Dfk9 *dZddlZddlZddlZddlZddlmZdZdZ dZ dZ dZ d Z Gd d ejZd)rBs r test_clientrGUs   ''rcH|j}t|_||_|S)r:)r;rr<r>r?s r testing_server_with_defaultsrI[s(%4K*,,K 2K rc|jSrErF)rIs r test_client_with_defaultsrKds  ( 55rcz|dd}t|dd}|dksJdS)z>Check that CONNECT query results in Method Not Allowed status.z /anythingrNi)connectint)rG status_line actual_statuss r test_http_connect_requestrRjsF%%k2215K BQB((M C      rc|d\}}}t|dd}|tksJ|dksJdS)z%Check that normal GET query succeeds.r(NrM Hello world!rrOHTTP_OKrGrP_actual_resp_bodyrQs r test_normal_requestrZqsX'2x'@'@$K$ BQB((M G # # # #  . . . . . .rc|d\}}}t|dd}|tksJ|dksJdS)z$Check that GET param is parsed well./query_string?test=TrueNrMs test=TruerUrWs r test_query_string_requestr]ys_'2!(($K$ BQB((M G # # # # | + + + + + +rurir(r\z /{0}?{1}={2})u Юххуууuїuйоc||d}t|dd}|tksJdS)z8Check that server responds with OK to valid GET queries.rNrMrU)rGr^rPrQs r test_parse_acceptable_urir`sF//#&&q)K BQB((M G # # # # # #rc|}dd}tj|}|dksJdjd it }||d|t|d}| |j tksJ| dd ksJ|d S) a#Test that malicious URI does not allow HTTP injection. This effectively checks that sending GET request with URL /%A0%D0blah%20key%200%20900%204%20data is not converted into GET / blah key 0 900 4 data HTTP/1.1 which would be a security issue otherwise. r+r#z&/%A0%D0blah%20key%200%20900%204%20datazGET {quoted} HTTP/1.1r"r1r3 rTNr )get_connectionr$urllibparsequoterr_output _send_outputr7beginrrVreadclose)rGcresourcequotedrequestresponses r test_parse_uri_unsafe_urirqs ""$$A-44Y??H \   ) )F = = = = =,%,88vxx88GIIgnnW%%&&&NN!!E222H NN ?g % % % % ==   / / / /GGIIIIIrcr|}|dd|t |d}||jtksJ|ddksJ| dS)zCheck that server responds with Bad Request to invalid GET queries. Invalid request line test case: it should only contain US-ASCII. uGET /йопта! HTTP/1.1r"r1r3sMalformed Request-URIN) rcrgr$rhr7rirHTTP_BAD_REQUESTrjrk)rGrlrps r test_parse_uri_invalid_urirus ""$$AII*11'::;;;NN!!E222H NN ?. . . . . ==   8 8 8 8 8GGIIIIIr)ru привітc|tj|\}}}t |dd}|t ksJd|vsJdS)zCheck that server responds with Bad Request to invalid GET queries. Invalid request line test case: it should have leading slash (be absolute). NrMsstarting with a slash)rrdrerfrOrt)rGr^rPrXrYrQs r #test_parse_no_leading_slash_invalidrwss(3 3(($K$ BQB((M , , , , , #'7 7 7 7 7 7 7rc|d\}}}t|dd}|tksJd}||ksJdS)zlCheck that server responds with Bad Request to Absolute URI. Only proxy servers should allow this. zhttp://google.com/NrMs2Absolute URI not allowed if server is not a proxy.rrOrtrGrPrXrYrQ expected_bodys r test_parse_uri_absolute_urir|sa (37K'L'L$K$ BQB((M , , , , ,IM } , , , , , ,rc|d\}}}t|dd}|tksJd}||ksJdS)zDCheck that server responds with OK to OPTIONS with "*" Absolute URI.*NrMs)Got asterisk URI path with OPTIONS method)optionsrOrVrzs r test_parse_uri_asterisk_urirs_'2':':3'?'?$K$ BQB((M G # # # #@M } , , , , , ,rc|d\}}}t|dd}|tksJd}||ksJdS)zACheck that server responds with Bad Request to URI with fragment.z/hello?test=something#fakeNrMs!Illegal #fragment in Request-URI.ryrzs r test_parse_uri_fragment_urirse'2$(($K$ BQB((M , , , , ,8M } , , , , , ,rc |}|dd|}|}|j}|t ksJ|dksJ|dS)z4Test POST query with an empty body being successful.POSTr)rTN)rcro getresponserjrrVrk)rGrlrprYrQs r test_no_content_lengthrs~ ""$$AIIfj!!!}}H}}OM G # # # #  . . . .GGIIIIIrc|}|dd|}||j}|t ksJ|dS)zDTest POST query with body failing because of missing Content-Length.rr*N)rcrorrjrHTTP_LENGTH_REQUIREDrk)rGrlrprQs r test_content_length_requiredrsn ""$$AIIf&'''}}H MMOOOOM 0 0 0 0 0GGIIIIIrz.https://github.com/cherrypy/cheroot/issues/106F)reasonstrictc|}|dd|dtd||}|j}|tksJdS)z5Test GET query with maliciously large Content-Length.r1r(rlN)rc putrequest putheaderstr endheadersrrHTTP_REQUEST_ENTITY_TOO_LARGE)rKrlrprQs r test_large_requestrs} "0022ALL!!!KK #e**---LLNNN}}HOM 9 9 9 9 9 9 9r) request_line status_coder{sGET /Malformed Request-LinesGET / HTTPS/1.1s$Malformed Request-Line: bad protocols GET / HTTP/1s#Malformed Request-Line: bad versionsGET / HTTP/2.15sCannot fulfill requestc\|}|||t|d}||j|ksJ|t||ksJ|dS)z5Test missing or invalid HTTP version in Request-Line.r1r3N) rcrgrhr7rirrjlenrk)rGrrr{rlrps r test_malformed_request_liner-s4 ""$$AIIlNN!!E222H NN ?k ) ) ) ) ==]++ , , = = = =GGIIIIIrc`|}|dd|dd||}|j}|t ksJ|d}|dksJ|dS)zTest non-uppercase HTTP method.GeTz/malformed_method_case Content-Type text/plainrssMalformed method nameN) rcrrrrrrtrjrkrGrlrprQrYs r test_malformed_http_methodrQs""$$ALL0111KK ---LLNNN}}HOM , , , , ,}}R(( 7 7 7 7 7GGIIIIIrc|}|dd|dd|d||}|j}|tksJ|d}|dksJ| dS) z5Check that broken HTTP header results in Bad Request.r1/rrsRe, 1.2.3.4#015#012sIllegal header line.N) rcrrrgrrrrtrjrkrs r test_malformed_headerras""$$ALLKK ---II$%%%LLNNN}}HOM , , , , ,}}R(( 6 6 6 6 6GGIIIIIrcd}td|zdksJ||d}|dksJdS)z?Check that HTTP request line of exactly 256 chars length is OK.z/hello?intervenant-entreprise-evenement_classaction=evenement-mailremerciements&_path=intervenant-entreprise-evenement&intervenant-entreprise-evenement_action-id=19404&intervenant-entreprise-evenement_id=19404&intervenant-entreprise_id=28092zGET %s HTTP/1.1 rTN)rr)rG Request_URIrYs r "test_request_line_split_issue_1220rss[ + ${2 3 3s : : : :"{33A6  . . . . . .rc|}|d|||jd} ||j}|tksJ|d}|dksJ| dS#tj $r!}|j tj krYd}~dSd}~wwxYw)z>Test that server sends an error for garbage received over TCP.sgjkgjklsgjklsgjkljklsgr1r3rN)rcrgrhr4r5rirrtrjrksocketerrorerrno ECONNRESET)rGrlrprQrYexs r test_garbage_inrs ""$$AII'(((NNu55H    00000#==,,#<<<<<  < 8u' ' '  ( ' ' ' ' 'sAB66C&C!!C&ceZdZdZdZdZdS)CloseControllerz*Controller for testing the close callback.c|jj|_t|j}||j|j|S)z'Get the req to know header sent status.)__self__r CloseResponserkrheadersitems)selfrstart_responser s r __call__zCloseController.__call__sE!*.TZ((t{DL$6$6$8$8999 rc:|jddS)zClose, writing hello.helloN)r writers r rkzCloseController.closes x     rN)r,r-r.r/rrkr rr rrs844!!!!!rrc$eZdZdZdZdZdZdS)rz3Dummy empty response to trigger the no body status.c4d|_ddi|_||_dS)z-Use some defaults to ensure we have a header.z200 OKrz text/htmlN)rrrk)rrks r __init__zCloseResponse.__init__s  & 4  rct)zEnsure we don't have a body.) IndexError)rindexs r __getitem__zCloseResponse.__getitem__s llrc|S)z%Return self to hook the close method.r rs r outputzCloseResponse.outputs rN)r,r-r.r/rrrr rr rrsG== rrcV|j}t|_d|_||_|Sr9)r;rr<r=r>r?s r testing_server_closerrCrcR|jd\}}}|dksJdS)z@Test we are actually sending the headers before calling 'close'.rrN)r>r)rrX resp_bodys r test_send_header_before_closingrs5*8<rs??   #  00000f'000fEEEE((( 666    ///,,, ! S#%C D D   $$  $:     8 8 8 - - -------$" ; :: :$4  7  E  D  &(A *  +*     $///"* ! ! ! ! ! ! ! !$!!!!!r