init-data-py 0.2.4__tar.gz → 0.2.6__tar.gz

{init_data_py-0.2.4 → init_data_py-0.2.6}/PKG-INFO

@@ -1,10 +1,9 @@
 Metadata-Version: 2.3
 Name: init-data-py
-Version: 0.2.4
+Version: 0.2.6
 Summary: A Python library that provides tools for using and validating Telegram web app init data.
 Author-email: nimaxin <nimaxin@proton.me>
-License-Expression: MIT
-License-File: LICENCE
+License: MIT
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 

{init_data_py-0.2.4 → init_data_py-0.2.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "init-data-py"
-version = "0.2.4"
+version = "0.2.6"
 description = "A Python library that provides tools for using and validating Telegram web app init data."
 authors = [
     { name = "nimaxin", email = "nimaxin@proton.me" }

{init_data_py-0.2.4 → init_data_py-0.2.6}/src/init_data_py/__init__.py

@@ -1,5 +1,5 @@
 from .init_data import InitData
 
-__version__ = "0.2.4"
+__version__ = "0.2.6"
 
 __all__ = ["InitData"]

{init_data_py-0.2.4 → init_data_py-0.2.6}/src/init_data_py/init_data.py

@@ -43,6 +43,9 @@ class InitData:
 
         hash (`str`, optional):
             A hash of all passed parameters, which the bot server can use to check their validity.
+
+        signature (`str`, optional):
+            A signature of all passed parameters (except hash), which the third party can use to check their validity.
     """
 
     def __init__(
@@ -60,6 +63,7 @@ class InitData:
         can_send_after: Optional[int] = None,
         auth_date: Optional[int] = None,
         hash: Optional[str] = None,
+        signature: Optional[str] = None,
     ) -> None:
         self.query_id = query_id
         self.user = user
@@ -71,6 +75,7 @@ class InitData:
         self.can_send_after = can_send_after
         self.auth_date = auth_date
         self.hash = hash
+        self.signature = signature
 
     def validate(
         self,
@@ -140,7 +145,9 @@ class InitData:
             `InitData`:
                 This current updated init data by setting the `auth_date` and generated signature (`hash`) attributes.
         """
-        self.auth_date = auth_date if auth_date is not None else int(time.time())
+        self.auth_date = (
+            auth_date if auth_date is not None else int(time.time())
+        )
         self.hash = self.calculate_hash(bot_token)
 
         return self
@@ -162,9 +169,11 @@ class InitData:
         init_data = self.to_dict(nested=False)
         init_data.pop("hash", None)
         sorted_attrs = sorted(init_data.items())
-        data_check_string = "\n".join(
-            f"{k}={v}" for k, v in sorted_attrs
-        ).encode()
+        data_check_string = (
+            "\n".join(f"{k}={v}" for k, v in sorted_attrs)
+            .replace("/", "\/")
+            .encode()
+        )
         secret_key = hmac.new(
             b"WebAppData", bot_token.encode(), hashlib.sha256
         ).digest()
@@ -210,6 +219,7 @@ class InitData:
         for k, v in parsed_qs.items():
             if k in {
                 "hash",
+                "signature",
                 "query_id",
                 "chat_type",
                 "chat_instance",

{init_data_py-0.2.4 → init_data_py-0.2.6}/tests/test_validate.py

@@ -29,6 +29,12 @@ class TestValidateInitData(unittest.TestCase):
         init_data = InitData.parse(query_string)
         self.assertTrue(init_data.validate(bot_token))
 
+    def test_escape_character(self):
+        query_string = "query_id=AAF03wc0AgAAAHTfBzTtHPDB&user=%7B%22id%22%3A5167898484%2C%22first_name%22%3A%22xin%22%2C%22last_name%22%3A%22%22%2C%22username%22%3A%22pvnimaxin%22%2C%22language_code%22%3A%22en%22%2C%22allows_write_to_pm%22%3Atrue%2C%22photo_url%22%3A%22https%3A%5C%2F%5C%2Ft.me%5C%2Fi%5C%2Fuserpic%5C%2F320%5C%2FYpcdHFmoxukmQ537mOZhe-Woot_k2xrmbdAIrGK1zFgIVth6Wzacz7P2nGNCcp9j.svg%22%7D&auth_date=1731441609&hash=f4bac82fe8f20abdc03126af489751752e830227b58241ec2f9dd67913909ee0"
+        bot_token = "7244657541:AAFMjYH4kc3U9zG0GWnxYfW-QKICVzDwvEw"
+        init_data = InitData.parse(query_string)
+        self.assertTrue(init_data.validate(bot_token))
+
     def test_valid_init_data(self):
         self.assertTrue(self.init_data.validate(self.bot_token))