
    ih                     n    S r SSKrSSKrSSKJr  SSKJr  SSKJr  SSKJr  SS	K	J
r
  S
r " S S\
5      rg)a  
A provided CSRF implementation which puts CSRF data in a session.

This can be used fairly comfortably with many `request.session` type
objects, including the Werkzeug/Flask session store, Django sessions, and
potentially other similar objects which use a dict-like API for storing
session keys.

The basic concept is a randomly generated value is stored in the user's
session, and an hmac-sha1 of it (along with an optional expiration time,
for extra security) is used as the value of the csrf_token. If this token
validates with the hmac of the random value + expiration time, and the
expiration time is not passed, the CSRF validation will pass.
    N)datetime)	timedelta)sha1   )ValidationError   )CSRF)SessionCSRFc                   ^   ^  \ rS rSrSrU 4S jrS rS rS r\	S 5       r
\	S 5       rS	rU =r$ )
r
      z%Y%m%d%H%M%Sc                 D   > UR                   U l        [        TU ]  U5      $ )N)meta	form_metasuper
setup_form)selfform	__class__s     W/home/kali/devsecops-assessor/venv/lib/python3.13/site-packages/wtforms/csrf/session.pyr   SessionCSRF.setup_form   s    w!$''    c                 V   U R                   nUR                  c  [        S5      eUR                  c  [	        S5      eU R
                  nSU;  a0  [        [        R                  " S5      5      R                  5       US'   U R                  (       aL  U R                  5       U R                  -   R                  U R                  5      nSR                  US   U5      nOSnUS   n[        R                   " UR                  UR#                  S5      [        S9nU S	UR                  5        3$ )
Nz<must set `csrf_secret` on class Meta for SessionCSRF to workz2Must provide a session-like object as csrf contextcsrf@   z{}{} utf8	digestmod##)r   csrf_secret	Exceptioncsrf_context	TypeErrorsessionr   osurandom	hexdigest
time_limitnowstrftimeTIME_FORMATformathmacnewencode)r   csrf_token_fieldr   r$   expires
csrf_build	hmac_csrfs          r   generate_csrf_tokenSessionCSRF.generate_csrf_token#   s   ~~#N  $PQQ,, "2::b>2<<>GFO??xxzDOO3==d>N>NOGwv@JG JHHj//74
	 "Y002344r   c                 h   U R                   nUR                  (       a  SUR                  ;  a  [        UR                  S5      5      eUR                  R	                  SS5      u  pEU R
                  S   U-   R                  S5      n[        R                  " UR                  U[        S9nUR                  5       U:w  a  [        UR                  S5      5      eU R                  (       aI  U R                  5       R                  U R                  5      nX:  a  [        UR                  S5      5      eg g )	Nr   zCSRF token missing.r   r   r   r   zCSRF failed.zCSRF token expired.)r   datar   gettextsplitr$   r/   r-   r.   r    r   r'   r(   r)   r*   r+   )	r   r   fieldr   r1   r3   	check_valhmac_comparenow_formatteds	            r   validate_csrf_tokenSessionCSRF.validate_csrf_token=   s    ~~zzT3!%--0E"FGG"ZZ--dA6\\&)G3;;FC	xx 0 0)tL!!#y0!%--"?@@?? HHJ//0@0@AM&%emm4I&JKK ' r   c                 ,    [         R                  " 5       $ )z@
Get the current time. Used for test mocking/overriding mainly.
)r   r)   r   s    r   r)   SessionCSRF.nowO   s     ||~r   c                 >    [        U R                  S[        SS95      $ )Ncsrf_time_limit   )minutes)getattrr   r   rA   s    r   r(   SessionCSRF.time_limitU   s    t~~'8)B:OPPr   c                 l    [        U R                  R                  SU R                  R                  5      $ )Nr$   )rG   r   r"   rA   s    r   r$   SessionCSRF.sessionY   s*    NN''DNN4O4O
 	
r   )r   )__name__
__module____qualname____firstlineno__r+   r   r4   r>   r)   propertyr(   r$   __static_attributes____classcell__)r   s   @r   r
   r
      sG     K(54L$ Q Q 
 
r   r
   )__doc__r-   r%   r   r   hashlibr   
validatorsr   corer	   __all__r
    r   r   <module>rX      s4     	    ( 
A
$ A
r   