Authlib 1.9.4__tar.gz → 1.9.5__tar.gz

{authlib-1.9.4 → authlib-1.9.5}/Authlib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.9.4
+Version: 1.9.5
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.9.4 → authlib-1.9.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.9.4
+Version: 1.9.5
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.9.4 → authlib-1.9.5}/authlib/consts.py

@@ -1,5 +1,5 @@
 name = "Authlib"
-version = "1.9.4"
+version = "1.9.5"
 author = "Hsiaoming Yang <me@lepture.com>"
 homepage = "https://authlib.org"
 default_user_agent = f"{name}/{version} (+{homepage})"

{authlib-1.9.4 → authlib-1.9.5}/authlib/jose/rfc7518/oct_key.py

@@ -1,5 +1,8 @@
 import secrets
 
+from cryptography.exceptions import UnsupportedAlgorithm
+from cryptography.hazmat.primitives.serialization import load_ssh_public_key
+
 from authlib.common.encoding import to_bytes
 from authlib.common.encoding import to_unicode
 from authlib.common.encoding import urlsafe_b64decode
@@ -16,6 +19,21 @@ POSSIBLE_UNSAFE_KEYS = (
     b"ecdsa-sha2-",
 )
 
+_SSH_PUBLIC_PREFIXES = (b"ssh-rsa", b"ssh-ed25519", b"ecdsa-sha2-")
+
+
+def _is_ssh_public_key(raw_key):
+    """Tell if the asymmetric key classes would load the bytes as an SSH key."""
+    if not raw_key.startswith(_SSH_PUBLIC_PREFIXES):
+        return False
+
+    try:
+        load_ssh_public_key(raw_key)
+    except (ValueError, UnsupportedAlgorithm):
+        return False
+
+    return True
+
 
 class OctKey(Key):
     """Key class of the ``oct`` key type."""
@@ -73,6 +91,9 @@ class OctKey(Key):
         if any(marker in raw_key for marker in POSSIBLE_UNSAFE_KEYS):
             raise ValueError("This key may not be safe to import")
 
+        if _is_ssh_public_key(raw_key):
+            raise ValueError("This key may not be safe to import")
+
     @classmethod
     def import_key(cls, raw, options=None):
         """Import a key from bytes, string, or dict data."""