6 r� ri �REASON_BAD_ORIGINr� r� rP r@ r� )rB r9 �callback� callback_args�callback_kwargsr� r r r � process_view� s. �$$z CsrfViewMiddleware.process_viewc C s& |j �d�r"| �||� d|j d< |S )Nr5 F)r6 rl r| r{ r r r �process_response� s z#CsrfViewMiddleware.process_responseN)rE rF rG �__doc__r r\ r^ rb re ri rr r| r� r� r� r� r� r� r� r r r r rQ � s$ -4 9rQ )?r� �logging�string� collectionsr � urllib.parser Z django.confr Zdjango.core.exceptionsr r Z django.httpr r Z django.urlsr Zdjango.utils.cacher Zdjango.utils.cryptor r Zdjango.utils.deprecationr Zdjango.utils.functionalr Zdjango.utils.httpr Zdjango.utils.logr Zdjango.utils.regex_helperr � getLoggerrg rJ r� r� r� r� r� r� r� rI rL r rH � ascii_letters�digitsr rm r r r1 r3 r; r< r= � Exceptionr> rM rO rP rQ r r r r �<module> sV �