Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified	Actions
📁 ..	-	2025-05-25 12:27
📄 doc.go // Copyright 2017 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. // Package internal contains support packages for oauth2 package. package internal	243 B	2025-05-25 12:27
📄 oauth2.go // Copyright 2014 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package internal import ( "crypto/rsa" "crypto/x509" "encoding/pem" "errors" "fmt" ) // ParseKey converts the binary contents of a private key file // to an rsa.PrivateKey. It detects whether the private key is in a // PEM container or not. If so, it extracts the private key // from PEM container before conversion. It only supports PEM // containers with no passphrase. func ParseKey(key []byte) (rsa.PrivateKey, error) { block, _ := pem.Decode(key) if block != nil { key = block.Bytes } parsedKey, err := x509.ParsePKCS8PrivateKey(key) if err != nil { parsedKey, err = x509.ParsePKCS1PrivateKey(key) if err != nil { return nil, fmt.Errorf("private key should be a PEM or plain PKCS1 or PKCS8; parse error: %v", err) } } parsed, ok := parsedKey.(*rsa.PrivateKey) if !ok { return nil, errors.New("private key is invalid") } return parsed, nil }	1.01 KB	2025-05-25 12:27
📄 token.go // Copyright 2014 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package internal import ( "context" "encoding/json" "errors" "fmt" "io" "io/ioutil" "math" "mime" "net/http" "net/url" "strconv" "strings" "sync" "sync/atomic" "time" ) // Token represents the credentials used to authorize // the requests to access protected resources on the OAuth 2.0 // provider's backend. // // This type is a mirror of oauth2.Token and exists to break // an otherwise-circular dependency. Other internal packages // should convert this Token into an oauth2.Token before use. type Token struct { // AccessToken is the token that authorizes and authenticates // the requests. AccessToken string // TokenType is the type of token. // The Type method returns either this or "Bearer", the default. TokenType string // RefreshToken is a token that's used by the application // (as opposed to the user) to refresh the access token // if it expires. RefreshToken string // Expiry is the optional expiration time of the access token. // // If zero, TokenSource implementations will reuse the same // token forever and RefreshToken or equivalent // mechanisms for that TokenSource will not be used. Expiry time.Time // Raw optionally contains extra metadata from the server // when updating a token. Raw interface{} } // tokenJSON is the struct representing the HTTP response from OAuth2 // providers returning a token or error in JSON form. // https://datatracker.ietf.org/doc/html/rfc6749#section-5.1 type tokenJSON struct { AccessToken string `json:"access_token"` TokenType string `json:"token_type"` RefreshToken string `json:"refresh_token"` ExpiresIn expirationTime `json:"expires_in"` // at least PayPal returns string, while most return number // error fields // https://datatracker.ietf.org/doc/html/rfc6749#section-5.2 ErrorCode string `json:"error"` ErrorDescription string `json:"error_description"` ErrorURI string `json:"error_uri"` } func (e tokenJSON) expiry() (t time.Time) { if v := e.ExpiresIn; v != 0 { return time.Now().Add(time.Duration(v) time.Second) } return } type expirationTime int32 func (e expirationTime) UnmarshalJSON(b []byte) error { if len(b) == 0 \|\| string(b) == "null" { return nil } var n json.Number err := json.Unmarshal(b, &n) if err != nil { return err } i, err := n.Int64() if err != nil { return err } if i > math.MaxInt32 { i = math.MaxInt32 } e = expirationTime(i) return nil } // RegisterBrokenAuthHeaderProvider previously did something. It is now a no-op. // // Deprecated: this function no longer does anything. Caller code that // wants to avoid potential extra HTTP requests made during // auto-probing of the provider's auth style should set // Endpoint.AuthStyle. func RegisterBrokenAuthHeaderProvider(tokenURL string) {} // AuthStyle is a copy of the golang.org/x/oauth2 package's AuthStyle type. type AuthStyle int const ( AuthStyleUnknown AuthStyle = 0 AuthStyleInParams AuthStyle = 1 AuthStyleInHeader AuthStyle = 2 ) // LazyAuthStyleCache is a backwards compatibility compromise to let Configs // have a lazily-initialized AuthStyleCache. // // The two users of this, oauth2.Config and oauth2/clientcredentials.Config, // both would ideally just embed an unexported AuthStyleCache but because both // were historically allowed to be copied by value we can't retroactively add an // uncopyable Mutex to them. // // We could use an atomic.Pointer, but that was added recently enough (in Go // 1.18) that we'd break Go 1.17 users where the tests as of 2023-08-03 // still pass. By using an atomic.Value, it supports both Go 1.17 and // copying by value, even if that's not ideal. type LazyAuthStyleCache struct { v atomic.Value // of AuthStyleCache } func (lc LazyAuthStyleCache) Get() AuthStyleCache { if c, ok := lc.v.Load().(AuthStyleCache); ok { return c } c := new(AuthStyleCache) if !lc.v.CompareAndSwap(nil, c) { c = lc.v.Load().(AuthStyleCache) } return c } // AuthStyleCache is the set of tokenURLs we've successfully used via // RetrieveToken and which style auth we ended up using. // It's called a cache, but it doesn't (yet?) shrink. It's expected that // the set of OAuth2 servers a program contacts over time is fixed and // small. type AuthStyleCache struct { mu sync.Mutex m map[string]AuthStyle // keyed by tokenURL } // lookupAuthStyle reports which auth style we last used with tokenURL // when calling RetrieveToken and whether we have ever done so. func (c AuthStyleCache) lookupAuthStyle(tokenURL string) (style AuthStyle, ok bool) { c.mu.Lock() defer c.mu.Unlock() style, ok = c.m[tokenURL] return } // setAuthStyle adds an entry to authStyleCache, documented above. func (c AuthStyleCache) setAuthStyle(tokenURL string, v AuthStyle) { c.mu.Lock() defer c.mu.Unlock() if c.m == nil { c.m = make(map[string]AuthStyle) } c.m[tokenURL] = v } // newTokenRequest returns a new http.Request to retrieve a new token // from tokenURL using the provided clientID, clientSecret, and POST // body parameters. // // inParams is whether the clientID & clientSecret should be encoded // as the POST body. An 'inParams' value of true means to send it in // the POST body (along with any values in v); false means to send it // in the Authorization header. func newTokenRequest(tokenURL, clientID, clientSecret string, v url.Values, authStyle AuthStyle) (http.Request, error) { if authStyle == AuthStyleInParams { v = cloneURLValues(v) if clientID != "" { v.Set("client_id", clientID) } if clientSecret != "" { v.Set("client_secret", clientSecret) } } req, err := http.NewRequest("POST", tokenURL, strings.NewReader(v.Encode())) if err != nil { return nil, err } req.Header.Set("Content-Type", "application/x-www-form-urlencoded") if authStyle == AuthStyleInHeader { req.SetBasicAuth(url.QueryEscape(clientID), url.QueryEscape(clientSecret)) } return req, nil } func cloneURLValues(v url.Values) url.Values { v2 := make(url.Values, len(v)) for k, vv := range v { v2[k] = append([]string(nil), vv...) } return v2 } func RetrieveToken(ctx context.Context, clientID, clientSecret, tokenURL string, v url.Values, authStyle AuthStyle, styleCache AuthStyleCache) (Token, error) { needsAuthStyleProbe := authStyle == 0 if needsAuthStyleProbe { if style, ok := styleCache.lookupAuthStyle(tokenURL); ok { authStyle = style needsAuthStyleProbe = false } else { authStyle = AuthStyleInHeader // the first way we'll try } } req, err := newTokenRequest(tokenURL, clientID, clientSecret, v, authStyle) if err != nil { return nil, err } token, err := doTokenRoundTrip(ctx, req) if err != nil && needsAuthStyleProbe { // If we get an error, assume the server wants the // clientID & clientSecret in a different form. // See https://code.google.com/p/goauth2/issues/detail?id=31 for background. // In summary: // - Reddit only accepts client secret in the Authorization header // - Dropbox accepts either it in URL param or Auth header, but not both. // - Google only accepts URL param (not spec compliant?), not Auth header // - Stripe only accepts client secret in Auth header with Bearer method, not Basic // // We used to maintain a big table in this code of all the sites and which way // they went, but maintaining it didn't scale & got annoying. // So just try both ways. authStyle = AuthStyleInParams // the second way we'll try req, _ = newTokenRequest(tokenURL, clientID, clientSecret, v, authStyle) token, err = doTokenRoundTrip(ctx, req) } if needsAuthStyleProbe && err == nil { styleCache.setAuthStyle(tokenURL, authStyle) } // Don't overwrite `RefreshToken` with an empty value // if this was a token refreshing request. if token != nil && token.RefreshToken == "" { token.RefreshToken = v.Get("refresh_token") } return token, err } func doTokenRoundTrip(ctx context.Context, req http.Request) (Token, error) { r, err := ContextClient(ctx).Do(req.WithContext(ctx)) if err != nil { return nil, err } body, err := ioutil.ReadAll(io.LimitReader(r.Body, 1<<20)) r.Body.Close() if err != nil { return nil, fmt.Errorf("oauth2: cannot fetch token: %v", err) } failureStatus := r.StatusCode < 200 \|\| r.StatusCode > 299 retrieveError := &RetrieveError{ Response: r, Body: body, // attempt to populate error detail below } var token Token content, _, _ := mime.ParseMediaType(r.Header.Get("Content-Type")) switch content { case "application/x-www-form-urlencoded", "text/plain": // some endpoints return a query string vals, err := url.ParseQuery(string(body)) if err != nil { if failureStatus { return nil, retrieveError } return nil, fmt.Errorf("oauth2: cannot parse response: %v", err) } retrieveError.ErrorCode = vals.Get("error") retrieveError.ErrorDescription = vals.Get("error_description") retrieveError.ErrorURI = vals.Get("error_uri") token = &Token{ AccessToken: vals.Get("access_token"), TokenType: vals.Get("token_type"), RefreshToken: vals.Get("refresh_token"), Raw: vals, } e := vals.Get("expires_in") expires, _ := strconv.Atoi(e) if expires != 0 { token.Expiry = time.Now().Add(time.Duration(expires) * time.Second) } default: var tj tokenJSON if err = json.Unmarshal(body, &tj); err != nil { if failureStatus { return nil, retrieveError } return nil, fmt.Errorf("oauth2: cannot parse json: %v", err) } retrieveError.ErrorCode = tj.ErrorCode retrieveError.ErrorDescription = tj.ErrorDescription retrieveError.ErrorURI = tj.ErrorURI token = &Token{ AccessToken: tj.AccessToken, TokenType: tj.TokenType, RefreshToken: tj.RefreshToken, Expiry: tj.expiry(), Raw: make(map[string]interface{}), } json.Unmarshal(body, &token.Raw) // no error checks for optional fields } // according to spec, servers should respond status 400 in error case // https://www.rfc-editor.org/rfc/rfc6749#section-5.2 // but some unorthodox servers respond 200 in error case if failureStatus \|\| retrieveError.ErrorCode != "" { return nil, retrieveError } if token.AccessToken == "" { return nil, errors.New("oauth2: server response missing access_token") } return token, nil } // mirrors oauth2.RetrieveError type RetrieveError struct { Response http.Response Body []byte ErrorCode string ErrorDescription string ErrorURI string } func (r RetrieveError) Error() string { if r.ErrorCode != "" { s := fmt.Sprintf("oauth2: %q", r.ErrorCode) if r.ErrorDescription != "" { s += fmt.Sprintf(" %q", r.ErrorDescription) } if r.ErrorURI != "" { s += fmt.Sprintf(" %q", r.ErrorURI) } return s } return fmt.Sprintf("oauth2: cannot fetch token: %v\nResponse: %s", r.Response.Status, r.Body) }	10.76 KB	2025-05-25 12:27
📄 token_test.go // Copyright 2014 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package internal import ( "context" "fmt" "io" "math" "net/http" "net/http/httptest" "net/url" "testing" ) func TestRetrieveToken_InParams(t testing.T) { styleCache := new(AuthStyleCache) const clientID = "client-id" ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { if got, want := r.FormValue("client_id"), clientID; got != want { t.Errorf("client_id = %q; want %q", got, want) } if got, want := r.FormValue("client_secret"), ""; got != want { t.Errorf("client_secret = %q; want empty", got) } w.Header().Set("Content-Type", "application/json") io.WriteString(w, `{"access_token": "ACCESS_TOKEN", "token_type": "bearer"}`) })) defer ts.Close() _, err := RetrieveToken(context.Background(), clientID, "", ts.URL, url.Values{}, AuthStyleInParams, styleCache) if err != nil { t.Errorf("RetrieveToken = %v; want no error", err) } } func TestRetrieveTokenWithContexts(t testing.T) { styleCache := new(AuthStyleCache) const clientID = "client-id" ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { w.Header().Set("Content-Type", "application/json") io.WriteString(w, `{"access_token": "ACCESS_TOKEN", "token_type": "bearer"}`) })) defer ts.Close() _, err := RetrieveToken(context.Background(), clientID, "", ts.URL, url.Values{}, AuthStyleUnknown, styleCache) if err != nil { t.Errorf("RetrieveToken (with background context) = %v; want no error", err) } retrieved := make(chan struct{}) cancellingts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { <-retrieved })) defer cancellingts.Close() ctx, cancel := context.WithCancel(context.Background()) cancel() _, err = RetrieveToken(ctx, clientID, "", cancellingts.URL, url.Values{}, AuthStyleUnknown, styleCache) close(retrieved) if err == nil { t.Errorf("RetrieveToken (with cancelled context) = nil; want error") } } func TestExpiresInUpperBound(t testing.T) { var e expirationTime if err := e.UnmarshalJSON([]byte(fmt.Sprint(int64(math.MaxInt32) + 1))); err != nil { t.Fatal(err) } const want = math.MaxInt32 if e != want { t.Errorf("expiration time = %v; want %v", e, want) } }	2.33 KB	2025-05-25 12:27
📄 transport.go // Copyright 2014 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package internal import ( "context" "net/http" ) // HTTPClient is the context key to use with golang.org/x/net/context's // WithValue function to associate an http.Client value with a context. var HTTPClient ContextKey // ContextKey is just an empty struct. It exists so HTTPClient can be // an immutable public variable with a unique type. It's immutable // because nobody else can create a ContextKey, being unexported. type ContextKey struct{} func ContextClient(ctx context.Context) http.Client { if ctx != nil { if hc, ok := ctx.Value(HTTPClient).(*http.Client); ok { return hc } } return http.DefaultClient }	793 B	2025-05-25 12:27

Terminal