Coverage for /pythoncovmergedfiles/medio/medio/usr/local/lib/python3.11/site-packages/botocore/handlers.py: 22%

1# Copyright 2012-2014 Amazon.com, Inc. or its affiliates. All Rights Reserved. 

2# 

3# Licensed under the Apache License, Version 2.0 (the "License"). You 

4# may not use this file except in compliance with the License. A copy of 

5# the License is located at 

6# 

7# http://aws.amazon.com/apache2.0/ 

8# 

9# or in the "license" file accompanying this file. This file is 

10# distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF 

11# ANY KIND, either express or implied. See the License for the specific 

12# language governing permissions and limitations under the License. 

13 

14"""Builtin event handlers. 

15 

16This module contains builtin handlers for events emitted by botocore. 

17""" 

18 

19import base64 

20import copy 

21import logging 

22import os 

23import re 

24import uuid 

25import warnings 

26from io import BytesIO 

27 

28import botocore 

29import botocore.auth 

30from botocore import ( 

31 retryhandler, # noqa: F401 

32 translate, # noqa: F401 

33 utils, 

34) 

35from botocore.args import ClientConfigString 

36from botocore.compat import ( 

37 MD5_AVAILABLE, # noqa: F401 

38 ETree, 

39 OrderedDict, 

40 XMLParseError, 

41 ensure_bytes, 

42 get_md5, 

43 json, 

44 quote, 

45 unquote, 

46 unquote_str, 

47 urlsplit, 

48 urlunsplit, 

49) 

50from botocore.docs.utils import ( 

51 AppendParamDocumentation, 

52 AutoPopulatedParam, 

53 HideParamFromOperations, 

54) 

55from botocore.endpoint_provider import VALID_HOST_LABEL_RE 

56from botocore.exceptions import ( 

57 AliasConflictParameterError, 

58 MissingServiceIdError, # noqa: F401 

59 ParamValidationError, 

60 UnsupportedTLSVersionWarning, 

61) 

62from botocore.regions import EndpointResolverBuiltins 

63from botocore.serialize import TIMESTAMP_PRECISION_MILLISECOND 

64from botocore.signers import ( 

65 add_dsql_generate_db_auth_token_methods, 

66 add_generate_db_auth_token, 

67 add_generate_presigned_post, 

68 add_generate_presigned_url, 

69) 

70from botocore.useragent import register_feature_id 

71from botocore.utils import ( 

72 SAFE_CHARS, 

73 SERVICE_NAME_ALIASES, # noqa: F401 

74 ArnParser, 

75 get_token_from_environment, 

76 hyphenize_service_id, # noqa: F401 

77 is_global_accesspoint, # noqa: F401 

78 percent_encode, 

79 switch_host_with_param, 

80) 

81 

82logger = logging.getLogger(__name__) 

83 

84REGISTER_FIRST = object() 

85REGISTER_LAST = object() 

86# From the S3 docs: 

87# The rules for bucket names in the US Standard region allow bucket names 

88# to be as long as 255 characters, and bucket names can contain any 

89# combination of uppercase letters, lowercase letters, numbers, periods 

90# (.), hyphens (-), and underscores (_). 

91VALID_BUCKET = re.compile(r'^[a-zA-Z0-9.\-_]{1,255}$') 

92_ACCESSPOINT_ARN = ( 

93 r'^arn:(aws).*:(s3|s3-object-lambda):[a-z\-0-9]*:[0-9]{12}:accesspoint[/:]' 

94 r'[a-zA-Z0-9\-.]{1,63}$' 

95) 

96_OUTPOST_ARN = ( 

97 r'^arn:(aws).*:s3-outposts:[a-z\-0-9]+:[0-9]{12}:outpost[/:]' 

98 r'[a-zA-Z0-9\-]{1,63}[/:]accesspoint[/:][a-zA-Z0-9\-]{1,63}$' 

99) 

100VALID_S3_ARN = re.compile('|'.join([_ACCESSPOINT_ARN, _OUTPOST_ARN])) 

101# signing names used for the services s3 and s3-control, for example in 

102# botocore/data/s3/2006-03-01/endpoints-rule-set-1.json 

103S3_SIGNING_NAMES = ('s3', 's3-outposts', 's3-object-lambda', 's3express') 

104VERSION_ID_SUFFIX = re.compile(r'\?versionId=[^\s]+$') 

105 

106 

107def handle_service_name_alias(service_name, **kwargs): 

108 return SERVICE_NAME_ALIASES.get(service_name, service_name) 

109 

110 

111def add_recursion_detection_header(params, **kwargs): 

112 has_lambda_name = 'AWS_LAMBDA_FUNCTION_NAME' in os.environ 

113 trace_id = os.environ.get('_X_AMZN_TRACE_ID') 

114 if has_lambda_name and trace_id: 

115 headers = params['headers'] 

116 if 'X-Amzn-Trace-Id' not in headers: 

117 headers['X-Amzn-Trace-Id'] = quote(trace_id, safe='-=;:+&[]{}"\',') 

118 

119 

120def escape_xml_payload(params, **kwargs): 

121 # Replace \r and \n with the escaped sequence over the whole XML document 

122 # to avoid linebreak normalization modifying customer input when the 

123 # document is parsed. Ideally, we would do this in ElementTree.tostring, 

124 # but it doesn't allow us to override entity escaping for text fields. For 

125 # this operation \r and \n can only appear in the XML document if they were 

126 # passed as part of the customer input. 

127 body = params['body'] 

128 if b'\r' in body: 

129 body = body.replace(b'\r', b'
') 

130 if b'\n' in body: 

131 body = body.replace(b'\n', b'
') 

132 

133 params['body'] = body 

134 

135 

136def check_for_200_error(response, **kwargs): 

137 """This function has been deprecated, but is kept for backwards compatibility.""" 

138 # From: http://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectCOPY.html 

139 # There are two opportunities for a copy request to return an error. One 

140 # can occur when Amazon S3 receives the copy request and the other can 

141 # occur while Amazon S3 is copying the files. If the error occurs before 

142 # the copy operation starts, you receive a standard Amazon S3 error. If the 

143 # error occurs during the copy operation, the error response is embedded in 

144 # the 200 OK response. This means that a 200 OK response can contain either 

145 # a success or an error. Make sure to design your application to parse the 

146 # contents of the response and handle it appropriately. 

147 # 

148 # So this handler checks for this case. Even though the server sends a 

149 # 200 response, conceptually this should be handled exactly like a 

150 # 500 response (with respect to raising exceptions, retries, etc.) 

151 # We're connected *before* all the other retry logic handlers, so as long 

152 # as we switch the error code to 500, we'll retry the error as expected. 

153 if response is None: 

154 # A None response can happen if an exception is raised while 

155 # trying to retrieve the response. See Endpoint._get_response(). 

156 return 

157 http_response, parsed = response 

158 if _looks_like_special_case_error( 

159 http_response.status_code, http_response.content 

160 ): 

161 logger.debug( 

162 "Error found for response with 200 status code, " 

163 "errors: %s, changing status code to " 

164 "500.", 

165 parsed, 

166 ) 

167 http_response.status_code = 500 

168 

169 

170def _looks_like_special_case_error(status_code, body): 

171 if status_code == 200 and body: 

172 try: 

173 parser = ETree.XMLParser( 

174 target=ETree.TreeBuilder(), encoding='utf-8' 

175 ) 

176 parser.feed(body) 

177 root = parser.close() 

178 except XMLParseError: 

179 # In cases of network disruptions, we may end up with a partial 

180 # streamed response from S3. We need to treat these cases as 

181 # 500 Service Errors and try again. 

182 return True 

183 if root.tag == 'Error': 

184 return True 

185 return False 

186 

187 

188def set_operation_specific_signer(context, signing_name, **kwargs): 

189 """Choose the operation-specific signer. 

190 

191 Individual operations may have a different auth type than the service as a 

192 whole. This will most often manifest as operations that should not be 

193 authenticated at all, but can include other auth modes such as sigv4 

194 without body signing. 

195 """ 

196 auth_type = context.get('auth_type') 

197 

198 # Auth type will be None if the operation doesn't have a configured auth 

199 # type. 

200 if not auth_type: 

201 return 

202 

203 # Auth type will be the string value 'none' if the operation should not 

204 # be signed at all. 

205 if auth_type == 'none': 

206 return botocore.UNSIGNED 

207 

208 if auth_type == 'bearer': 

209 return 'bearer' 

210 

211 # If the operation needs an unsigned body, we set additional context 

212 # allowing the signer to be aware of this. 

213 if context.get('unsigned_payload') or auth_type == 'v4-unsigned-body': 

214 context['payload_signing_enabled'] = False 

215 

216 if auth_type.startswith('v4'): 

217 if auth_type == 'v4-s3express': 

218 return auth_type 

219 

220 if auth_type == 'v4a': 

221 # If sigv4a is chosen, we must add additional signing config for 

222 # global signature. 

223 region = _resolve_sigv4a_region(context) 

224 signing = {'region': region, 'signing_name': signing_name} 

225 if 'signing' in context: 

226 context['signing'].update(signing) 

227 else: 

228 context['signing'] = signing 

229 signature_version = 'v4a' 

230 else: 

231 signature_version = 'v4' 

232 

233 # Signing names used by s3 and s3-control use customized signers "s3v4" 

234 # and "s3v4a". 

235 if signing_name in S3_SIGNING_NAMES: 

236 signature_version = f's3{signature_version}' 

237 

238 return signature_version 

239 

240 

241def _handle_sqs_compatible_error(parsed, context, **kwargs): 

242 """ 

243 Ensures backward compatibility for SQS errors. 

244 

245 SQS's migration from the Query protocol to JSON was done prior to SDKs allowing a 

246 service to support multiple protocols. Because of this, SQS is missing the "error" 

247 key from its modeled exceptions, which is used by most query compatible services 

248 to map error codes to the proper exception. Instead, SQS uses the error's shape name, 

249 which is preserved in the QueryErrorCode key. 

250 """ 

251 parsed_error = parsed.get("Error", {}) 

252 if not parsed_error: 

253 return 

254 

255 if query_code := parsed_error.get("QueryErrorCode"): 

256 context['error_code_override'] = query_code 

257 

258 

259def _resolve_sigv4a_region(context): 

260 region = None 

261 if 'client_config' in context: 

262 region = context['client_config'].sigv4a_signing_region_set 

263 if not region and context.get('signing', {}).get('region'): 

264 region = context['signing']['region'] 

265 return region or '*' 

266 

267 

268def decode_console_output(parsed, **kwargs): 

269 if 'Output' in parsed: 

270 try: 

271 # We're using 'replace' for errors because it is 

272 # possible that console output contains non string 

273 # chars we can't utf-8 decode. 

274 value = base64.b64decode( 

275 bytes(parsed['Output'], 'latin-1') 

276 ).decode('utf-8', 'replace') 

277 parsed['Output'] = value 

278 except (ValueError, TypeError, AttributeError): 

279 logger.debug('Error decoding base64', exc_info=True) 

280 

281 

282def generate_idempotent_uuid(params, model, **kwargs): 

283 for name in model.idempotent_members: 

284 if name not in params: 

285 params[name] = str(uuid.uuid4()) 

286 logger.debug( 

287 "injecting idempotency token (%s) into param '%s'.", 

288 params[name], 

289 name, 

290 ) 

291 

292 

293def decode_quoted_jsondoc(value): 

294 try: 

295 value = json.loads(unquote(value)) 

296 except (ValueError, TypeError): 

297 logger.debug('Error loading quoted JSON', exc_info=True) 

298 return value 

299 

300 

301def json_decode_template_body(parsed, **kwargs): 

302 if 'TemplateBody' in parsed: 

303 try: 

304 value = json.loads( 

305 parsed['TemplateBody'], object_pairs_hook=OrderedDict 

306 ) 

307 parsed['TemplateBody'] = value 

308 except (ValueError, TypeError): 

309 logger.debug('error loading JSON', exc_info=True) 

310 

311 

312def validate_bucket_name(params, **kwargs): 

313 if 'Bucket' not in params: 

314 return 

315 bucket = params['Bucket'] 

316 if not VALID_BUCKET.search(bucket) and not VALID_S3_ARN.search(bucket): 

317 error_msg = ( 

318 f'Invalid bucket name "{bucket}": Bucket name must match ' 

319 f'the regex "{VALID_BUCKET.pattern}" or be an ARN matching ' 

320 f'the regex "{VALID_S3_ARN.pattern}"' 

321 ) 

322 raise ParamValidationError(report=error_msg) 

323 

324 

325def sse_md5(params, **kwargs): 

326 """ 

327 S3 server-side encryption requires the encryption key to be sent to the 

328 server base64 encoded, as well as a base64-encoded MD5 hash of the 

329 encryption key. This handler does both if the MD5 has not been set by 

330 the caller. 

331 """ 

332 _sse_md5(params, 'SSECustomer') 

333 

334 

335def copy_source_sse_md5(params, **kwargs): 

336 """ 

337 S3 server-side encryption requires the encryption key to be sent to the 

338 server base64 encoded, as well as a base64-encoded MD5 hash of the 

339 encryption key. This handler does both if the MD5 has not been set by 

340 the caller specifically if the parameter is for the copy-source sse-c key. 

341 """ 

342 _sse_md5(params, 'CopySourceSSECustomer') 

343 

344 

345def _sse_md5(params, sse_member_prefix='SSECustomer'): 

346 if not _needs_s3_sse_customization(params, sse_member_prefix): 

347 return 

348 

349 sse_key_member = sse_member_prefix + 'Key' 

350 sse_md5_member = sse_member_prefix + 'KeyMD5' 

351 key_as_bytes = params[sse_key_member] 

352 if isinstance(key_as_bytes, str): 

353 key_as_bytes = key_as_bytes.encode('utf-8') 

354 md5_val = get_md5(key_as_bytes, usedforsecurity=False).digest() 

355 key_md5_str = base64.b64encode(md5_val).decode('utf-8') 

356 key_b64_encoded = base64.b64encode(key_as_bytes).decode('utf-8') 

357 params[sse_key_member] = key_b64_encoded 

358 params[sse_md5_member] = key_md5_str 

359 

360 

361def _needs_s3_sse_customization(params, sse_member_prefix): 

362 return ( 

363 params.get(sse_member_prefix + 'Key') is not None 

364 and sse_member_prefix + 'KeyMD5' not in params 

365 ) 

366 

367 

368def disable_signing(**kwargs): 

369 """ 

370 This handler disables request signing by setting the signer 

371 name to a special sentinel value. 

372 """ 

373 return botocore.UNSIGNED 

374 

375 

376def add_expect_header(model, params, **kwargs): 

377 if model.http.get('method', '') not in ['PUT', 'POST']: 

378 return 

379 if 'body' in params: 

380 body = params['body'] 

381 if hasattr(body, 'read'): 

382 check_body = utils.ensure_boolean( 

383 os.environ.get( 

384 'BOTO_EXPERIMENTAL__NO_EMPTY_CONTINUE', 

385 False, 

386 ) 

387 ) 

388 if check_body and utils.determine_content_length(body) == 0: 

389 return 

390 # Any file like object will use an expect 100-continue 

391 # header regardless of size. 

392 logger.debug("Adding expect 100 continue header to request.") 

393 params['headers']['Expect'] = '100-continue' 

394 

395 

396class DeprecatedServiceDocumenter: 

397 def __init__(self, replacement_service_name): 

398 self._replacement_service_name = replacement_service_name 

399 

400 def inject_deprecation_notice(self, section, event_name, **kwargs): 

401 section.style.start_important() 

402 section.write('This service client is deprecated. Please use ') 

403 section.style.ref( 

404 self._replacement_service_name, 

405 self._replacement_service_name, 

406 ) 

407 section.write(' instead.') 

408 section.style.end_important() 

409 

410 

411def document_copy_source_form(section, event_name, **kwargs): 

412 if 'request-example' in event_name: 

413 parent = section.get_section('structure-value') 

414 param_line = parent.get_section('CopySource') 

415 value_portion = param_line.get_section('member-value') 

416 value_portion.clear_text() 

417 value_portion.write( 

418 "'string' or {'Bucket': 'string', " 

419 "'Key': 'string', 'VersionId': 'string'}" 

420 ) 

421 elif 'request-params' in event_name: 

422 param_section = section.get_section('CopySource') 

423 type_section = param_section.get_section('param-type') 

424 type_section.clear_text() 

425 type_section.write(':type CopySource: str or dict') 

426 doc_section = param_section.get_section('param-documentation') 

427 doc_section.clear_text() 

428 doc_section.write( 

429 "The name of the source bucket, key name of the source object, " 

430 "and optional version ID of the source object. You can either " 

431 "provide this value as a string or a dictionary. The " 

432 "string form is {bucket}/{key} or " 

433 "{bucket}/{key}?versionId={versionId} if you want to copy a " 

434 "specific version. You can also provide this value as a " 

435 "dictionary. The dictionary format is recommended over " 

436 "the string format because it is more explicit. The dictionary " 

437 "format is: {'Bucket': 'bucket', 'Key': 'key', 'VersionId': 'id'}." 

438 " Note that the VersionId key is optional and may be omitted." 

439 " To specify an S3 access point, provide the access point" 

440 " ARN for the ``Bucket`` key in the copy source dictionary. If you" 

441 " want to provide the copy source for an S3 access point as a" 

442 " string instead of a dictionary, the ARN provided must be the" 

443 " full S3 access point object ARN" 

444 " (i.e. {accesspoint_arn}/object/{key})" 

445 ) 

446 

447 

448def handle_copy_source_param(params, **kwargs): 

449 """Convert CopySource param for CopyObject/UploadPartCopy. 

450 

451 This handler will deal with two cases: 

452 

453 * CopySource provided as a string. We'll make a best effort 

454 to URL encode the key name as required. This will require 

455 parsing the bucket and version id from the CopySource value 

456 and only encoding the key. 

457 * CopySource provided as a dict. In this case we're 

458 explicitly given the Bucket, Key, and VersionId so we're 

459 able to encode the key and ensure this value is serialized 

460 and correctly sent to S3. 

461 

462 """ 

463 source = params.get('CopySource') 

464 if source is None: 

465 # The call will eventually fail but we'll let the 

466 # param validator take care of this. It will 

467 # give a better error message. 

468 return 

469 if isinstance(source, str): 

470 params['CopySource'] = _quote_source_header(source) 

471 elif isinstance(source, dict): 

472 params['CopySource'] = _quote_source_header_from_dict(source) 

473 

474 

475def _quote_source_header_from_dict(source_dict): 

476 try: 

477 bucket = source_dict['Bucket'] 

478 key = source_dict['Key'] 

479 version_id = source_dict.get('VersionId') 

480 if VALID_S3_ARN.search(bucket): 

481 final = f'{bucket}/object/{key}' 

482 else: 

483 final = f'{bucket}/{key}' 

484 except KeyError as e: 

485 raise ParamValidationError( 

486 report=f'Missing required parameter: {str(e)}' 

487 ) 

488 final = percent_encode(final, safe=SAFE_CHARS + '/') 

489 if version_id is not None: 

490 final += f'?versionId={version_id}' 

491 return final 

492 

493 

494def _quote_source_header(value): 

495 result = VERSION_ID_SUFFIX.search(value) 

496 if result is None: 

497 return percent_encode(value, safe=SAFE_CHARS + '/') 

498 else: 

499 first, version_id = value[: result.start()], value[result.start() :] 

500 return percent_encode(first, safe=SAFE_CHARS + '/') + version_id 

501 

502 

503def _get_cross_region_presigned_url( 

504 request_signer, request_dict, model, source_region, destination_region 

505): 

506 # The better way to do this is to actually get the 

507 # endpoint_resolver and get the endpoint_url given the 

508 # source region. In this specific case, we know that 

509 # we can safely replace the dest region with the source 

510 # region because of the supported EC2 regions, but in 

511 # general this is not a safe assumption to make. 

512 # I think eventually we should try to plumb through something 

513 # that allows us to resolve endpoints from regions. 

514 request_dict_copy = copy.deepcopy(request_dict) 

515 request_dict_copy['body']['DestinationRegion'] = destination_region 

516 request_dict_copy['url'] = request_dict['url'].replace( 

517 destination_region, source_region 

518 ) 

519 request_dict_copy['method'] = 'GET' 

520 request_dict_copy['headers'] = {} 

521 return request_signer.generate_presigned_url( 

522 request_dict_copy, region_name=source_region, operation_name=model.name 

523 ) 

524 

525 

526def _get_presigned_url_source_and_destination_regions(request_signer, params): 

527 # Gets the source and destination regions to be used 

528 destination_region = request_signer._region_name 

529 source_region = params.get('SourceRegion') 

530 return source_region, destination_region 

531 

532 

533def inject_presigned_url_ec2(params, request_signer, model, **kwargs): 

534 # The customer can still provide this, so we should pass if they do. 

535 if 'PresignedUrl' in params['body']: 

536 return 

537 src, dest = _get_presigned_url_source_and_destination_regions( 

538 request_signer, params['body'] 

539 ) 

540 url = _get_cross_region_presigned_url( 

541 request_signer, params, model, src, dest 

542 ) 

543 params['body']['PresignedUrl'] = url 

544 # EC2 Requires that the destination region be sent over the wire in 

545 # addition to the source region. 

546 params['body']['DestinationRegion'] = dest 

547 

548 

549def inject_presigned_url_rds(params, request_signer, model, **kwargs): 

550 # SourceRegion is not required for RDS operations, so it's possible that 

551 # it isn't set. In that case it's probably a local copy so we don't need 

552 # to do anything else. 

553 if 'SourceRegion' not in params['body']: 

554 return 

555 

556 src, dest = _get_presigned_url_source_and_destination_regions( 

557 request_signer, params['body'] 

558 ) 

559 

560 # Since SourceRegion isn't actually modeled for RDS, it needs to be 

561 # removed from the request params before we send the actual request. 

562 del params['body']['SourceRegion'] 

563 

564 if 'PreSignedUrl' in params['body']: 

565 return 

566 

567 url = _get_cross_region_presigned_url( 

568 request_signer, params, model, src, dest 

569 ) 

570 params['body']['PreSignedUrl'] = url 

571 

572 

573def json_decode_policies(parsed, model, **kwargs): 

574 # Any time an IAM operation returns a policy document 

575 # it is a string that is json that has been urlencoded, 

576 # i.e urlencode(json.dumps(policy_document)). 

577 # To give users something more useful, we will urldecode 

578 # this value and json.loads() the result so that they have 

579 # the policy document as a dictionary. 

580 output_shape = model.output_shape 

581 if output_shape is not None: 

582 _decode_policy_types(parsed, model.output_shape) 

583 

584 

585def _decode_policy_types(parsed, shape): 

586 # IAM consistently uses the policyDocumentType shape to indicate 

587 # strings that have policy documents. 

588 shape_name = 'policyDocumentType' 

589 if shape.type_name == 'structure': 

590 for member_name, member_shape in shape.members.items(): 

591 if ( 

592 member_shape.type_name == 'string' 

593 and member_shape.name == shape_name 

594 and member_name in parsed 

595 ): 

596 parsed[member_name] = decode_quoted_jsondoc( 

597 parsed[member_name] 

598 ) 

599 elif member_name in parsed: 

600 _decode_policy_types(parsed[member_name], member_shape) 

601 if shape.type_name == 'list': 

602 shape_member = shape.member 

603 for item in parsed: 

604 _decode_policy_types(item, shape_member) 

605 

606 

607def parse_get_bucket_location(parsed, http_response, **kwargs): 

608 # s3.GetBucketLocation cannot be modeled properly. To 

609 # account for this we just manually parse the XML document. 

610 # The "parsed" passed in only has the ResponseMetadata 

611 # filled out. This handler will fill in the LocationConstraint 

612 # value. 

613 if http_response.raw is None: 

614 return 

615 response_body = http_response.content 

616 parser = ETree.XMLParser(target=ETree.TreeBuilder(), encoding='utf-8') 

617 parser.feed(response_body) 

618 root = parser.close() 

619 region = root.text 

620 parsed['LocationConstraint'] = region 

621 

622 

623def base64_encode_user_data(params, **kwargs): 

624 if 'UserData' in params: 

625 if isinstance(params['UserData'], str): 

626 # Encode it to bytes if it is text. 

627 params['UserData'] = params['UserData'].encode('utf-8') 

628 params['UserData'] = base64.b64encode(params['UserData']).decode( 

629 'utf-8' 

630 ) 

631 

632 

633def document_base64_encoding(param): 

634 description = ( 

635 '**This value will be base64 encoded automatically. Do ' 

636 'not base64 encode this value prior to performing the ' 

637 'operation.**' 

638 ) 

639 append = AppendParamDocumentation(param, description) 

640 return append.append_documentation 

641 

642 

643def validate_ascii_metadata(params, **kwargs): 

644 """Verify S3 Metadata only contains ascii characters. 

645 

646 From: http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingMetadata.html 

647 

648 "Amazon S3 stores user-defined metadata in lowercase. Each name, value pair 

649 must conform to US-ASCII when using REST and UTF-8 when using SOAP or 

650 browser-based uploads via POST." 

651 

652 """ 

653 metadata = params.get('Metadata') 

654 if not metadata or not isinstance(metadata, dict): 

655 # We have to at least type check the metadata as a dict type 

656 # because this handler is called before param validation. 

657 # We'll go ahead and return because the param validator will 

658 # give a descriptive error message for us. 

659 # We might need a post-param validation event. 

660 return 

661 for key, value in metadata.items(): 

662 try: 

663 key.encode('ascii') 

664 value.encode('ascii') 

665 except UnicodeEncodeError: 

666 error_msg = ( 

667 'Non ascii characters found in S3 metadata ' 

668 f'for key "{key}", value: "{value}". \nS3 metadata can only ' 

669 'contain ASCII characters. ' 

670 ) 

671 raise ParamValidationError(report=error_msg) 

672 

673 

674def fix_route53_ids(params, model, **kwargs): 

675 """ 

676 Check for and split apart Route53 resource IDs, setting 

677 only the last piece. This allows the output of one operation 

678 (e.g. ``'foo/1234'``) to be used as input in another 

679 operation (e.g. it expects just ``'1234'``). 

680 """ 

681 input_shape = model.input_shape 

682 if not input_shape or not hasattr(input_shape, 'members'): 

683 return 

684 

685 members = [ 

686 name 

687 for (name, shape) in input_shape.members.items() 

688 if shape.name in ['ResourceId', 'DelegationSetId', 'ChangeId'] 

689 ] 

690 

691 for name in members: 

692 if name in params: 

693 orig_value = params[name] 

694 params[name] = orig_value.split('/')[-1] 

695 logger.debug('%s %s -> %s', name, orig_value, params[name]) 

696 

697 

698def inject_account_id(params, **kwargs): 

699 if params.get('accountId') is None: 

700 # Glacier requires accountId, but allows you 

701 # to specify '-' for the current owners account. 

702 # We add this default value if the user does not 

703 # provide the accountId as a convenience. 

704 params['accountId'] = '-' 

705 

706 

707def add_glacier_version(model, params, **kwargs): 

708 request_dict = params 

709 request_dict['headers']['x-amz-glacier-version'] = model.metadata[ 

710 'apiVersion' 

711 ] 

712 

713 

714def add_accept_header(model, params, **kwargs): 

715 if params['headers'].get('Accept', None) is None: 

716 request_dict = params 

717 request_dict['headers']['Accept'] = 'application/json' 

718 

719 

720def add_glacier_checksums(params, **kwargs): 

721 """Add glacier checksums to the http request. 

722 

723 This will add two headers to the http request: 

724 

725 * x-amz-content-sha256 

726 * x-amz-sha256-tree-hash 

727 

728 These values will only be added if they are not present 

729 in the HTTP request. 

730 

731 """ 

732 request_dict = params 

733 headers = request_dict['headers'] 

734 body = request_dict['body'] 

735 if isinstance(body, bytes): 

736 # If the user provided a bytes type instead of a file 

737 # like object, we're temporarily create a BytesIO object 

738 # so we can use the util functions to calculate the 

739 # checksums which assume file like objects. Note that 

740 # we're not actually changing the body in the request_dict. 

741 body = BytesIO(body) 

742 starting_position = body.tell() 

743 if 'x-amz-content-sha256' not in headers: 

744 headers['x-amz-content-sha256'] = utils.calculate_sha256( 

745 body, as_hex=True 

746 ) 

747 body.seek(starting_position) 

748 if 'x-amz-sha256-tree-hash' not in headers: 

749 headers['x-amz-sha256-tree-hash'] = utils.calculate_tree_hash(body) 

750 body.seek(starting_position) 

751 

752 

753def document_glacier_tree_hash_checksum(): 

754 doc = ''' 

755 This is a required field. 

756 

757 Ideally you will want to compute this value with checksums from 

758 previous uploaded parts, using the algorithm described in 

759 `Glacier documentation <http://docs.aws.amazon.com/amazonglacier/latest/dev/checksum-calculations.html>`_. 

760 

761 But if you prefer, you can also use botocore.utils.calculate_tree_hash() 

762 to compute it from raw file by:: 

763 

764 checksum = calculate_tree_hash(open('your_file.txt', 'rb')) 

765 

766 ''' 

767 return AppendParamDocumentation('checksum', doc).append_documentation 

768 

769 

770def document_cloudformation_get_template_return_type( 

771 section, event_name, **kwargs 

772): 

773 if 'response-params' in event_name: 

774 template_body_section = section.get_section('TemplateBody') 

775 type_section = template_body_section.get_section('param-type') 

776 type_section.clear_text() 

777 type_section.write('(*dict*) --') 

778 elif 'response-example' in event_name: 

779 parent = section.get_section('structure-value') 

780 param_line = parent.get_section('TemplateBody') 

781 value_portion = param_line.get_section('member-value') 

782 value_portion.clear_text() 

783 value_portion.write('{}') 

784 

785 

786def switch_host_machinelearning(request, **kwargs): 

787 switch_host_with_param(request, 'PredictEndpoint') 

788 

789 

790def check_openssl_supports_tls_version_1_2(**kwargs): 

791 import ssl 

792 

793 try: 

794 openssl_version_tuple = ssl.OPENSSL_VERSION_INFO 

795 if openssl_version_tuple < (1, 0, 1): 

796 warnings.warn( 

797 f'Currently installed openssl version: {ssl.OPENSSL_VERSION} does not ' 

798 'support TLS 1.2, which is required for use of iot-data. ' 

799 'Please use python installed with openssl version 1.0.1 or ' 

800 'higher.', 

801 UnsupportedTLSVersionWarning, 

802 ) 

803 # We cannot check the openssl version on python2.6, so we should just 

804 # pass on this conveniency check. 

805 except AttributeError: 

806 pass 

807 

808 

809def change_get_to_post(request, **kwargs): 

810 # This is useful when we need to change a potentially large GET request 

811 # into a POST with x-www-form-urlencoded encoding. 

812 if request.method == 'GET' and '?' in request.url: 

813 request.headers['Content-Type'] = 'application/x-www-form-urlencoded' 

814 request.method = 'POST' 

815 request.url, request.data = request.url.split('?', 1) 

816 

817 

818def set_list_objects_encoding_type_url(params, context, **kwargs): 

819 if 'EncodingType' not in params: 

820 # We set this context so that we know it wasn't the customer that 

821 # requested the encoding. 

822 context['encoding_type_auto_set'] = True 

823 params['EncodingType'] = 'url' 

824 

825 

826def decode_list_object(parsed, context, **kwargs): 

827 # This is needed because we are passing url as the encoding type. Since the 

828 # paginator is based on the key, we need to handle it before it can be 

829 # round tripped. 

830 # 

831 # From the documentation: If you specify encoding-type request parameter, 

832 # Amazon S3 includes this element in the response, and returns encoded key 

833 # name values in the following response elements: 

834 # Delimiter, Marker, Prefix, NextMarker, Key. 

835 _decode_list_object( 

836 top_level_keys=['Delimiter', 'Marker', 'NextMarker'], 

837 nested_keys=[('Contents', 'Key'), ('CommonPrefixes', 'Prefix')], 

838 parsed=parsed, 

839 context=context, 

840 ) 

841 

842 

843def decode_list_object_v2(parsed, context, **kwargs): 

844 # From the documentation: If you specify encoding-type request parameter, 

845 # Amazon S3 includes this element in the response, and returns encoded key 

846 # name values in the following response elements: 

847 # Delimiter, Prefix, ContinuationToken, Key, and StartAfter. 

848 _decode_list_object( 

849 top_level_keys=['Delimiter', 'Prefix', 'StartAfter'], 

850 nested_keys=[('Contents', 'Key'), ('CommonPrefixes', 'Prefix')], 

851 parsed=parsed, 

852 context=context, 

853 ) 

854 

855 

856def decode_list_object_versions(parsed, context, **kwargs): 

857 # From the documentation: If you specify encoding-type request parameter, 

858 # Amazon S3 includes this element in the response, and returns encoded key 

859 # name values in the following response elements: 

860 # KeyMarker, NextKeyMarker, Prefix, Key, and Delimiter. 

861 _decode_list_object( 

862 top_level_keys=[ 

863 'KeyMarker', 

864 'NextKeyMarker', 

865 'Prefix', 

866 'Delimiter', 

867 ], 

868 nested_keys=[ 

869 ('Versions', 'Key'), 

870 ('DeleteMarkers', 'Key'), 

871 ('CommonPrefixes', 'Prefix'), 

872 ], 

873 parsed=parsed, 

874 context=context, 

875 ) 

876 

877 

878def _decode_list_object(top_level_keys, nested_keys, parsed, context): 

879 if parsed.get('EncodingType') == 'url' and context.get( 

880 'encoding_type_auto_set' 

881 ): 

882 # URL decode top-level keys in the response if present. 

883 for key in top_level_keys: 

884 if key in parsed: 

885 parsed[key] = unquote_str(parsed[key]) 

886 # URL decode nested keys from the response if present. 

887 for top_key, child_key in nested_keys: 

888 if top_key in parsed: 

889 for member in parsed[top_key]: 

890 member[child_key] = unquote_str(member[child_key]) 

891 

892 

893def convert_body_to_file_like_object(params, **kwargs): 

894 if 'Body' in params: 

895 if isinstance(params['Body'], str): 

896 params['Body'] = BytesIO(ensure_bytes(params['Body'])) 

897 elif isinstance(params['Body'], bytes): 

898 params['Body'] = BytesIO(params['Body']) 

899 

900 

901def _add_parameter_aliases(handler_list): 

902 # Mapping of original parameter to parameter alias. 

903 # The key is <service>.<operation>.parameter 

904 # The first part of the key is used for event registration. 

905 # The last part is the original parameter name and the value is the 

906 # alias to expose in documentation. 

907 aliases = { 

908 'ec2.*.Filter': 'Filters', 

909 'logs.CreateExportTask.from': 'fromTime', 

910 'cloudsearchdomain.Search.return': 'returnFields', 

911 } 

912 

913 for original, new_name in aliases.items(): 

914 event_portion, original_name = original.rsplit('.', 1) 

915 parameter_alias = ParameterAlias(original_name, new_name) 

916 

917 # Add the handlers to the list of handlers. 

918 # One handler is to handle when users provide the alias. 

919 # The other handler is to update the documentation to show only 

920 # the alias. 

921 parameter_build_event_handler_tuple = ( 

922 'before-parameter-build.' + event_portion, 

923 parameter_alias.alias_parameter_in_call, 

924 REGISTER_FIRST, 

925 ) 

926 docs_event_handler_tuple = ( 

927 'docs.*.' + event_portion + '.complete-section', 

928 parameter_alias.alias_parameter_in_documentation, 

929 )