Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This module will handle authentication for your SharePoint Online/O365 site, allowing you to make straightforward HTTP requests from Python. It extends the commonly used Requests module, meaning that returned objects are familliar, easy to work with and well documented.
SharePy can be installed from the Python Package Index, PyPI.
pip install sharepy
import sharepy
s = sharepy.connect("example.sharepoint.com")
You will be prompted to enter your username and password, which are used to request a security token from Microsoft. An access cookie and request digest token are then retrieved and saved to properties for later use. The digest token will be refreshed automatically as it expires.
A username and password can also be provided as arguments of the connect
function, if prompts are not desirable.
r = s.get("https://example.sharepoint.com/_api/web/lists/GetByTitle('Test Library')")
This will return a Requests response
object. See the requests documentation for details. By default, the headers Accept: application/json; odata=verbose
and Content-type: application/json; odata=verbose
are sent with all requests, so API responses will be formatted as JSON where available.
Headers can be added or overridden by supplying a dictionary to the relevant method:
r = s.get("https://example.sharepoint.com/_api/...", headers={"Accept": "application/atom+xml"})
The request will send a digest header, allowing modifications to be made to SharePoint objects.
r = s.getfile("https://example.sharepoint.com/Library/Test%20File.pdf")
This will download the file to the current directory and return a response
object. Alternatively you can specify a location to save the file to:
r = s.getfile("https://example.sharepoint.com/Library/Test%20File.pdf", filename="downloads/file.pdf")
Properties of the authentication session can be saved to a file using the save
method, so the session can be used without having to re-authenticate each time a program is run:
s.save()
Later, the load
function can be used to restore the session:
s = sharepy.load()
The default file name for saving and loading sessions is sp-session.pkl
, however an alternative location can be provided as an argument to save()
and load()
.
SharePy implements Requests authentication classes that can also be used directly with Requests itself:
import requests
import sharepy
auth = sharepy.auth.SharePointOnline(username="user@example.com")
auth.login(site="example.sharepoint.com")
r = requests.get("https://example.sharepoint.com", auth=auth)
Available authentication classes are:
SharepointOnline
- For normal SharePoint Online sitesSharepointADFS
- For ADFS-enabled sitesThe authentication URL is detected automatically when using sharepy.connect()
. If a different URL is required for a region-specific account, it can be specified by manually creating an auth object and setting its login_url
property:
import sharepy
auth = sharepy.auth.SharePointOnline(username="user@example.com")
auth.login_url = "https://login.microsoftonline.de/extSES.srf"
s = sharepy.SharePointSession("example.sharepoint.com", auth)
This software is distributed under the GNU General Public License v3. Copyright 2016-2021 Jonathan Holvey.
FAQs
Simple SharePoint Online authentication for Python
We found that sharepy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.