Coverage for /pythoncovmergedfiles/medio/medio/usr/local/lib/python3.11/site-packages/jwt/utils.py: 53%

1import base64 

2import binascii 

3import re 

4from typing import Optional, Union 

5 

6try: 

7 from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurve 

8 from cryptography.hazmat.primitives.asymmetric.utils import ( 

9 decode_dss_signature, 

10 encode_dss_signature, 

11 ) 

12except ModuleNotFoundError: 

13 pass 

14 

15 

16def force_bytes(value: Union[bytes, str]) -> bytes: 

17 if isinstance(value, str): 

18 return value.encode("utf-8") 

19 elif isinstance(value, bytes): 

20 return value 

21 else: 

22 raise TypeError("Expected a string value") 

23 

24 

25def base64url_decode(input: Union[bytes, str]) -> bytes: 

26 input_bytes = force_bytes(input) 

27 

28 rem = len(input_bytes) % 4 

29 

30 if rem > 0: 

31 input_bytes += b"=" * (4 - rem) 

32 

33 return base64.urlsafe_b64decode(input_bytes) 

34 

35 

36def base64url_encode(input: bytes) -> bytes: 

37 return base64.urlsafe_b64encode(input).replace(b"=", b"") 

38 

39 

40def to_base64url_uint(val: int, *, bit_length: Optional[int] = None) -> bytes: 

41 if val < 0: 

42 raise ValueError("Must be a positive integer") 

43 

44 int_bytes = bytes_from_int(val, bit_length=bit_length) 

45 

46 if len(int_bytes) == 0: 

47 int_bytes = b"\x00" 

48 

49 return base64url_encode(int_bytes) 

50 

51 

52def from_base64url_uint(val: Union[bytes, str]) -> int: 

53 data = base64url_decode(force_bytes(val)) 

54 return int.from_bytes(data, byteorder="big") 

55 

56 

57def number_to_bytes(num: int, num_bytes: int) -> bytes: 

58 padded_hex = "%0*x" % (2 * num_bytes, num) 

59 return binascii.a2b_hex(padded_hex.encode("ascii")) 

60 

61 

62def bytes_to_number(string: bytes) -> int: 

63 return int(binascii.b2a_hex(string), 16) 

64 

65 

66def bytes_from_int(val: int, *, bit_length: Optional[int] = None) -> bytes: 

67 if bit_length is None: 

68 bit_length = val.bit_length() 

69 byte_length = (bit_length + 7) // 8 

70 

71 return val.to_bytes(byte_length, "big", signed=False) 

72 

73 

74def der_to_raw_signature(der_sig: bytes, curve: "EllipticCurve") -> bytes: 

75 num_bits = curve.key_size 

76 num_bytes = (num_bits + 7) // 8 

77 

78 r, s = decode_dss_signature(der_sig) 

79 

80 return number_to_bytes(r, num_bytes) + number_to_bytes(s, num_bytes) 

81 

82 

83def raw_to_der_signature(raw_sig: bytes, curve: "EllipticCurve") -> bytes: 

84 num_bits = curve.key_size 

85 num_bytes = (num_bits + 7) // 8 

86 

87 if len(raw_sig) != 2 * num_bytes: 

88 raise ValueError("Invalid signature") 

89 

90 r = bytes_to_number(raw_sig[:num_bytes]) 

91 s = bytes_to_number(raw_sig[num_bytes:]) 

92 

93 return bytes(encode_dss_signature(r, s)) 

94 

95 

96# Based on https://github.com/hynek/pem/blob/7ad94db26b0bc21d10953f5dbad3acfdfacf57aa/src/pem/_core.py#L224-L252 

97_PEMS = { 

98 b"CERTIFICATE", 

99 b"TRUSTED CERTIFICATE", 

100 b"PRIVATE KEY", 

101 b"PUBLIC KEY", 

102 b"ENCRYPTED PRIVATE KEY", 

103 b"OPENSSH PRIVATE KEY", 

104 b"DSA PRIVATE KEY", 

105 b"RSA PRIVATE KEY", 

106 b"RSA PUBLIC KEY", 

107 b"EC PRIVATE KEY", 

108 b"DH PARAMETERS", 

109 b"NEW CERTIFICATE REQUEST", 

110 b"CERTIFICATE REQUEST", 

111 b"SSH2 PUBLIC KEY", 

112 b"SSH2 ENCRYPTED PRIVATE KEY", 

113 b"X509 CRL", 

114} 

115 

116# Accept PEM formatting variants that the cryptography loader accepts, while 

117# retaining the explicit asymmetric-key marker check. 

118_PEM_MARKER_RE = re.compile( 

119 b"(?=(----[- ](BEGIN|END) (" + b"|".join(_PEMS) + b")[- ]----))" 

120) 

121 

122 

123def is_pem_format(key: bytes) -> bool: 

124 begin_markers: dict[bytes, int] = {} 

125 for marker in _PEM_MARKER_RE.finditer(key): 

126 marker_type, label = marker.group(2), marker.group(3) 

127 if marker_type == b"BEGIN": 

128 begin_markers[label] = marker.start(1) + len(marker.group(1)) 

129 elif label in begin_markers and begin_markers[label] < marker.start(1): 

130 return True 

131 return False 

132 

133 

134# Based on https://github.com/pyca/cryptography/blob/bcb70852d577b3f490f015378c75cba74986297b/src/cryptography/hazmat/primitives/serialization/ssh.py#L40-L46 

135_SSH_KEY_FORMATS = ( 

136 b"ssh-ed25519", 

137 b"ssh-rsa", 

138 b"ssh-dss", 

139 b"ecdsa-sha2-nistp256", 

140 b"ecdsa-sha2-nistp384", 

141 b"ecdsa-sha2-nistp521", 

142) 

143 

144 

145def is_ssh_key(key: bytes) -> bool: 

146 return key.startswith(_SSH_KEY_FORMATS)