a mzfk9 @sdZddlZddlZddlZddlZddlmZdZdZ dZ dZ dZ d Z Gd d d ejZdUd dZejddZejddZejddZejddZddZddZddZejdddd jeejjd!fd"d#Zd$d%Z d&d'Z!ejdd(d)d*Z"d+d,Z#d-d.Z$d/d0Z%d1d2Z&d3d4Z'ejj(d5d6d7d8d9Z)ejd:d;edfd?ed@fdAe dBffdCdDZ*dEdFZ+dGdHZ,dIdJZ-dKdLZ.GdMdNdNZ/GdOdPdPZ0ejdQdRZ1dSdTZ2dS)Vz9Tests for managing HTTP issues (malformed requests, etc).N)helperiiiiic@sdeZdZdZddZddZddZdd Zd d Zd ed ededeedeedededeiZ dS)HelloControllerz!Controller for serving WSGI apps.cCsdS)zRender Hello world. Hello world!reqresprrD/var/www/media/lib/python3.9/site-packages/cheroot/test/test_core.pyhelloszHelloController.hellocCs |jdddurd|_dSdS)zRender Hello world or set 411.Content-LengthNz411 Length Requiredr)environgetstatusrrrr body_requiredszHelloController.body_requiredcCs|jddS)zRender QUERY_STRING value. QUERY_STRING)r rrrrr query_string"szHelloController.query_stringcCs$|jdd}d}|jfitS)zRender request method value.REQUEST_METHODzNO METHOD FOUNDz*Got asterisk URI path with {method} method)r rformatlocals)rr methodtmplrrr asterisk&szHelloController.asteriskcCs|ddS)zEncode PATH_INFO correctly depending on Python version. WSGI 1.0 is a mess around unicode. Create endpoints that match the PATH_INFO that it produces. utf-8latin-1)encodedecode)stringrrr _munge-szHelloController._munge/hello/no_body/body_requiredz /query_stringu /привітu /Юххууу/ Ðblah key 0 900 4 dataz/*N) __name__ __module__ __qualname____doc__r rrrrhandlersrrrr rs rGETcCs|j|j|dS)Nr)response_classsock) connectionrrrr _get_http_responseGsr.cCs|j}t|_d|_||_|S:Attach a WSGI app to the given server and preconfigure it.i)server_instancerwsgi_appmax_request_body_size server_clientZwsgi_server_clientZ wsgi_serverrrr testing_serverKs r6cCs|jSz5Get and return a test client out of the given server.r4)r6rrr test_clientUsr9cCs|j}t|_||_|S)r0)r1rr2r4r5rrr testing_server_with_defaults[sr:cCs|jSr7r8)r:rrr test_client_with_defaultsdsr;cCs.|dd}t|dd}|dks*JdS)z>Check that CONNECT query results in Method Not Allowed status.z /anythingrNi)connectint)r9 status_line actual_statusrrr test_http_connect_requestjsrAcCs<|d\}}}t|dd}|tks,J|dks8JdS)z%Check that normal GET query succeeds.r Nr< Hello world!rr>HTTP_OKr9r?_actual_resp_bodyr@rrr test_normal_requestqs rHcCs<|d\}}}t|dd}|tks,J|dks8JdS)z$Check that GET param is parsed well./query_string?test=TrueNr<s test=TruerCrErrr test_query_string_requestys   rJurir rIz /{0}?{1}={2})u ЮххуууuїuйоcCs.||d}t|dd}|tks*JdS)z8Check that server responds with OK to valid GET queries.rNr<rC)r9rKr?r@rrr test_parse_acceptable_uris rLcCs|}dd}tj|}|dks*Jdjfit}||d|t |dd}| |j t ksvJ| dd ksJ|d S) a#Test that malicious URI does not allow HTTP injection. This effectively checks that sending GET request with URL /%A0%D0blah%20key%200%20900%204%20data is not converted into GET / blah key 0 900 4 data HTTP/1.1 which would be a security issue otherwise. r#rz&/%A0%D0blah%20key%200%20900%204%20datazGET {quoted} HTTP/1.1rr)r* rBN)get_connectionrurllibparsequoterr_output _send_outputr.beginrrDreadclose)r9cresourcequotedrequestresponserrr test_parse_uri_unsafe_uris    r\cCs`|}|dd|t|dd}||jtksBJ|ddksTJ| dS)zCheck that server responds with Bad Request to invalid GET queries. Invalid request line test case: it should only contain US-ASCII. uGET /йопта! HTTP/1.1rr)r*sMalformed Request-URIN) rNrRrrSr.rTrHTTP_BAD_REQUESTrUrV)r9rWr[rrr test_parse_uri_invalid_uris r_)r u привітcCsD|tj|\}}}t|dd}|tks4Jd|vs@JdS)zCheck that server responds with Bad Request to invalid GET queries. Invalid request line test case: it should have leading slash (be absolute). Nr<sstarting with a slash)rrOrPrQr>r^)r9rKr?rFrGr@rrr #test_parse_no_leading_slash_invalids   r`cCs@|d\}}}t|dd}|tks,Jd}||ksr^r9r?rFrGr@ expected_bodyrrr test_parse_uri_absolute_uris  rdcCs@|d\}}}t|dd}|tks,Jd}||ksrDrbrrr test_parse_uri_asterisk_uris  rgcCs@|d\}}}t|dd}|tks,Jd}||ksTest that server sends an error for garbage received over TCP.sgjkgjklsgjklsgjkljklsgr)r*rxN)rNrRrSr+r,rTrr^rUrVsocketerrorerrno ECONNRESET)r9rWr[r@rGexrrr test_garbage_ins      rc@s eZdZdZddZddZdS)CloseControllerz*Controller for testing the close callback.cCs*|jj|_t|j}||j|j|S)z'Get the req to know header sent status.)__self__r CloseResponserVrheadersitems)selfr Zstart_responser rrr __call__s  zCloseController.__call__cCs|jddS)zClose, writing hello.helloN)rwriterrrr rVszCloseController.closeN)r$r%r&r'rrVrrrr rsrc@s(eZdZdZddZddZddZdS) rz3Dummy empty response to trigger the no body status.cCsd|_ddi|_||_dS)z-Use some defaults to ensure we have a header.z200 OKr{z text/htmlN)rrrV)rrVrrr __init__s zCloseResponse.__init__cCs tdS)zEnsure we don't have a body.N) IndexError)rindexrrr __getitem__szCloseResponse.__getitem__cCs|S)z%Return self to hook the close method.rrrrr outputszCloseResponse.outputN)r$r%r&r'rrrrrrr rsrcCs|j}t|_d|_||_|Sr/)r1rr2r3r4r5rrr testing_server_closes rcCs"|jd\}}}|dksJdS)z@Test we are actually sending the headers before calling 'close'.rrN)r4r)rrFZ resp_bodyrrr test_send_header_before_closingsr)r))3r'rr urllib.parserOZpytestZ cheroot.testrr^rlZHTTP_NOT_FOUNDrtrDHTTP_VERSION_NOT_SUPPORTEDZ Controllerrr.Zfixturer6r9r:r;rArHrJmarkZ parametrizermaprPrQrLr\r_r`rdrgrhrkrmZxfailrurzr~rrrrrrrrrrr s 3