#j`: VdZddlZddlZddlZddlZddlmZdZdZ dZ dZ dZ d Z d ZGd d ZGd dej Zd>dZej&dZej&dZej&dZej&dZdZdZdZej6j9ddddj:eej>j@dfdZ!dZ"dZ#ej6j9ddd Z$d!Z%d"Z&d#Z'd$Z(d%Z)ej6jUd&d'(d)Z+ej6j9d*d+ed,fd-ed.fd/ed0fd1e d2ffd3Z,d4Z-d5Z.d6Z/d7Z0Gd8d9Z1Gd:d;Z2ej&d<Z3d=Z4y)?z9Tests for managing HTTP issues (malformed requests, etc).N)helperiiiiicB|jdjdS)zEncode PATH_INFO correctly depending on Python version. WSGI 1.0 is a mess around Unicode. Create endpoints that match the PATH_INFO that it produces. utf-8latin-1)encodedecode)strings E/srv/dav/.venv/lib/python3.12/site-packages/cheroot/test/test_core.py_munger s == ! ( ( 33cPeZdZdZedZedZedZedZy) WSGICallables!Controller for serving WSGI apps.cy)zRender Hello world. Hello world!reqresps r hellozWSGICallables.hello sr cL|jjddd|_yy)zRender Hello world or set 411.Content-LengthNz411 Length Requiredr)environgetstatusrs r body_requiredzWSGICallables.body_required%s' ;;??+T 2 :/DKr c:|jjddS)zRender QUERY_STRING value. QUERY_STRINGrrrs r query_stringzWSGICallables.query_string-s{{~r22r cF|jjdd}d|dS)zRender request method value.REQUEST_METHODzNO METHOD FOUNDzGot asterisk URI path with z methodr!)rrmethods r asteriskzWSGICallables.asterisk2s)!13DE,VHG<Check that CONNECT query results in Method Not Allowed status.z /anythingrNi)connectint)rH status_line actual_statuss r test_http_connect_requestrSrs5%%k215K BQ(M C  r cn|jd\}}}t|dd}|tk(sJ|dk(sJy)z%Check that normal GET query succeeds.r.NrN Hello world!rrPHTTP_OKrHrQ_actual_resp_bodyrRs r test_normal_requestr[ysD'2x'@$K$ BQ(M G ## #  .. .r cn|jd\}}}t|dd}|tk(sJ|dk(sJy)z(Check that GET parameter is parsed well./query_string?test=TrueNrNs test=TruerVrXs r test_query_string_requestr^sI'2!($K$ BQ(M G ## # | ++ +r urir.r]z /{0}?{1}={2})u Юххуууuїuйоc^|j|d}t|dd}|tk(sJy)z8Check that server responds with OK to valid GET queries.rNrNrV)rHr_rQrRs r test_parse_acceptable_uriras5//#&q)K BQ(M G ## #r c|j}djd}tjj |}|dk(sJdj d it }|j|jd|jt|d}|j|jtk(sJ|jdd k(sJ|jy ) a#Test that malicious URI does not allow HTTP injection. This effectively checks that sending GET request with URL /%A0%D0blah%20key%200%20900%204%20data is not converted into GET / blah key 0 900 4 data HTTP/1.1 which would be a security issue otherwise. r1rz&/%A0%D0blah%20key%200%20900%204%20datazGET {quoted} HTTP/1.1rGETr4 rUNr)get_connectionrurllibparsequoteformatlocals_output _send_outputr8beginrrWreadclose)rHcresourcequotedrequestresponses r test_parse_uri_unsafe_urirus ""$A-44Y?H \\   )F = == =,%,,8vx8GIIgnnW%&NN!!E2H NN ??g %% % ==  // /GGIr c2|j}|jdj|jt |d}|j |j tk(sJ|jddk(sJ|jy)zCheck that server responds with Bad Request to invalid GET queries. Invalid request line test case: it should only contain US-ASCII. uGET /йопта! HTTP/1.1rcr4sMalformed Request-URIN) rerkrrlr8rmrHTTP_BAD_REQUESTrnro)rHrprts r test_parse_uri_invalid_urirys| ""$AII)0023NN!!E2H NN ??. .. . ==  8 88 8GGIr )ru привітc|jtjj|\}}}t |dd}|t k(sJd|vsJy)zCheck that server responds with Bad Request to invalid GET queries. Invalid request line test case: it should have leading slash (be absolute). NrNsstarting with a slash)rrfrgrhrPrx)rHr_rQrYrZrRs r #test_parse_no_leading_slash_invalidr{s\(3 3($K$ BQ(M , ,, , #'7 77 7r cr|jd\}}}t|dd}|tk(sJd}||k(sJy)zlCheck that server responds with Bad Request to Absolute URI. Only proxy servers should allow this. zhttp://google.com/NrNs2Absolute URI not allowed if server is not a proxy.rrPrxrHrQrYrZrR expected_bodys r test_parse_uri_absolute_urirsM (37K'L$K$ BQ(M , ,, ,IM } ,, ,r cr|jd\}}}t|dd}|tk(sJd}||k(sJy)zDCheck that server responds with OK to OPTIONS with "*" Absolute URI.*NrNs)Got asterisk URI path with OPTIONS method)optionsrPrWr~s r test_parse_uri_asterisk_urirsK'2':':3'?$K$ BQ(M G ## #@M } ,, ,r cr|jd\}}}t|dd}|tk(sJd}||k(sJy)zACheck that server responds with Bad Request to URI with fragment.z/hello?test=something#fakeNrNs!Illegal #fragment in Request-URI.r}r~s r test_parse_uri_fragment_urirsO'2$($K$ BQ(M , ,, ,8M } ,, ,r c|j}|jdd|j}|j}|j}|t k(sJ|dk(sJ|j y)z4Test POST query with an empty body being successful.POSTr/rUN)rers getresponsernrrWro)rHrprtrZrRs r test_no_content_lengthrse ""$AIIfj!}}H}}OOM G ## #  .. .GGIr c|j}|jdd|j}|j|j}|t k(sJ|j y)zDTest POST query with body failing because of missing Content-Length.rr0N)rersrrnrHTTP_LENGTH_REQUIREDro)rHrprtrRs r test_content_length_requiredrsV ""$AIIf&'}}H MMOOOM 0 00 0GGIr z.https://github.com/cherrypy/cheroot/issues/106F)reasonstrictc|j}|jdd|jdtd|j |j }|j }|tk(sJy)z5Test GET query with maliciously large Content-Length.rcr.rlN)re putrequest putheaderstr endheadersrrHTTP_REQUEST_ENTITY_TOO_LARGE)rLrprtrRs r test_large_requestrs_ "002ALL!KK #e*-LLN}}HOOM 9 99 9r ) request_line status_codersGET /Malformed Request-LinesGET / HTTPS/1.1s$Malformed Request-Line: bad protocols GET / HTTP/1s#Malformed Request-Line: bad versionsGET / HTTP/2.15sCannot fulfill requestc |j}|j||jt|d}|j |j |k(sJ|j t||k(sJ|jy)z5Test missing or invalid HTTP version in Request-Line.rcr4N) rerkrlr8rmrrnlenro)rHrrrrprts r test_malformed_request_liner5sv@ ""$AIIlNN!!E2H NN ??k )) ) ==]+ , == =GGIr c*|j}|jdd|jdd|j|j }|j }|t k(sJ|jd}|dk(sJ|jy)zTest non-uppercase HTTP method.GeTz/malformed_method_case Content-Type text/plainrwsMalformed method nameN) rerrrrrrxrnrorHrprtrRrZs r test_malformed_http_methodr_s""$ALL01KK -LLN}}HOOM , ,, ,}}R( 7 77 7GGIr cL|j}|jdd|jdd|jd|j |j }|j }|tk(sJ|jd}|dk(sJ|jy) z5Check that broken HTTP header results in Bad Request.rc/rrsRe, 1.2.3.4#015#012sIllegal header line.N) rerrrkrrrrxrnrors r test_malformed_headerros""$ALLKK -II$%LLN}}HOOM , ,, ,}}R( 6 66 6GGIr cdd}td|zdk(sJ|j|d}|dk(sJy)z?Check that HTTP request line of exactly 256 chars length is OK.z/hello?intervenant-entreprise-evenement_classaction=evenement-mailremerciements&_path=intervenant-entreprise-evenement&intervenant-entreprise-evenement_action-id=19404&intervenant-entreprise-evenement_id=19404&intervenant-entreprise_id=28092zGET %s HTTP/1.1 rUN)rr)rH Request_URIrZs r "test_request_line_split_issue_1220rsI + ${2 3s :: :"{3A6  .. .r c|j}|jd|j|j|jd} |j |j }|tk(sJ|jd}|dk(sJ|jy#tj$r(}|jtjk7rYd}~yd}~wwxYw)z>Test that server sends an error for garbage received over TCP.sgjkgjklsgjklsgjkljklsgrcr4rN)rerkrlr5r6rmrrxrnrosocketerrorerrno ECONNRESET)rHrprtrRrZexs r test_garbage_inrs ""$AII'(NNu5H    0000#==,#<<<<  << 88u'' '  (sAB C3CCceZdZdZdZdZy)CloseControllerz*Controller for testing the close callback.c|jj|_t|j}||j|j j |S)z'Get the req to know header sent status.)__self__r CloseResponserorheadersitems)selfrstart_responsers r __call__zCloseController.__call__sC!**..TZZ(t{{DLL$6$6$89 r c:|jjdy)zClose, writing hello.helloN)rwriters r rozCloseController.closes x r N)r'r(r)r*rrorr r rrs4!r rc"eZdZdZdZdZdZy)rz3Dummy empty response to trigger the no body status.c2d|_ddi|_||_y)z-Use some defaults to ensure we have a header.z200 OKrz text/htmlN)rrro)rros r __init__zCloseResponse.__init__s & 4  r ct)zEnsure we don't have a body.) IndexError)rindexs r __getitem__zCloseResponse.__getitem__sr c|S)z%Return self to hook the close method.rrs r outputzCloseResponse.outputs r N)r'r(r)r*rrrrr r rrs= r rcX|j}t|_d|_||_|Sr:)r<rr=r>r?r@s r testing_server_closerrDr cP|jjd\}}}|dk(sJy)z@Test we are actually sending the headers before calling 'close'.rrN)r?r)rrY resp_bodys r test_send_header_before_closingrs,*88<rsS?   #  4==:f''*E(( 66  /, ! ##%C D  $ $:   8 8 ---$" ; : :$4   %   3   2  & % !232"  $/"* ! !$!r