def _check_ssl_cert(self): """Preflight the SSL certificate presented by the backend. This isn't 100% bulletproof, in that we're not actually validating the transport used to communicate with Stripe, merely that the first attempt to does not use a revoked certificate. Unfortunately the interface to OpenSSL doesn't make it easy to check the certificate before sending potentially sensitive data on the wire. This approach raises the bar for an attacker significantly.""" from stripe import verify_ssl_certs if verify_ssl_certs and not self._CERTIFICATE_VERIFIED: uri = urllib.parse.urlparse(stripe.api_base) try: certificate = ssl.get_server_certificate( (uri.hostname, uri.port or 443)) der_cert = ssl.PEM_cert_to_DER_cert(certificate) except socket.error as e: raise error.APIConnectionError(e) except TypeError: # The Google App Engine development server blocks the C socket # module which causes a type error when using the SSL library if util.is_appengine_dev(): self._CERTIFICATE_VERIFIED = True warnings.warn( 'We were unable to verify Stripe\'s SSL certificate ' 'due to a bug in the Google App Engine development ' 'server. Please alert us immediately at ' '[email protected] if this message appears in your ' 'production logs.') return else: raise self._CERTIFICATE_VERIFIED = certificate_blacklist.verify( uri.hostname, der_cert)
def _deprecated_request(self, impl, method, url, headers, params): warnings.warn( 'The *_request functions of APIRequestor are deprecated and ' 'will be removed in version 2.0. Please use the client classes ' ' in `stripe.http_client` instead', DeprecationWarning, stacklevel=2) method = method.lower() if method == 'get' or method == 'delete': if params: url = self.build_url(url, params) post_data = None elif method == 'post': post_data = self.encode(params) else: raise error.APIConnectionError( 'Unrecognized HTTP method %r. This may indicate a bug in the ' 'Stripe bindings. Please contact [email protected] for ' 'assistance.' % (method,)) client = impl(verify_ssl_certs=self._client._verify_ssl_certs) return client.request(method, url, headers, post_data)
def request_raw(self, method, url, params=None): """ Mechanism for issuing an API call """ from stripe import api_version if self.api_key: my_api_key = self.api_key else: from stripe import api_key my_api_key = api_key if my_api_key is None: raise error.AuthenticationError( 'No API key provided. (HINT: set your API key using ' '"stripe.api_key = <API-KEY>"). You can generate API keys ' 'from the Stripe web interface. See https://stripe.com/api ' 'for details, or email [email protected] if you have any ' 'questions.') abs_url = '%s%s' % (stripe.api_base, url) encoded_params = urllib.parse.urlencode(list(_api_encode(params or {}))) if method == 'get' or method == 'delete': if params: abs_url = _build_api_url(abs_url, encoded_params) post_data = None elif method == 'post': post_data = encoded_params else: raise error.APIConnectionError( 'Unrecognized HTTP method %r. This may indicate a bug in the ' 'Stripe bindings. Please contact [email protected] for ' 'assistance.' % (method,)) ua = { 'bindings_version': version.VERSION, 'lang': 'python', 'publisher': 'stripe', 'httplib': self._client.name, } for attr, func in [['lang_version', platform.python_version], ['platform', platform.platform], ['uname', lambda: ' '.join(platform.uname())]]: try: val = func() except Exception as e: val = "!! %s" % (e,) ua[attr] = val headers = { 'X-Stripe-Client-User-Agent': util.json.dumps(ua), 'User-Agent': 'Stripe/v1 PythonBindings/%s' % (version.VERSION,), 'Authorization': 'Bearer %s' % (my_api_key,) } if api_version is not None: headers['Stripe-Version'] = api_version rbody, rcode = self._client.request( method, abs_url, headers, post_data) util.logger.info( 'API request to %s returned (response code, response body) of ' '(%d, %r)', abs_url, rcode, rbody) return rbody, rcode, my_api_key
def request_raw(self, method, url, params=None, supplied_headers=None): """ Mechanism for issuing an API call """ if self.api_key: my_api_key = self.api_key else: from stripe import api_key my_api_key = api_key if my_api_key is None: raise error.AuthenticationError( 'No API key provided. (HINT: set your API key using ' '"stripe.api_key = <API-KEY>"). You can generate API keys ' 'from the Stripe web interface. See https://stripe.com/api ' 'for details, or email [email protected] if you have any ' 'questions.') abs_url = '%s%s' % (self.api_base, url) encoded_params = urllib.parse.urlencode(list(_api_encode(params or {}))) if method == 'get' or method == 'delete': if params: abs_url = _build_api_url(abs_url, encoded_params) post_data = None elif method == 'post': if supplied_headers is not None and \ supplied_headers.get("Content-Type") == \ "multipart/form-data": generator = MultipartDataGenerator() generator.add_params(params or {}) post_data = generator.get_post_data() supplied_headers["Content-Type"] = \ "multipart/form-data; boundary=%s" % (generator.boundary,) else: post_data = encoded_params else: raise error.APIConnectionError( 'Unrecognized HTTP method %r. This may indicate a bug in the ' 'Stripe bindings. Please contact [email protected] for ' 'assistance.' % (method, )) headers = self.request_headers(my_api_key, method) if supplied_headers is not None: for key, value in list(supplied_headers.items()): headers[key] = value util.log_info('Request to Stripe api', method=method, path=abs_url) util.log_debug('Post details', post_data=post_data, api_version=self.api_version) rbody, rcode, rheaders = self._client.request(method, abs_url, headers, post_data) util.log_info('Stripe API response', path=abs_url, response_code=rcode) util.log_debug('API response body', body=rbody) if 'Request-Id' in rheaders: util.log_debug('Dashboard link for request', link=util.dashboard_link(rheaders['Request-Id'])) return rbody, rcode, rheaders, my_api_key
def request_raw(self, method, url, params=None, supplied_headers=None): """ Mechanism for issuing an API call """ from stripe import api_version if self.api_key: my_api_key = self.api_key else: from stripe import api_key my_api_key = api_key if my_api_key is None: raise error.AuthenticationError( 'No API key provided. (HINT: set your API key using ' '"stripe.api_key = <API-KEY>"). You can generate API keys ' 'from the Stripe web interface. See https://stripe.com/api ' 'for details, or email [email protected] if you have any ' 'questions.') abs_url = '%s%s' % (self.api_base, url) encoded_params = urllib.parse.urlencode(list(_api_encode(params or {}))) if method == 'get' or method == 'delete': if params: abs_url = _build_api_url(abs_url, encoded_params) post_data = None elif method == 'post': if supplied_headers is not None and \ supplied_headers.get("Content-Type") == \ "multipart/form-data": generator = MultipartDataGenerator() generator.add_params(params or {}) post_data = generator.get_post_data() supplied_headers["Content-Type"] = \ "multipart/form-data; boundary=%s" % (generator.boundary,) else: post_data = encoded_params else: raise error.APIConnectionError( 'Unrecognized HTTP method %r. This may indicate a bug in the ' 'Stripe bindings. Please contact [email protected] for ' 'assistance.' % (method,)) ua = { 'bindings_version': version.VERSION, 'lang': 'python', 'publisher': 'stripe', 'httplib': self._client.name, } for attr, func in [['lang_version', platform.python_version], ['platform', platform.platform], ['uname', lambda: ' '.join(platform.uname())]]: try: val = func() except Exception as e: val = "!! %s" % (e,) ua[attr] = val headers = { 'X-Stripe-Client-User-Agent': util.json.dumps(ua), 'User-Agent': 'Stripe/v1 PythonBindings/%s' % (version.VERSION,), 'Authorization': 'Bearer %s' % (my_api_key,) } if self.stripe_account: headers['Stripe-Account'] = self.stripe_account if method == 'post': headers['Content-Type'] = 'application/x-www-form-urlencoded' if api_version is not None: headers['Stripe-Version'] = api_version if supplied_headers is not None: for key, value in list(supplied_headers.items()): headers[key] = value util.log_info('Request to Stripe api', method=method, path=abs_url) util.log_debug( 'Post details', post_data=post_data, api_version=api_version) rbody, rcode, rheaders = self._client.request( method, abs_url, headers, post_data) util.log_info( 'Stripe API response', path=abs_url, response_code=rcode) util.log_debug('API response body', body=rbody) if 'Request-Id' in rheaders: util.log_debug('Dashboard link for request', link=util.dashboard_link(rheaders['Request-Id'])) return rbody, rcode, rheaders, my_api_key