diff options
Diffstat (limited to 'oauthlib/oauth1/rfc5849/signature.py')
| -rw-r--r-- | oauthlib/oauth1/rfc5849/signature.py | 35 |
1 files changed, 33 insertions, 2 deletions
diff --git a/oauthlib/oauth1/rfc5849/signature.py b/oauthlib/oauth1/rfc5849/signature.py index d9d11a8..677865c 100644 --- a/oauthlib/oauth1/rfc5849/signature.py +++ b/oauthlib/oauth1/rfc5849/signature.py @@ -99,7 +99,7 @@ def construct_base_string(http_method, base_string_uri, return base_string -def normalize_base_string_uri(uri): +def normalize_base_string_uri(uri, host=None): """**Base String URI** Per `section 3.4.1.2`_ of the spec. @@ -118,6 +118,8 @@ def normalize_base_string_uri(uri): is represented by the base string URI: "https://www.example.net:8080/". .. _`section 3.4.1.2`: http://tools.ietf.org/html/rfc5849#section-3.4.1.2 + + The host argument overrides the netloc part of the uri argument. """ if not isinstance(uri, unicode_type): raise ValueError('uri must be a unicode object.') @@ -131,13 +133,26 @@ def normalize_base_string_uri(uri): # # .. _`RFC2616`: http://tools.ietf.org/html/rfc3986 + if not scheme: + raise ValueError('uri must include a scheme') + + # Per `RFC 2616 section 5.1.2`_: + # + # Note that the absolute path cannot be empty; if none is present in + # the original URI, it MUST be given as "/" (the server root). + # + # .. _`RFC 2616 section 5.1.2`: http://tools.ietf.org/html/rfc2616#section-5.1.2 + if not path: + path = '/' + # 1. The scheme and host MUST be in lowercase. scheme = scheme.lower() netloc = netloc.lower() # 2. The host and port values MUST match the content of the HTTP # request "Host" header field. - # TODO: enforce this constraint + if host is not None: + netloc = host.lower() # 3. The port MUST be included if it is not the default port for the # scheme, and MUST be excluded if it is the default. Specifically, @@ -514,6 +529,15 @@ def verify_hmac_sha1(request, client_secret=None, Per `section 3.4`_ of the spec. .. _`section 3.4`: http://tools.ietf.org/html/rfc5849#section-3.4 + + To satisfy `RFC2616 section 5.2`_ item 1, the request argument's uri + attribute MUST be an absolute URI whose netloc part identifies the + origin server or gateway on which the resource resides. Any Host + item of the request argument's headers dict attribute will be + ignored. + + .. _`RFC2616 section 5.2`: http://tools.ietf.org/html/rfc2616#section-5.2 + """ norm_params = normalize_parameters(request.params) uri = normalize_base_string_uri(request.uri) @@ -532,6 +556,13 @@ def verify_rsa_sha1(request, rsa_public_key): .. _`section 3.4.3`: http://tools.ietf.org/html/rfc5849#section-3.4.3 + To satisfy `RFC2616 section 5.2`_ item 1, the request argument's uri + attribute MUST be an absolute URI whose netloc part identifies the + origin server or gateway on which the resource resides. Any Host + item of the request argument's headers dict attribute will be + ignored. + + .. _`RFC2616 section 5.2`: http://tools.ietf.org/html/rfc2616#section-5.2 """ from Crypto.PublicKey import RSA from Crypto.Signature import PKCS1_v1_5 |