zscaler-sdk-python 1.8.4__tar.gz → 1.8.6__tar.gz

{zscaler_sdk_python-1.8.4 → zscaler_sdk_python-1.8.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: zscaler-sdk-python
-Version: 1.8.4
+Version: 1.8.6
 Summary: Official Python SDK for the Zscaler Products
 Home-page: https://github.com/zscaler/zscaler-sdk-python
 License: MIT
@@ -26,9 +26,9 @@ Requires-Dist: arrow (>=1.3.0)
 Requires-Dist: cryptography (>=45.0.2)
 Requires-Dist: flatdict (>=4.0.0)
 Requires-Dist: pydash (>=8.0.3)
-Requires-Dist: pyjwt (>=2.8.0)
 Requires-Dist: python-box (>=7.3.0)
 Requires-Dist: python-dateutil (>=2.9.0)
+Requires-Dist: python-jose[cryptography] (>=3.3.0)
 Requires-Dist: pytz (>=2024.2)
 Requires-Dist: pyyaml (>=6.0.0)
 Requires-Dist: requests (>=2.32.3)

{zscaler_sdk_python-1.8.4 → zscaler_sdk_python-1.8.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "zscaler-sdk-python"
-version = "1.8.4"
+version = "1.8.6"
 description = "Official Python SDK for the Zscaler Products"
 authors = ["Zscaler, Inc. <devrel@zscaler.com>"]
 license = "MIT"
@@ -36,7 +36,7 @@ pytz = ">=2024.2"
 python-box = ">=7.3.0"
 python-dateutil = ">=2.9.0"
 flatdict = ">=4.0.0"
-pyjwt = ">=2.8.0"
+python-jose = {extras = ["cryptography"], version = ">=3.3.0"}
 aenum = ">=3.1.11"
 pydash = ">=8.0.3"
 arrow = ">=1.3.0"

{zscaler_sdk_python-1.8.4 → zscaler_sdk_python-1.8.6}/zscaler/__init__.py

@@ -29,7 +29,7 @@ __license__ = "MIT"
 __contributors__ = [
     "William Guilherme",
 ]
-__version__ = "1.8.4"
+__version__ = "1.8.6"
 
 
 from zscaler.oneapi_client import Client as ZscalerClient  # noqa

{zscaler_sdk_python-1.8.4 → zscaler_sdk_python-1.8.6}/zscaler/oneapi_oauth_client.py

@@ -1,16 +1,80 @@
 import logging
 import json
 import requests
-import jwt
+import os
+from jose import jwt
 import time
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
 from zscaler.user_agent import UserAgent
 from zscaler.oneapi_http_client import HTTPClient
 from zscaler.errors.response_checker import check_response_for_error
 
 logger = logging.getLogger(__name__)
 
+# Security constants for key validation
+MIN_RSA_KEY_SIZE = 2048  # NIST recommends minimum 2048 bits for RSA keys
+
+
+def validate_rsa_key_strength(private_key_obj):
+    """
+    Validate that an RSA private key meets minimum security requirements.
+    
+    This addresses CWE-326 (Inadequate Encryption Strength) by ensuring
+    RSA keys meet NIST recommendations of at least 2048 bits.
+    
+    Args:
+        private_key_obj: RSA private key object from cryptography library
+        
+    Raises:
+        ValueError: If the key size is below the minimum requirement
+        
+    Returns:
+        int: The key size in bits
+    """
+    if isinstance(private_key_obj, rsa.RSAPrivateKey):
+        key_size = private_key_obj.key_size
+        if key_size < MIN_RSA_KEY_SIZE:
+            logger.error(f"RSA key size ({key_size} bits) is below minimum requirement ({MIN_RSA_KEY_SIZE} bits)")
+            raise ValueError(
+                f"Insufficient RSA key strength: {key_size} bits. "
+                f"Minimum required: {MIN_RSA_KEY_SIZE} bits (NIST recommendation). "
+                f"Please use a stronger RSA key to ensure secure authentication."
+            )
+        logger.debug(f"RSA key validation passed: {key_size} bits")
+        return key_size
+    else:
+        logger.warning(f"Key validation skipped: Unsupported key type {type(private_key_obj)}")
+        return None
+
+
+def _setup_proxy(proxy):
+    """Sets up the proxy string from the configuration or environment variables."""
+    proxy_string = ""
+
+    if proxy is None:
+        if "HTTP_PROXY" in os.environ:
+            proxy_string = os.environ["HTTP_PROXY"]
+        if "HTTPS_PROXY" in os.environ:
+            proxy_string = os.environ["HTTPS_PROXY"]
+        return proxy_string if proxy_string != "" else None
+
+    host = proxy["host"]
+    port = int(proxy["port"]) if "port" in proxy else ""
+
+    if "username" in proxy and "password" in proxy:
+        username = proxy["username"]
+        password = proxy["password"]
+        proxy_string = f"http://{username}:{password}@{host}"
+    else:
+        proxy_string = f"http://{host}"
+
+    if port:
+        proxy_string += f":{port}/"
+
+    return proxy_string if proxy_string != "" else None
+
 
 class OAuth:
     """
@@ -233,9 +297,14 @@ class OAuth:
             "User-Agent": user_agent,
         }
 
+        # Get proxy configuration from config
+        proxy_config = self._config["client"].get("proxy")
+        proxy_string = _setup_proxy(proxy_config)
+        proxies = {"http": proxy_string, "https": proxy_string} if proxy_string else None
+
         # logging.debug(f"Sending authentication request to {auth_url}.")
         # Synchronous HTTP request (with form data in the body)
-        response = requests.post(auth_url, data=form_data, headers=headers)
+        response = requests.post(auth_url, data=form_data, headers=headers, proxies=proxies)
 
         if response.status_code >= 300:
             logging.error(f"Error authenticating: {response.status_code}, {response.text}")
@@ -280,6 +349,9 @@ class OAuth:
             with open(private_key, "rb") as key_file:
                 private_key_obj = serialization.load_pem_private_key(key_file.read(), password=None, backend=default_backend())
 
+        # **Validate key strength to mitigate CWE-326 (Inadequate Encryption Strength)**
+        validate_rsa_key_strength(private_key_obj)
+
         # **Step 2: Create JWT for Client Assertion**
         now = int(time.time())
         payload = {
@@ -307,8 +379,13 @@ class OAuth:
             "User-Agent": "Zscaler-SDK",
         }
 
+        # Get proxy configuration from config
+        proxy_config = self._config["client"].get("proxy")
+        proxy_string = _setup_proxy(proxy_config)
+        proxies = {"http": proxy_string, "https": proxy_string} if proxy_string else None
+
         logging.debug(f"Sending authentication request to {auth_url} with JWT.")
-        response = requests.post(auth_url, data=form_data, headers=headers)
+        response = requests.post(auth_url, data=form_data, headers=headers, proxies=proxies)
 
         if response.status_code >= 300:
             logging.error(f"Error authenticating: {response.status_code}, {response.text}")