Mercurial > p > roundup > code
view roundup/anypy/random_.py @ 7155:89a59e46b3af
improve REST interface security
When using REST, we reflect the client's origin. If the wildcard '*'
is used in allowed_api_origins all origins are allowed. When this is
done, it also added an 'Access-Control-Allow-Credentials: true'
header.
This Credentials header should not be added if the site is matched
only by '*'. This header should be provided only for explicit origins
(e.g. https://example.org) not for the wildcard.
This is now fixed for CORS preflight OPTIONS request as well as normal
GET, PUT, DELETE, POST, PATCH and OPTIONS requests.
A missing Access-Control-Allow-Credentials will prevent the tracker
from being accessed using credentials. This prevents an unauthorized
third party web site from using a user's credentials to access
information in the tracker that is not publicly available.
Added test for this specific case.
In addition, allowed_api_origins can include explicit origins in
addition to '*'. '*' must be first in the list.
Also adapted numerous tests to work with these changes.
Doc updates.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Thu, 23 Feb 2023 12:01:33 -0500 |
| parents | adf54478cdaf |
| children | 07ce4e4110f5 |
line wrap: on
line source
try: from secrets import choice, randbelow, token_bytes def seed(v=None): pass is_weak = False except ImportError: import os as _os import random as _random # prefer to use SystemRandom if it is available if hasattr(_random, 'SystemRandom'): def seed(v=None): pass _r = _random.SystemRandom() is_weak = False else: # don't completely throw away the existing state, but add some # more random state to the existing state def seed(v=None): import os, time _r.seed((_r.getstate(), v, hasattr(os, 'getpid') and os.getpid(), time.time())) # create our own instance so we don't mess with the global # random number generator _r = _random.Random() seed() is_weak = True choice = _r.choice def randbelow(i): return _r.randint(0, i - 1) if hasattr(_os, 'urandom'): def token_bytes(l): return _os.urandom(l) else: def token_bytes(l): _bchr = chr if str == bytes else lambda x: bytes((x,)) return b''.join([_bchr(_r.getrandbits(8)) for i in range(l)])
