Newer
Older
# Copyright(C) 2016 Edouard Lambert
#
# This woob module is free software: you can redistribute it and/or modify
# it under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This woob module is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Lesser General Public License for more details.
# You should have received a copy of the GNU Lesser General Public License
# along with this woob module. If not, see <http://www.gnu.org/licenses/>.
from base64 import b64decode, b64encode
from random import choices
from string import digits
try:
from Cryptodome.Cipher import PKCS1_v1_5
from Cryptodome.PublicKey import RSA
except ImportError:
from Crypto.Cipher import PKCS1_v1_5
from Crypto.PublicKey import RSA
from woob.browser import URL
from woob.browser.exceptions import ClientError
from woob.exceptions import (
BrowserIncorrectPassword, BrowserPasswordExpired,
NeedInteractiveFor2FA, OTPSentType, SentOTPQuestion,
)
from woob.tools.url import get_url_param
from woob_modules.s2e.browser import S2eBrowser
from .pages import (
AuthenticationPage, FinalizeAuthenticationPage, LoginPage,
)
class ErehsbcBrowser(S2eBrowser):
BASEURL = 'https://epargnant.ere.hsbc.fr'
AUTH_BASEURL = 'https://iam.epargne-salariale-retraite.hsbc.fr'
SLUG = 'hsbc'
LANG = 'fr' # ['fr', 'en']
login_page = URL(r'/portal/salarie-(?P<slug>\w+)/connect', LoginPage)
r'/connect/json/authenticate\?realm=/hsbc_ws',
AuthenticationPage,
base='AUTH_BASEURL'
)
finalize_authentication_page = URL(
r'/connect/json/realms/root/realms/hsbc_ws/users\?_action=idFromSession',
FinalizeAuthenticationPage,
base='AUTH_BASEURL'
)
def __init__(self, config, *args, **kwargs):
self.config = config
self.otp_json = None
self.redirect_uri = None
self.__states__ += ('otp_json', 'redirect_uri')
kwargs['username'] = self.config['login'].get()
kwargs['password'] = self.config['password'].get()
super(ErehsbcBrowser, self).__init__(config, *args, **kwargs)
# Parent is popping the URL from the state but we need it
def dump_state(self):
state = super(ErehsbcBrowser, self).dump_state()
if hasattr(self, 'page') and self.page:
state['url'] = self.page.url
return state
# Override parent or we get a LoggedOut exception during next connection
def deinit(self):
self.session.close()
def do_login(self):
# There are two possible cases:
# - we are not a trusted device registered and OTP will be sent on the user email
# - we are a trusted device and we can connect directly without OTP
if '/connect/console' not in data.get('successUrl', ''):
data = self.page.get_pre_otp_json()
if self.page.is_pre_otp_here():
if not self.is_interactive:
raise NeedInteractiveFor2FA()
self.authentication_page.go(json=data) # OTP sent to user here
self.otp_json = self.page.get_otp_json()
if self.otp_json['callbacks'][1]['output'][0]['value'] == 'Enter the received code':
raise SentOTPQuestion(
'otp',
medium_type=OTPSentType.EMAIL,
medium_label=self.page.get_email(),
message='Entrez le code temporaire'
)
raise AssertionError('Unhandled authentication flow')
self.accounts.go(slug=self.SLUG, lang=self.LANG)
def build_authentication_params(self):
# Keeping redirect_uri in the state for OTP connections
# that will need it in finalize_login
self.redirect_uri = get_url_param(self.url, 'goto')
'goto': self.redirect_uri,
'authIndexType': 'service',
'authIndexValue': 'authn_hsbc_ws',
}
def init_login(self):
# Most of the time, login process is done by posting on the same URL
# different JSON callbacks that we may have to update with some values
self.login_page.go(slug=self.SLUG)
params = self.build_authentication_params()
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
self.authentication_page.go(data='', params=params)
# If needed, logic behind password encryption found in
# '/connect/XUI/themes/authn_hsbc_ws/js/jsencrypt.js?_=1650371144583' and
# '/connect/XUI/themes/authn_hsbc_ws/templates/openam/authn/DecryptPwdAndTokenReapp2.html?v=13.0.0-7'
data = self.page.get_password_json()
public_key = self.page.get_public_key()
b64_public_key = b64decode(public_key)
randomized_password = (''.join(choices(digits, k=24)) + self.password).encode()
recipient_key = RSA.import_key(b64_public_key)
cipher_rsa = PKCS1_v1_5.new(recipient_key) # PKCS1_v1_5 needed to match JSEncrypt.encrypt() method
encrypted_password = b64encode(cipher_rsa.encrypt(randomized_password))
data['callbacks'][0]['input'][0]['value'] = self.username
data['callbacks'][1]['input'][0]['value'] = encrypted_password
data['callbacks'][2]['input'][0]['value'] = public_key
# Only way to detect wrong credentials is through a 401 messageless error
try:
self.authentication_page.go(json=data)
except ClientError as e:
if e.response.status_code == 401:
raise BrowserIncorrectPassword()
raise
if self.page.is_device_fingerprint_needed():
data = self.response.json()
# set device fingerprint
# to trigger otp we can just modify userAgent value
data['callbacks'][0]['input'][0]['value'] = (
'{"screen":{"screenWidth":1920,"screenHeight":1080,"screenColourDepth":24},'
+ '"timezone":{"timezone":-120},"plugins":{"installedPlugins":""},"fonts":'
+ '{"installedFonts":"cursive;monospace;serif;sans-serif;fantasy;default;'
+ 'Arial;Arial Narrow;Bookman Old Style;Courier;Courier New;Times;Times New Roman;"},'
+ '"userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0",'
+ '"appName":"Netscape","appCodeName":"Mozilla","appVersion":"5.0 (X11)","platform":'
+ '"Linux x86_64","oscpu":"Linux x86_64","product":"Gecko","productSub":"20100101","language":"en-US"}'
)
self.authentication_page.go(json=data)
def finalize_login(self, token):
# tokenId allows us to access user_connect_page which itself gives us the final login URL
self.session.cookies['idtksam'] = token
self.finalize_authentication_page.go(data='')
self.location(self.redirect_uri)
# This has the same purpose as in do_login: going to accounts the first time
# does not redirect to account page but to home page, which will make S2E parent
# raise a BrowserIncorrectPassword because of a check in the iter_accounts.
# So, first call to accounts here leads us to home page, then iter_accounts from
# parent does the request again and this time we're correctly redirected to
# the real accounts page.
self.accounts.go(slug=self.SLUG, lang=self.LANG)
def handle_otp(self):
self.otp_json['callbacks'][1]['input'][0]['value'] = self.config['otp'].get()
try:
self.authentication_page.go(json=self.otp_json)
data = self.response.json()
# If OTP is wrong, we can spot it thanks to website
# response being otp_json again
if self.page.is_wrong_otp():
raise BrowserIncorrectPassword(bad_fields=['otp'])
except ClientError as e:
if e.response.status_code == 401:
raise BrowserPasswordExpired('Code de sécurité expiré')
raise
# add browser like trusted device
if self.page.is_json_to_trust_device():
self.authentication_page.go(json=data)
self.finalize_login(self.response.json().get('tokenId'))