Skip to content

Commit d44049a

Browse files
author
Simple Geebus
committed
Merge commit 'c0df03cebdd61cbf5367290a735cf7c593fdb596'
2 parents a81f97f + c0df03c commit d44049a

File tree

2 files changed

+72
-9
lines changed

2 files changed

+72
-9
lines changed

‎oauth2/__init__.py

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
THE SOFTWARE.
2323
"""
2424

25+
import base64
2526
import urllib
2627
import time
2728
import random
@@ -459,6 +460,14 @@ def get_normalized_parameters(self):
459460
def sign_request(self, signature_method, consumer, token):
460461
"""Set the signature parameter to the result of sign."""
461462

463+
if not self.is_form_encoded:
464+
# according to
465+
# http://oauth.googlecode.com/svn/spec/ext/body_hash/1.0/oauth-bodyhash.html
466+
# section 4.1.1 "OAuth Consumers MUST NOT include an
467+
# oauth_body_hash parameter on requests with form-encoded
468+
# request bodies."
469+
self['oauth_body_hash'] = base64.b64encode(sha(self.body).digest())
470+
462471
if 'oauth_consumer_key' not in self:
463472
self['oauth_consumer_key'] = consumer.key
464473

‎tests/test_oauth.py

Lines changed: 63 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -622,14 +622,14 @@ def test_request_nonutf8_bytes(self, mock_make_nonce, mock_make_timestamp):
622622
url = u'http://sp.example.com/\u2019'
623623
req = oauth.Request(method="GET", url=url, parameters=params)
624624
req.sign_request(oauth.SignatureMethod_HMAC_SHA1(), con, None)
625-
self.failUnlessReallyEqual(req['oauth_signature'], '/DgF7cY2friC01cmOAFdu8S0z+A=')
625+
self.failUnlessReallyEqual(req['oauth_signature'], 'cMzvCkhvLL57+sTIxLITTHfkqZk=')
626626

627627
# And if it is a utf-8-encoded-then-percent-encoded non-ascii
628628
# thing, we'll decode it and use it.
629629
url = "http://sp.example.com/%E2%80%99"
630630
req = oauth.Request(method="GET", url=url, parameters=params)
631631
req.sign_request(oauth.SignatureMethod_HMAC_SHA1(), con, None)
632-
self.failUnlessReallyEqual(req['oauth_signature'], 'anzjnpdqCUJWvePgDiwMb7Q8g28=')
632+
self.failUnlessReallyEqual(req['oauth_signature'], 'yMLKOyNKC/DkyhUOb8DLSvceEWE=')
633633

634634
# Same thing with the params.
635635
url = "http://sp.example.com/"
@@ -643,20 +643,74 @@ def test_request_nonutf8_bytes(self, mock_make_nonce, mock_make_timestamp):
643643
params['non_oauth_thing'] = u'\u2019'
644644
req = oauth.Request(method="GET", url=url, parameters=params)
645645
req.sign_request(oauth.SignatureMethod_HMAC_SHA1(), con, None)
646-
self.failUnlessReallyEqual(req['oauth_signature'], 'QcgQMe9XzNxDWpechlQKFCd2orw=')
646+
self.failUnlessReallyEqual(req['oauth_signature'], '0GU50m0v60CVDB5JnoBXnvvvKx4=')
647647

648648
# And if it is a utf-8-encoded non-ascii thing, we'll decode
649649
# it and use it.
650650
params['non_oauth_thing'] = '\xc2\xae'
651651
req = oauth.Request(method="GET", url=url, parameters=params)
652652
req.sign_request(oauth.SignatureMethod_HMAC_SHA1(), con, None)
653-
self.failUnlessReallyEqual(req['oauth_signature'], 'OuMkgNFhlgcmEA1gIMII7aWLDgE=')
653+
self.failUnlessReallyEqual(req['oauth_signature'], 'pqOCu4qvRTiGiXB8Z61Jsey0pMM=')
654654

655655

656656
# Also if there are non-utf8 bytes in the query args.
657657
url = "http://sp.example.com/?q=\x92" # cp1252
658658
self.assertRaises(TypeError, oauth.Request, method="GET", url=url, parameters=params)
659659

660+
def test_request_hash_of_body(self):
661+
tok = oauth.Token(key="token", secret="tok-test-secret")
662+
con = oauth.Consumer(key="consumer", secret="con-test-secret")
663+
664+
# Example 1a from Appendix A.1 of
665+
# http://oauth.googlecode.com/svn/spec/ext/body_hash/1.0/oauth-bodyhash.html
666+
# Except that we get a differetn result than they do.
667+
668+
params = {
669+
'oauth_version': "1.0",
670+
'oauth_token': tok.key,
671+
'oauth_nonce': 10288510250934,
672+
'oauth_timestamp': 1236874155,
673+
'oauth_consumer_key': con.key
674+
}
675+
676+
url = u"http://www.example.com/resource"
677+
req = oauth.Request(method="PUT", url=url, parameters=params, body="Hello World!", is_form_encoded=False)
678+
req.sign_request(oauth.SignatureMethod_HMAC_SHA1(), con, None)
679+
self.failUnlessReallyEqual(req['oauth_body_hash'], 'Lve95gjOVATpfV8EL5X4nxwjKHE=')
680+
self.failUnlessReallyEqual(req['oauth_signature'], 't+MX8l/0S8hdbVQL99nD0X1fPnM=')
681+
# oauth-bodyhash.html A.1 has
682+
# '08bUFF%2Fjmp59mWB7cSgCYBUpJ0U%3D', but I don't see how that
683+
# is possible.
684+
685+
# Example 1b
686+
params = {
687+
'oauth_version': "1.0",
688+
'oauth_token': tok.key,
689+
'oauth_nonce': 10369470270925,
690+
'oauth_timestamp': 1236874236,
691+
'oauth_consumer_key': con.key
692+
}
693+
694+
req = oauth.Request(method="PUT", url=url, parameters=params, body="Hello World!", is_form_encoded=False)
695+
req.sign_request(oauth.SignatureMethod_HMAC_SHA1(), con, None)
696+
self.failUnlessReallyEqual(req['oauth_body_hash'], 'Lve95gjOVATpfV8EL5X4nxwjKHE=')
697+
self.failUnlessReallyEqual(req['oauth_signature'], 'CTFmrqJIGT7NsWJ42OrujahTtTc=')
698+
699+
# Appendix A.2
700+
params = {
701+
'oauth_version': "1.0",
702+
'oauth_token': tok.key,
703+
'oauth_nonce': 8628868109991,
704+
'oauth_timestamp': 1238395022,
705+
'oauth_consumer_key': con.key
706+
}
707+
708+
req = oauth.Request(method="GET", url=url, parameters=params, is_form_encoded=False)
709+
req.sign_request(oauth.SignatureMethod_HMAC_SHA1(), con, None)
710+
self.failUnlessReallyEqual(req['oauth_body_hash'], '2jmj7l5rSw0yVb/vlWAYkK/YBwk=')
711+
self.failUnlessReallyEqual(req['oauth_signature'], 'Zhl++aWSP0O3/hYQ0CuBc7jv38I=')
712+
713+
660714
def test_sign_request(self):
661715
url = "http://sp.example.com/"
662716

@@ -674,7 +728,7 @@ def test_sign_request(self):
674728
req = oauth.Request(method="GET", url=url, parameters=params)
675729

676730
methods = {
677-
'TQ6vGQ5A6IZn8dmeGB4+/Jl3EMI=': oauth.SignatureMethod_HMAC_SHA1(),
731+
'DX01TdHws7OninCLK9VztNTH1M4=': oauth.SignatureMethod_HMAC_SHA1(),
678732
'con-test-secret&tok-test-secret': oauth.SignatureMethod_PLAINTEXT()
679733
}
680734

@@ -687,23 +741,23 @@ def test_sign_request(self):
687741
url = "http://sp.example.com/\xe2\x80\x99" # utf-8 bytes
688742
req = oauth.Request(method="GET", url=url, parameters=params)
689743
req.sign_request(oauth.SignatureMethod_HMAC_SHA1(), con, tok)
690-
self.assertEquals(req['oauth_signature'], 'KagU7uiAAEvkZEzej2fcbyRXtzo=')
744+
self.assertEquals(req['oauth_signature'], 'loFvp5xC7YbOgd9exIO6TxB7H4s=')
691745

692746
url = u'http://sp.example.com/\u2019' # Python unicode object
693747
req = oauth.Request(method="GET", url=url, parameters=params)
694748
req.sign_request(oauth.SignatureMethod_HMAC_SHA1(), con, tok)
695-
self.assertEquals(req['oauth_signature'], 'KagU7uiAAEvkZEzej2fcbyRXtzo=')
749+
self.assertEquals(req['oauth_signature'], 'loFvp5xC7YbOgd9exIO6TxB7H4s=')
696750

697751
# Also if there are non-ascii chars in the query args.
698752
url = "http://sp.example.com/?q=\xe2\x80\x99" # utf-8 bytes
699753
req = oauth.Request(method="GET", url=url, parameters=params)
700754
req.sign_request(oauth.SignatureMethod_HMAC_SHA1(), con, tok)
701-
self.assertEquals(req['oauth_signature'], '5hyI7ovTVkcCyLeOKYzugnIvseo=')
755+
self.assertEquals(req['oauth_signature'], 'IBw5mfvoCsDjgpcsVKbyvsDqQaU=')
702756

703757
url = u'http://sp.example.com/?q=\u2019' # Python unicode object
704758
req = oauth.Request(method="GET", url=url, parameters=params)
705759
req.sign_request(oauth.SignatureMethod_HMAC_SHA1(), con, tok)
706-
self.assertEquals(req['oauth_signature'], '5hyI7ovTVkcCyLeOKYzugnIvseo=')
760+
self.assertEquals(req['oauth_signature'], 'IBw5mfvoCsDjgpcsVKbyvsDqQaU=')
707761

708762
def test_from_request(self):
709763
url = "http://sp.example.com/"

0 commit comments

Comments
 (0)