Authlib 1.6.4__tar.gz → 1.6.5__tar.gz

{authlib-1.6.4 → authlib-1.6.5}/Authlib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.6.4
+Version: 1.6.5
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.6.4 → authlib-1.6.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.6.4
+Version: 1.6.5
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.6.4 → authlib-1.6.5}/authlib/consts.py

@@ -1,5 +1,5 @@
 name = "Authlib"
-version = "1.6.4"
+version = "1.6.5"
 author = "Hsiaoming Yang <me@lepture.com>"
 homepage = "https://authlib.org"
 default_user_agent = f"{name}/{version} (+{homepage})"

{authlib-1.6.4 → authlib-1.6.5}/authlib/jose/rfc7515/jws.py

@@ -34,6 +34,8 @@ class JsonWebSignature:
         ]
     )
 
+    MAX_CONTENT_LENGTH: int = 256000
+
     #: Defined available JWS algorithms in the registry
     ALGORITHMS_REGISTRY = {}
 
@@ -89,6 +91,9 @@ class JsonWebSignature:
 
         .. _`Section 7.1`: https://tools.ietf.org/html/rfc7515#section-7.1
         """
+        if len(s) > self.MAX_CONTENT_LENGTH:
+            raise ValueError("Serialization is too long.")
+
         try:
             s = to_bytes(s)
             signing_input, signature_segment = s.rsplit(b".", 1)

authlib-1.6.5/authlib/jose/rfc7518/jwe_zips.py

@@ -0,0 +1,34 @@
+import zlib
+
+from ..rfc7516 import JsonWebEncryption
+from ..rfc7516 import JWEZipAlgorithm
+
+GZIP_HEAD = bytes([120, 156])
+MAX_SIZE = 250 * 1024
+
+
+class DeflateZipAlgorithm(JWEZipAlgorithm):
+    name = "DEF"
+    description = "DEFLATE"
+
+    def compress(self, s: bytes) -> bytes:
+        """Compress bytes data with DEFLATE algorithm."""
+        data = zlib.compress(s)
+        # https://datatracker.ietf.org/doc/html/rfc1951
+        # since DEF is always gzip, we can drop gzip headers and tail
+        return data[2:-4]
+
+    def decompress(self, s: bytes) -> bytes:
+        """Decompress DEFLATE bytes data."""
+        if s.startswith(GZIP_HEAD):
+            decompressor = zlib.decompressobj()
+        else:
+            decompressor = zlib.decompressobj(-zlib.MAX_WBITS)
+        value = decompressor.decompress(s, MAX_SIZE)
+        if decompressor.unconsumed_tail:
+            raise ValueError(f"Decompressed string exceeds {MAX_SIZE} bytes")
+        return value
+
+
+def register_jwe_rfc7518():
+    JsonWebEncryption.register_algorithm(DeflateZipAlgorithm())

{authlib-1.6.4 → authlib-1.6.5}/authlib/jose/util.py

@@ -7,6 +7,9 @@ from authlib.jose.errors import DecodeError
 
 
 def extract_header(header_segment, error_cls):
+    if len(header_segment) > 256000:
+        raise ValueError("Value of header is too long")
+
     header_data = extract_segment(header_segment, error_cls, "header")
 
     try:
@@ -20,6 +23,9 @@ def extract_header(header_segment, error_cls):
 
 
 def extract_segment(segment, error_cls, name="payload"):
+    if len(segment) > 256000:
+        raise ValueError(f"Value of {name} is too long")
+
     try:
         return urlsafe_b64decode(segment)
     except (TypeError, binascii.Error) as exc:

{authlib-1.6.4 → authlib-1.6.5}/authlib/oauth2/rfc6749/parameters.py

@@ -54,9 +54,14 @@ def prepare_grant_uri(
     if state:
         params.append(("state", state))
 
-    for k in kwargs:
-        if kwargs[k] is not None:
-            params.append((to_unicode(k), kwargs[k]))
+    for k, value in kwargs.items():
+        if value is not None:
+            if isinstance(value, (list, tuple)):
+                for v in value:
+                    if v is not None:
+                        params.append((to_unicode(k), v))
+            else:
+                params.append((to_unicode(k), value))
 
     return add_params_to_uri(uri, params)
 

{authlib-1.6.4 → authlib-1.6.5}/authlib/oauth2/rfc7591/endpoint.py

@@ -4,6 +4,7 @@ import time
 
 from authlib.common.security import generate_token
 from authlib.consts import default_json_headers
+from authlib.deprecate import deprecate
 from authlib.jose import JoseError
 from authlib.jose import JsonWebToken
 
@@ -41,7 +42,7 @@ class ClientRegistrationEndpoint:
         request.credential = token
 
         client_metadata = self.extract_client_metadata(request)
-        client_info = self.generate_client_info()
+        client_info = self.generate_client_info(request)
         body = {}
         body.update(client_metadata)
         body.update(client_info)
@@ -91,10 +92,28 @@ class ClientRegistrationEndpoint:
         except JoseError as exc:
             raise InvalidSoftwareStatementError() from exc
 
-    def generate_client_info(self):
+    def generate_client_info(self, request):
         # https://tools.ietf.org/html/rfc7591#section-3.2.1
-        client_id = self.generate_client_id()
-        client_secret = self.generate_client_secret()
+        try:
+            client_id = self.generate_client_id(request)
+        except TypeError:  # pragma: no cover
+            client_id = self.generate_client_id()
+            deprecate(
+                "generate_client_id takes a 'request' parameter. "
+                "It will become mandatory in coming releases",
+                version="1.8",
+            )
+
+        try:
+            client_secret = self.generate_client_secret(request)
+        except TypeError:  # pragma: no cover
+            client_secret = self.generate_client_secret()
+            deprecate(
+                "generate_client_secret takes a 'request' parameter. "
+                "It will become mandatory in coming releases",
+                version="1.8",
+            )
+
         client_id_issued_at = int(time.time())
         client_secret_expires_at = 0
         return dict(
@@ -114,13 +133,13 @@ class ClientRegistrationEndpoint:
     def create_endpoint_request(self, request):
         return self.server.create_json_request(request)
 
-    def generate_client_id(self):
+    def generate_client_id(self, request):
         """Generate ``client_id`` value. Developers MAY rewrite this method
         to use their own way to generate ``client_id``.
         """
         return generate_token(42)
 
-    def generate_client_secret(self):
+    def generate_client_secret(self, request):
         """Generate ``client_secret`` value. Developers MAY rewrite this method
         to use their own way to generate ``client_secret``.
         """

authlib-1.6.4/authlib/jose/rfc7518/jwe_zips.py

@@ -1,23 +0,0 @@
-import zlib
-
-from ..rfc7516 import JsonWebEncryption
-from ..rfc7516 import JWEZipAlgorithm
-
-
-class DeflateZipAlgorithm(JWEZipAlgorithm):
-    name = "DEF"
-    description = "DEFLATE"
-
-    def compress(self, s):
-        """Compress bytes data with DEFLATE algorithm."""
-        data = zlib.compress(s)
-        # drop gzip headers and tail
-        return data[2:-4]
-
-    def decompress(self, s):
-        """Decompress DEFLATE bytes data."""
-        return zlib.decompress(s, -zlib.MAX_WBITS)
-
-
-def register_jwe_rfc7518():
-    JsonWebEncryption.register_algorithm(DeflateZipAlgorithm())