Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def static(environ, session, path):
logger.info("[static]sending: %s" % (path,))
try:
text = open(path).read()
ext = path.rsplit(".", 1)[-1]
try:
ctype = CTYPE_MAP[ext]
except KeyError:
ctype = CTYPE_MAP["txt"]
return Response(text, headers=[('Content-Type', ctype)])
except IOError:
return NotFound()
def test_multiple_response_types_urlencoded(self):
ar = AuthorizationRequest(response_type=["code", "token"], client_id="foobar")
ue = ar.to_urlencoded()
ue_splits = ue.split("&")
expected_ue_splits = "response_type=code+token&client_id=foobar".split("&")
assert _eq(ue_splits, expected_ue_splits)
are = AuthorizationRequest().deserialize(ue, "urlencoded")
assert _eq(are.keys(), ["response_type", "client_id"])
assert _eq(are["response_type"], ["code", "token"])
key = SYMKey(key="TestPassword")
_signed_jwt = idts.to_jwt(key=[key], algorithm="HS256")
# Mess with the signed id_token
p = _signed_jwt.split(".")
p[2] = "aaa"
_faulty_signed_jwt = ".".join(p)
_info = {
"access_token": "accessTok",
"id_token": _faulty_signed_jwt,
"token_type": "Bearer",
"expires_in": 3600,
}
at = AccessTokenResponse(**_info)
with pytest.raises(BadSignature):
at.verify(key=[key])
idval = {'nonce': 'KUEYfRM2VzKDaaKD', 'sub': 'EndUserSubject',
'iss': 'https://alpha.cloud.nds.rub.de', 'exp': 1420823073,
'iat': 1420822473, 'aud': 'TestClient'}
idts = IdToken(**idval)
key = SYMKey(key="TestPassword")
_signed_jwt = idts.to_jwt(key=[key], algorithm="HS256")
# Mess with the signed id_token
p = _signed_jwt.split(".")
p[2] = "aaa"
_faulty_signed_jwt = ".".join(p)
_info = {"access_token": "accessTok", "id_token": _faulty_signed_jwt,
"token_type": "Bearer", "expires_in": 3600}
at = AccessTokenResponse(**_info)
with pytest.raises(BadSignature):
at.verify(key=[key])
def test_omit(self):
err = ErrorResponse(
error="invalid_request",
error_description="Something was missing",
error_uri="http://example.com/error_message.html",
)
ue_str = err.to_urlencoded()
del err["error_uri"]
ueo_str = err.to_urlencoded()
assert ue_str != ueo_str
assert "error_message" not in ueo_str
assert "error_message" in ue_str
def flow_list(self, session):
resp = Response(mako_template="flowlist.mako",
template_lookup=self.lookup,
headers=[])
try:
_tid = session["testid"]
except KeyError:
_tid = None
self.dump_log(session, _tid)
argv = {
"flows": session["tests"],
"profile": session["profile"],
"test_info": session["test_info"].keys(),
"base": self.conf.BASE,
"headlines": self.test_flows.DESC,
def registration_endpoint(self, data):
try:
req = self.parse_registration_request(data, "json")
except DecodeError:
req = self.parse_registration_request(data)
client_secret = rndstr()
expires = utc_time_sans_frac() + self.registration_expires_in
kwargs = {} # type: Dict[str, str]
if "client_id" not in req:
client_id = rndstr(10)
registration_access_token = rndstr(20)
_client_info = req.to_dict()
kwargs.update(_client_info)
_client_info.update(
{
"client_secret": client_secret,
"info": req.to_dict(),
"expires": expires,
"registration_access_token": registration_access_token,
"registration_client_uri": "register_endpoint",
}
)
def registration_endpoint(self, data):
try:
req = self.parse_registration_request(data, "json")
except ValueError:
req = self.parse_registration_request(data)
client_secret = rndstr()
expires = utc_time_sans_frac() + self.registration_expires_in
kwargs = {} # type: Dict[str, str]
if "client_id" not in req:
client_id = rndstr(10)
registration_access_token = rndstr(20)
_client_info = req.to_dict()
kwargs.update(_client_info)
_client_info.update(
{
"client_secret": client_secret,
"info": req.to_dict(),
"expires": expires,
"registration_access_token": registration_access_token,
"registration_client_uri": "register_endpoint",
}
)
def create_provider(self):
kb = KeyBundle(JWKS["keys"])
kj = KeyJar()
kj.issuer_keys[""] = [kb]
_sdb = SessionDB(
"https://example.com/",
db=DictSessionBackend(),
code_factory=DefaultToken(
"supersecret", "verybadpassword", typ="A", lifetime=600
),
token_factory=JWTToken(
"T",
keyjar=kj,
lt_pattern={"code": 3600, "token": 900},
iss="https://example.com/as",
sign_alg="RS256",
),
refresh_token_factory=JWTToken(
def fo_member(*args):
_kj = KeyJar()
for fo in args:
_kj.import_jwks(fo.jwks, fo.iss)
return Operator(fo_keyjar=_kj)