2012-08-11 09:11:20 +00:00
|
|
|
from io import BytesIO
|
2013-07-13 08:16:40 +00:00
|
|
|
from itertools import chain
|
2017-01-26 13:25:15 +00:00
|
|
|
from urllib.parse import urlencode
|
2008-03-08 03:06:30 +00:00
|
|
|
|
2017-05-25 12:19:01 +00:00
|
|
|
from django.core.exceptions import DisallowedHost
|
2015-01-28 12:35:27 +00:00
|
|
|
from django.core.handlers.wsgi import LimitedStream, WSGIRequest
|
2018-01-08 16:24:26 +00:00
|
|
|
from django.http import HttpRequest, RawPostDataException, UnreadablePostError
|
2019-03-01 17:53:18 +00:00
|
|
|
from django.http.multipartparser import MultiPartParserError
|
2018-05-04 23:37:01 +00:00
|
|
|
from django.http.request import HttpHeaders, split_domain_port
|
2015-01-28 12:35:27 +00:00
|
|
|
from django.test import RequestFactory, SimpleTestCase, override_settings
|
2012-10-20 13:53:28 +00:00
|
|
|
from django.test.client import FakePayload
|
2008-03-08 03:06:30 +00:00
|
|
|
|
2011-09-10 00:46:38 +00:00
|
|
|
|
2013-04-03 20:27:20 +00:00
|
|
|
class RequestsTests(SimpleTestCase):
|
2010-09-28 07:06:37 +00:00
|
|
|
def test_httprequest(self):
|
2010-09-28 11:54:58 +00:00
|
|
|
request = HttpRequest()
|
2017-05-27 23:08:46 +00:00
|
|
|
self.assertEqual(list(request.GET), [])
|
|
|
|
self.assertEqual(list(request.POST), [])
|
|
|
|
self.assertEqual(list(request.COOKIES), [])
|
|
|
|
self.assertEqual(list(request.META), [])
|
2008-08-23 17:28:12 +00:00
|
|
|
|
Fixed #22799 -- Made GET and POST on HttpRequest QueryDicts, and FILES a MultiValueDict.
Previously, GET, POST, and FILES on an HttpRequest were created in
the __init__ method as dictionaries. This was not something you would
usually notice causing trouble in production as you'd only see a
WSGIRequest, but in testing using the test client, calling .getlist
on GET, POST, or FILES for a request with no get/post data resulted in
an AttributeError.
Changed GET and POST on an HttpRequest object to be mutable
QueryDicts (mutable because the Django tests, and probably many
third party tests, were expecting it).
2014-06-07 23:47:43 +00:00
|
|
|
# .GET and .POST should be QueryDicts
|
|
|
|
self.assertEqual(request.GET.urlencode(), '')
|
|
|
|
self.assertEqual(request.POST.urlencode(), '')
|
|
|
|
|
|
|
|
# and FILES should be MultiValueDict
|
|
|
|
self.assertEqual(request.FILES.getlist('foo'), [])
|
|
|
|
|
2015-08-07 05:51:39 +00:00
|
|
|
self.assertIsNone(request.content_type)
|
|
|
|
self.assertIsNone(request.content_params)
|
|
|
|
|
2014-10-31 15:43:34 +00:00
|
|
|
def test_httprequest_full_path(self):
|
|
|
|
request = HttpRequest()
|
2017-11-07 20:58:05 +00:00
|
|
|
request.path = '/;some/?awful/=path/foo:bar/'
|
|
|
|
request.path_info = '/prefix' + request.path
|
2014-10-31 15:43:34 +00:00
|
|
|
request.META['QUERY_STRING'] = ';some=query&+query=string'
|
|
|
|
expected = '/%3Bsome/%3Fawful/%3Dpath/foo:bar/?;some=query&+query=string'
|
|
|
|
self.assertEqual(request.get_full_path(), expected)
|
2017-11-07 20:58:05 +00:00
|
|
|
self.assertEqual(request.get_full_path_info(), '/prefix' + expected)
|
2014-10-31 15:43:34 +00:00
|
|
|
|
|
|
|
def test_httprequest_full_path_with_query_string_and_fragment(self):
|
|
|
|
request = HttpRequest()
|
2017-11-07 20:58:05 +00:00
|
|
|
request.path = '/foo#bar'
|
|
|
|
request.path_info = '/prefix' + request.path
|
2014-10-31 15:43:34 +00:00
|
|
|
request.META['QUERY_STRING'] = 'baz#quux'
|
|
|
|
self.assertEqual(request.get_full_path(), '/foo%23bar?baz#quux')
|
2017-11-07 20:58:05 +00:00
|
|
|
self.assertEqual(request.get_full_path_info(), '/prefix/foo%23bar?baz#quux')
|
2014-10-31 15:43:34 +00:00
|
|
|
|
2011-06-09 23:15:42 +00:00
|
|
|
def test_httprequest_repr(self):
|
|
|
|
request = HttpRequest()
|
2012-06-07 16:08:47 +00:00
|
|
|
request.path = '/somepath/'
|
2014-11-20 09:28:16 +00:00
|
|
|
request.method = 'GET'
|
2012-06-07 16:08:47 +00:00
|
|
|
request.GET = {'get-key': 'get-value'}
|
|
|
|
request.POST = {'post-key': 'post-value'}
|
|
|
|
request.COOKIES = {'post-key': 'post-value'}
|
|
|
|
request.META = {'post-key': 'post-value'}
|
2017-01-20 14:24:05 +00:00
|
|
|
self.assertEqual(repr(request), "<HttpRequest: GET '/somepath/'>")
|
2011-06-09 23:15:42 +00:00
|
|
|
|
2014-11-20 09:28:16 +00:00
|
|
|
def test_httprequest_repr_invalid_method_and_path(self):
|
|
|
|
request = HttpRequest()
|
2017-01-20 14:24:05 +00:00
|
|
|
self.assertEqual(repr(request), "<HttpRequest>")
|
2014-11-20 09:28:16 +00:00
|
|
|
request = HttpRequest()
|
|
|
|
request.method = "GET"
|
2017-01-20 14:24:05 +00:00
|
|
|
self.assertEqual(repr(request), "<HttpRequest>")
|
2014-11-20 09:28:16 +00:00
|
|
|
request = HttpRequest()
|
|
|
|
request.path = ""
|
2017-01-20 14:24:05 +00:00
|
|
|
self.assertEqual(repr(request), "<HttpRequest>")
|
2014-11-20 09:28:16 +00:00
|
|
|
|
2010-09-28 07:06:37 +00:00
|
|
|
def test_wsgirequest(self):
|
2015-08-07 05:51:39 +00:00
|
|
|
request = WSGIRequest({
|
|
|
|
'PATH_INFO': 'bogus',
|
|
|
|
'REQUEST_METHOD': 'bogus',
|
|
|
|
'CONTENT_TYPE': 'text/html; charset=utf8',
|
|
|
|
'wsgi.input': BytesIO(b''),
|
|
|
|
})
|
2017-05-27 23:08:46 +00:00
|
|
|
self.assertEqual(list(request.GET), [])
|
|
|
|
self.assertEqual(list(request.POST), [])
|
|
|
|
self.assertEqual(list(request.COOKIES), [])
|
2015-08-07 05:51:39 +00:00
|
|
|
self.assertEqual(
|
2017-05-27 23:08:46 +00:00
|
|
|
set(request.META),
|
2015-08-07 05:51:39 +00:00
|
|
|
{'PATH_INFO', 'REQUEST_METHOD', 'SCRIPT_NAME', 'CONTENT_TYPE', 'wsgi.input'}
|
|
|
|
)
|
2010-09-28 11:54:58 +00:00
|
|
|
self.assertEqual(request.META['PATH_INFO'], 'bogus')
|
|
|
|
self.assertEqual(request.META['REQUEST_METHOD'], 'bogus')
|
|
|
|
self.assertEqual(request.META['SCRIPT_NAME'], '')
|
2015-08-07 05:51:39 +00:00
|
|
|
self.assertEqual(request.content_type, 'text/html')
|
|
|
|
self.assertEqual(request.content_params, {'charset': 'utf8'})
|
2010-09-12 20:52:49 +00:00
|
|
|
|
2013-03-31 07:54:52 +00:00
|
|
|
def test_wsgirequest_with_script_name(self):
|
|
|
|
"""
|
2016-10-27 07:53:39 +00:00
|
|
|
The request's path is correctly assembled, regardless of whether or
|
|
|
|
not the SCRIPT_NAME has a trailing slash (#20169).
|
2013-03-31 07:54:52 +00:00
|
|
|
"""
|
|
|
|
# With trailing slash
|
2015-09-11 23:33:12 +00:00
|
|
|
request = WSGIRequest({
|
|
|
|
'PATH_INFO': '/somepath/',
|
|
|
|
'SCRIPT_NAME': '/PREFIX/',
|
|
|
|
'REQUEST_METHOD': 'get',
|
|
|
|
'wsgi.input': BytesIO(b''),
|
|
|
|
})
|
2013-03-31 07:54:52 +00:00
|
|
|
self.assertEqual(request.path, '/PREFIX/somepath/')
|
|
|
|
# Without trailing slash
|
2015-09-11 23:33:12 +00:00
|
|
|
request = WSGIRequest({
|
|
|
|
'PATH_INFO': '/somepath/',
|
|
|
|
'SCRIPT_NAME': '/PREFIX',
|
|
|
|
'REQUEST_METHOD': 'get',
|
|
|
|
'wsgi.input': BytesIO(b''),
|
|
|
|
})
|
2013-03-31 07:54:52 +00:00
|
|
|
self.assertEqual(request.path, '/PREFIX/somepath/')
|
|
|
|
|
2015-10-23 12:53:32 +00:00
|
|
|
def test_wsgirequest_script_url_double_slashes(self):
|
|
|
|
"""
|
|
|
|
WSGI squashes multiple successive slashes in PATH_INFO, WSGIRequest
|
|
|
|
should take that into account when populating request.path and
|
2016-10-27 07:53:39 +00:00
|
|
|
request.META['SCRIPT_NAME'] (#17133).
|
2015-10-23 12:53:32 +00:00
|
|
|
"""
|
|
|
|
request = WSGIRequest({
|
|
|
|
'SCRIPT_URL': '/mst/milestones//accounts/login//help',
|
|
|
|
'PATH_INFO': '/milestones/accounts/login/help',
|
|
|
|
'REQUEST_METHOD': 'get',
|
|
|
|
'wsgi.input': BytesIO(b''),
|
|
|
|
})
|
|
|
|
self.assertEqual(request.path, '/mst/milestones/accounts/login/help')
|
|
|
|
self.assertEqual(request.META['SCRIPT_NAME'], '/mst')
|
|
|
|
|
2013-03-31 07:54:52 +00:00
|
|
|
def test_wsgirequest_with_force_script_name(self):
|
|
|
|
"""
|
2016-10-27 07:53:39 +00:00
|
|
|
The FORCE_SCRIPT_NAME setting takes precedence over the request's
|
|
|
|
SCRIPT_NAME environment parameter (#20169).
|
2013-03-31 07:54:52 +00:00
|
|
|
"""
|
|
|
|
with override_settings(FORCE_SCRIPT_NAME='/FORCED_PREFIX/'):
|
2015-09-11 23:33:12 +00:00
|
|
|
request = WSGIRequest({
|
|
|
|
'PATH_INFO': '/somepath/',
|
|
|
|
'SCRIPT_NAME': '/PREFIX/',
|
|
|
|
'REQUEST_METHOD': 'get',
|
|
|
|
'wsgi.input': BytesIO(b''),
|
|
|
|
})
|
2013-03-31 07:54:52 +00:00
|
|
|
self.assertEqual(request.path, '/FORCED_PREFIX/somepath/')
|
|
|
|
|
|
|
|
def test_wsgirequest_path_with_force_script_name_trailing_slash(self):
|
|
|
|
"""
|
2016-10-27 07:53:39 +00:00
|
|
|
The request's path is correctly assembled, regardless of whether or not
|
|
|
|
the FORCE_SCRIPT_NAME setting has a trailing slash (#20169).
|
2013-03-31 07:54:52 +00:00
|
|
|
"""
|
|
|
|
# With trailing slash
|
|
|
|
with override_settings(FORCE_SCRIPT_NAME='/FORCED_PREFIX/'):
|
|
|
|
request = WSGIRequest({'PATH_INFO': '/somepath/', 'REQUEST_METHOD': 'get', 'wsgi.input': BytesIO(b'')})
|
|
|
|
self.assertEqual(request.path, '/FORCED_PREFIX/somepath/')
|
|
|
|
# Without trailing slash
|
|
|
|
with override_settings(FORCE_SCRIPT_NAME='/FORCED_PREFIX'):
|
|
|
|
request = WSGIRequest({'PATH_INFO': '/somepath/', 'REQUEST_METHOD': 'get', 'wsgi.input': BytesIO(b'')})
|
|
|
|
self.assertEqual(request.path, '/FORCED_PREFIX/somepath/')
|
|
|
|
|
2011-06-09 23:15:42 +00:00
|
|
|
def test_wsgirequest_repr(self):
|
2014-11-20 09:28:16 +00:00
|
|
|
request = WSGIRequest({'REQUEST_METHOD': 'get', 'wsgi.input': BytesIO(b'')})
|
2017-01-20 14:24:05 +00:00
|
|
|
self.assertEqual(repr(request), "<WSGIRequest: GET '/'>")
|
2012-08-11 09:11:20 +00:00
|
|
|
request = WSGIRequest({'PATH_INFO': '/somepath/', 'REQUEST_METHOD': 'get', 'wsgi.input': BytesIO(b'')})
|
2012-06-07 16:08:47 +00:00
|
|
|
request.GET = {'get-key': 'get-value'}
|
|
|
|
request.POST = {'post-key': 'post-value'}
|
|
|
|
request.COOKIES = {'post-key': 'post-value'}
|
|
|
|
request.META = {'post-key': 'post-value'}
|
2017-01-20 14:24:05 +00:00
|
|
|
self.assertEqual(repr(request), "<WSGIRequest: GET '/somepath/'>")
|
2011-06-09 23:15:42 +00:00
|
|
|
|
2012-12-17 09:49:26 +00:00
|
|
|
def test_wsgirequest_path_info(self):
|
2016-08-12 13:31:18 +00:00
|
|
|
def wsgi_str(path_info, encoding='utf-8'):
|
2016-12-01 10:38:01 +00:00
|
|
|
path_info = path_info.encode(encoding) # Actual URL sent by the browser (bytestring)
|
|
|
|
path_info = path_info.decode('iso-8859-1') # Value in the WSGI environ dict (native string)
|
2012-12-17 09:49:26 +00:00
|
|
|
return path_info
|
|
|
|
# Regression for #19468
|
|
|
|
request = WSGIRequest({'PATH_INFO': wsgi_str("/سلام/"), 'REQUEST_METHOD': 'get', 'wsgi.input': BytesIO(b'')})
|
|
|
|
self.assertEqual(request.path, "/سلام/")
|
|
|
|
|
2016-08-12 13:31:18 +00:00
|
|
|
# The URL may be incorrectly encoded in a non-UTF-8 encoding (#26971)
|
|
|
|
request = WSGIRequest({
|
|
|
|
'PATH_INFO': wsgi_str("/café/", encoding='iso-8859-1'),
|
|
|
|
'REQUEST_METHOD': 'get',
|
|
|
|
'wsgi.input': BytesIO(b''),
|
|
|
|
})
|
|
|
|
# Since it's impossible to decide the (wrong) encoding of the URL, it's
|
|
|
|
# left percent-encoded in the path.
|
|
|
|
self.assertEqual(request.path, "/caf%E9/")
|
|
|
|
|
2010-10-29 16:39:25 +00:00
|
|
|
def test_limited_stream(self):
|
|
|
|
# Read all of a limited stream
|
2012-08-11 09:11:20 +00:00
|
|
|
stream = LimitedStream(BytesIO(b'test'), 2)
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(stream.read(), b'te')
|
2011-01-16 07:31:35 +00:00
|
|
|
# Reading again returns nothing.
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(stream.read(), b'')
|
2010-10-29 16:39:25 +00:00
|
|
|
|
|
|
|
# Read a number of characters greater than the stream has to offer
|
2012-08-11 09:11:20 +00:00
|
|
|
stream = LimitedStream(BytesIO(b'test'), 2)
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(stream.read(5), b'te')
|
2011-01-16 07:31:35 +00:00
|
|
|
# Reading again returns nothing.
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(stream.readline(5), b'')
|
2010-10-29 16:39:25 +00:00
|
|
|
|
|
|
|
# Read sequentially from a stream
|
2012-08-11 09:11:20 +00:00
|
|
|
stream = LimitedStream(BytesIO(b'12345678'), 8)
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(stream.read(5), b'12345')
|
|
|
|
self.assertEqual(stream.read(5), b'678')
|
2011-01-16 07:31:35 +00:00
|
|
|
# Reading again returns nothing.
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(stream.readline(5), b'')
|
2010-10-29 16:39:25 +00:00
|
|
|
|
|
|
|
# Read lines from a stream
|
2012-08-11 09:11:20 +00:00
|
|
|
stream = LimitedStream(BytesIO(b'1234\n5678\nabcd\nefgh\nijkl'), 24)
|
2010-10-29 16:39:25 +00:00
|
|
|
# Read a full line, unconditionally
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(stream.readline(), b'1234\n')
|
2010-10-29 16:39:25 +00:00
|
|
|
# Read a number of characters less than a line
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(stream.readline(2), b'56')
|
2010-10-29 16:39:25 +00:00
|
|
|
# Read the rest of the partial line
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(stream.readline(), b'78\n')
|
2010-10-29 16:39:25 +00:00
|
|
|
# Read a full line, with a character limit greater than the line length
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(stream.readline(6), b'abcd\n')
|
2010-10-29 16:39:25 +00:00
|
|
|
# Read the next line, deliberately terminated at the line end
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(stream.readline(4), b'efgh')
|
2010-10-29 16:39:25 +00:00
|
|
|
# Read the next line... just the line end
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(stream.readline(), b'\n')
|
2010-10-29 16:39:25 +00:00
|
|
|
# Read everything else.
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(stream.readline(), b'ijkl')
|
2010-10-29 16:39:25 +00:00
|
|
|
|
2011-01-16 07:31:35 +00:00
|
|
|
# Regression for #15018
|
|
|
|
# If a stream contains a newline, but the provided length
|
|
|
|
# is less than the number of provided characters, the newline
|
|
|
|
# doesn't reset the available character count
|
2012-08-11 09:11:20 +00:00
|
|
|
stream = LimitedStream(BytesIO(b'1234\nabcdef'), 9)
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(stream.readline(10), b'1234\n')
|
|
|
|
self.assertEqual(stream.readline(3), b'abc')
|
2011-01-16 07:31:35 +00:00
|
|
|
# Now expire the available characters
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(stream.readline(3), b'd')
|
2011-01-16 07:31:35 +00:00
|
|
|
# Reading again returns nothing.
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(stream.readline(2), b'')
|
2011-01-16 07:31:35 +00:00
|
|
|
|
|
|
|
# Same test, but with read, not readline.
|
2012-08-11 09:11:20 +00:00
|
|
|
stream = LimitedStream(BytesIO(b'1234\nabcdef'), 9)
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(stream.read(6), b'1234\na')
|
|
|
|
self.assertEqual(stream.read(2), b'bc')
|
|
|
|
self.assertEqual(stream.read(2), b'd')
|
|
|
|
self.assertEqual(stream.read(2), b'')
|
|
|
|
self.assertEqual(stream.read(), b'')
|
2011-01-16 07:31:35 +00:00
|
|
|
|
2010-10-29 16:39:25 +00:00
|
|
|
def test_stream(self):
|
2012-10-20 13:53:28 +00:00
|
|
|
payload = FakePayload('name=value')
|
2019-01-02 23:18:19 +00:00
|
|
|
request = WSGIRequest({
|
|
|
|
'REQUEST_METHOD': 'POST',
|
|
|
|
'CONTENT_TYPE': 'application/x-www-form-urlencoded',
|
|
|
|
'CONTENT_LENGTH': len(payload),
|
|
|
|
'wsgi.input': payload},
|
|
|
|
)
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(request.read(), b'name=value')
|
2010-10-29 16:39:25 +00:00
|
|
|
|
|
|
|
def test_read_after_value(self):
|
|
|
|
"""
|
|
|
|
Reading from request is allowed after accessing request contents as
|
2011-12-16 23:40:32 +00:00
|
|
|
POST or body.
|
2010-10-29 16:39:25 +00:00
|
|
|
"""
|
2012-10-20 13:53:28 +00:00
|
|
|
payload = FakePayload('name=value')
|
2019-01-02 23:18:19 +00:00
|
|
|
request = WSGIRequest({
|
|
|
|
'REQUEST_METHOD': 'POST',
|
|
|
|
'CONTENT_TYPE': 'application/x-www-form-urlencoded',
|
|
|
|
'CONTENT_LENGTH': len(payload),
|
|
|
|
'wsgi.input': payload,
|
|
|
|
})
|
2012-06-07 16:08:47 +00:00
|
|
|
self.assertEqual(request.POST, {'name': ['value']})
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(request.body, b'name=value')
|
|
|
|
self.assertEqual(request.read(), b'name=value')
|
2010-10-29 16:39:25 +00:00
|
|
|
|
|
|
|
def test_value_after_read(self):
|
|
|
|
"""
|
2011-12-16 23:40:32 +00:00
|
|
|
Construction of POST or body is not allowed after reading
|
2010-10-29 16:39:25 +00:00
|
|
|
from request.
|
|
|
|
"""
|
2012-10-20 13:53:28 +00:00
|
|
|
payload = FakePayload('name=value')
|
2019-01-02 23:18:19 +00:00
|
|
|
request = WSGIRequest({
|
|
|
|
'REQUEST_METHOD': 'POST',
|
|
|
|
'CONTENT_TYPE': 'application/x-www-form-urlencoded',
|
|
|
|
'CONTENT_LENGTH': len(payload),
|
|
|
|
'wsgi.input': payload,
|
|
|
|
})
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(request.read(2), b'na')
|
2016-01-17 11:26:39 +00:00
|
|
|
with self.assertRaises(RawPostDataException):
|
|
|
|
request.body
|
2010-10-29 16:39:25 +00:00
|
|
|
self.assertEqual(request.POST, {})
|
|
|
|
|
2012-11-03 11:54:06 +00:00
|
|
|
def test_non_ascii_POST(self):
|
|
|
|
payload = FakePayload(urlencode({'key': 'España'}))
|
|
|
|
request = WSGIRequest({
|
|
|
|
'REQUEST_METHOD': 'POST',
|
|
|
|
'CONTENT_LENGTH': len(payload),
|
|
|
|
'CONTENT_TYPE': 'application/x-www-form-urlencoded',
|
|
|
|
'wsgi.input': payload,
|
|
|
|
})
|
|
|
|
self.assertEqual(request.POST, {'key': ['España']})
|
|
|
|
|
2012-10-29 19:33:00 +00:00
|
|
|
def test_alternate_charset_POST(self):
|
|
|
|
"""
|
|
|
|
Test a POST with non-utf-8 payload encoding.
|
|
|
|
"""
|
2017-01-26 13:25:15 +00:00
|
|
|
payload = FakePayload(urlencode({'key': 'España'.encode('latin-1')}))
|
2012-10-29 19:33:00 +00:00
|
|
|
request = WSGIRequest({
|
|
|
|
'REQUEST_METHOD': 'POST',
|
|
|
|
'CONTENT_LENGTH': len(payload),
|
|
|
|
'CONTENT_TYPE': 'application/x-www-form-urlencoded; charset=iso-8859-1',
|
|
|
|
'wsgi.input': payload,
|
|
|
|
})
|
|
|
|
self.assertEqual(request.POST, {'key': ['España']})
|
|
|
|
|
2013-05-18 10:26:38 +00:00
|
|
|
def test_body_after_POST_multipart_form_data(self):
|
2011-03-28 16:11:40 +00:00
|
|
|
"""
|
2013-05-18 10:26:38 +00:00
|
|
|
Reading body after parsing multipart/form-data is not allowed
|
2011-03-28 16:11:40 +00:00
|
|
|
"""
|
2015-01-20 14:54:12 +00:00
|
|
|
# Because multipart is used for large amounts of data i.e. file uploads,
|
2011-03-28 16:11:40 +00:00
|
|
|
# we don't want the data held in memory twice, and we don't want to
|
2011-12-16 23:40:32 +00:00
|
|
|
# silence the error by setting body = '' either.
|
2012-10-20 13:53:28 +00:00
|
|
|
payload = FakePayload("\r\n".join([
|
2013-10-19 23:33:10 +00:00
|
|
|
'--boundary',
|
|
|
|
'Content-Disposition: form-data; name="name"',
|
|
|
|
'',
|
|
|
|
'value',
|
|
|
|
'--boundary--'
|
|
|
|
'']))
|
2019-01-02 23:18:19 +00:00
|
|
|
request = WSGIRequest({
|
|
|
|
'REQUEST_METHOD': 'POST',
|
|
|
|
'CONTENT_TYPE': 'multipart/form-data; boundary=boundary',
|
|
|
|
'CONTENT_LENGTH': len(payload),
|
|
|
|
'wsgi.input': payload,
|
|
|
|
})
|
2012-06-07 16:08:47 +00:00
|
|
|
self.assertEqual(request.POST, {'name': ['value']})
|
2016-01-17 11:26:39 +00:00
|
|
|
with self.assertRaises(RawPostDataException):
|
|
|
|
request.body
|
2011-03-28 16:11:40 +00:00
|
|
|
|
2013-05-18 10:26:38 +00:00
|
|
|
def test_body_after_POST_multipart_related(self):
|
|
|
|
"""
|
|
|
|
Reading body after parsing multipart that isn't form-data is allowed
|
|
|
|
"""
|
|
|
|
# Ticket #9054
|
|
|
|
# There are cases in which the multipart data is related instead of
|
|
|
|
# being a binary upload, in which case it should still be accessible
|
|
|
|
# via body.
|
2013-05-18 11:34:08 +00:00
|
|
|
payload_data = b"\r\n".join([
|
2013-10-19 23:33:10 +00:00
|
|
|
b'--boundary',
|
|
|
|
b'Content-ID: id; name="name"',
|
|
|
|
b'',
|
|
|
|
b'value',
|
|
|
|
b'--boundary--'
|
|
|
|
b''])
|
2013-05-18 10:26:38 +00:00
|
|
|
payload = FakePayload(payload_data)
|
2019-01-02 23:18:19 +00:00
|
|
|
request = WSGIRequest({
|
|
|
|
'REQUEST_METHOD': 'POST',
|
|
|
|
'CONTENT_TYPE': 'multipart/related; boundary=boundary',
|
|
|
|
'CONTENT_LENGTH': len(payload),
|
|
|
|
'wsgi.input': payload,
|
|
|
|
})
|
2013-05-18 10:26:38 +00:00
|
|
|
self.assertEqual(request.POST, {})
|
|
|
|
self.assertEqual(request.body, payload_data)
|
|
|
|
|
2011-06-10 08:39:38 +00:00
|
|
|
def test_POST_multipart_with_content_length_zero(self):
|
|
|
|
"""
|
|
|
|
Multipart POST requests with Content-Length >= 0 are valid and need to be handled.
|
|
|
|
"""
|
|
|
|
# According to:
|
2018-09-26 06:48:47 +00:00
|
|
|
# https://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.13
|
2011-06-10 08:39:38 +00:00
|
|
|
# Every request.POST with Content-Length >= 0 is a valid request,
|
|
|
|
# this test ensures that we handle Content-Length == 0.
|
2012-10-20 13:53:28 +00:00
|
|
|
payload = FakePayload("\r\n".join([
|
2013-10-19 23:33:10 +00:00
|
|
|
'--boundary',
|
|
|
|
'Content-Disposition: form-data; name="name"',
|
|
|
|
'',
|
|
|
|
'value',
|
|
|
|
'--boundary--'
|
|
|
|
'']))
|
2019-01-02 23:18:19 +00:00
|
|
|
request = WSGIRequest({
|
|
|
|
'REQUEST_METHOD': 'POST',
|
|
|
|
'CONTENT_TYPE': 'multipart/form-data; boundary=boundary',
|
|
|
|
'CONTENT_LENGTH': 0,
|
|
|
|
'wsgi.input': payload,
|
|
|
|
})
|
2011-06-10 08:39:38 +00:00
|
|
|
self.assertEqual(request.POST, {})
|
|
|
|
|
2012-10-20 12:33:57 +00:00
|
|
|
def test_POST_binary_only(self):
|
|
|
|
payload = b'\r\n\x01\x00\x00\x00ab\x00\x00\xcd\xcc,@'
|
2019-01-02 23:18:19 +00:00
|
|
|
environ = {
|
|
|
|
'REQUEST_METHOD': 'POST',
|
|
|
|
'CONTENT_TYPE': 'application/octet-stream',
|
|
|
|
'CONTENT_LENGTH': len(payload),
|
|
|
|
'wsgi.input': BytesIO(payload),
|
|
|
|
}
|
2012-10-20 12:33:57 +00:00
|
|
|
request = WSGIRequest(environ)
|
|
|
|
self.assertEqual(request.POST, {})
|
|
|
|
self.assertEqual(request.FILES, {})
|
|
|
|
self.assertEqual(request.body, payload)
|
|
|
|
|
|
|
|
# Same test without specifying content-type
|
|
|
|
environ.update({'CONTENT_TYPE': '', 'wsgi.input': BytesIO(payload)})
|
|
|
|
request = WSGIRequest(environ)
|
|
|
|
self.assertEqual(request.POST, {})
|
|
|
|
self.assertEqual(request.FILES, {})
|
|
|
|
self.assertEqual(request.body, payload)
|
|
|
|
|
2010-10-29 16:39:25 +00:00
|
|
|
def test_read_by_lines(self):
|
2012-10-20 13:53:28 +00:00
|
|
|
payload = FakePayload('name=value')
|
2019-01-02 23:18:19 +00:00
|
|
|
request = WSGIRequest({
|
|
|
|
'REQUEST_METHOD': 'POST',
|
|
|
|
'CONTENT_TYPE': 'application/x-www-form-urlencoded',
|
|
|
|
'CONTENT_LENGTH': len(payload),
|
|
|
|
'wsgi.input': payload,
|
|
|
|
})
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(list(request), [b'name=value'])
|
2011-03-28 16:11:40 +00:00
|
|
|
|
2011-12-16 23:40:32 +00:00
|
|
|
def test_POST_after_body_read(self):
|
2011-03-28 16:11:40 +00:00
|
|
|
"""
|
2011-12-16 23:40:32 +00:00
|
|
|
POST should be populated even if body is read first
|
2011-03-28 16:11:40 +00:00
|
|
|
"""
|
2012-10-20 13:53:28 +00:00
|
|
|
payload = FakePayload('name=value')
|
2019-01-02 23:18:19 +00:00
|
|
|
request = WSGIRequest({
|
|
|
|
'REQUEST_METHOD': 'POST',
|
|
|
|
'CONTENT_TYPE': 'application/x-www-form-urlencoded',
|
|
|
|
'CONTENT_LENGTH': len(payload),
|
|
|
|
'wsgi.input': payload,
|
|
|
|
})
|
2013-10-19 12:31:38 +00:00
|
|
|
request.body # evaluate
|
2012-06-07 16:08:47 +00:00
|
|
|
self.assertEqual(request.POST, {'name': ['value']})
|
2011-03-28 16:11:40 +00:00
|
|
|
|
2011-12-16 23:40:32 +00:00
|
|
|
def test_POST_after_body_read_and_stream_read(self):
|
2011-03-28 16:11:40 +00:00
|
|
|
"""
|
2011-12-16 23:40:32 +00:00
|
|
|
POST should be populated even if body is read first, and then
|
2011-03-28 16:11:40 +00:00
|
|
|
the stream is read second.
|
|
|
|
"""
|
2012-10-20 13:53:28 +00:00
|
|
|
payload = FakePayload('name=value')
|
2019-01-02 23:18:19 +00:00
|
|
|
request = WSGIRequest({
|
|
|
|
'REQUEST_METHOD': 'POST',
|
|
|
|
'CONTENT_TYPE': 'application/x-www-form-urlencoded',
|
|
|
|
'CONTENT_LENGTH': len(payload),
|
|
|
|
'wsgi.input': payload,
|
|
|
|
})
|
2013-10-19 12:31:38 +00:00
|
|
|
request.body # evaluate
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(request.read(1), b'n')
|
2012-06-07 16:08:47 +00:00
|
|
|
self.assertEqual(request.POST, {'name': ['value']})
|
2011-03-28 16:11:40 +00:00
|
|
|
|
2011-12-16 23:40:32 +00:00
|
|
|
def test_POST_after_body_read_and_stream_read_multipart(self):
|
2011-03-28 16:11:40 +00:00
|
|
|
"""
|
2011-12-16 23:40:32 +00:00
|
|
|
POST should be populated even if body is read first, and then
|
2011-03-28 16:11:40 +00:00
|
|
|
the stream is read second. Using multipart/form-data instead of urlencoded.
|
|
|
|
"""
|
2012-10-20 13:53:28 +00:00
|
|
|
payload = FakePayload("\r\n".join([
|
2013-10-19 23:33:10 +00:00
|
|
|
'--boundary',
|
|
|
|
'Content-Disposition: form-data; name="name"',
|
|
|
|
'',
|
|
|
|
'value',
|
|
|
|
'--boundary--'
|
|
|
|
'']))
|
2019-01-02 23:18:19 +00:00
|
|
|
request = WSGIRequest({
|
|
|
|
'REQUEST_METHOD': 'POST',
|
|
|
|
'CONTENT_TYPE': 'multipart/form-data; boundary=boundary',
|
|
|
|
'CONTENT_LENGTH': len(payload),
|
|
|
|
'wsgi.input': payload,
|
|
|
|
})
|
2013-10-19 12:31:38 +00:00
|
|
|
request.body # evaluate
|
2011-03-28 16:11:40 +00:00
|
|
|
# Consume enough data to mess up the parsing:
|
2012-05-19 15:43:34 +00:00
|
|
|
self.assertEqual(request.read(13), b'--boundary\r\nC')
|
2012-06-07 16:08:47 +00:00
|
|
|
self.assertEqual(request.POST, {'name': ['value']})
|
2011-12-16 23:40:32 +00:00
|
|
|
|
2019-08-23 08:46:43 +00:00
|
|
|
def test_POST_immutable_for_multipart(self):
|
2016-11-16 13:22:38 +00:00
|
|
|
"""
|
|
|
|
MultiPartParser.parse() leaves request.POST immutable.
|
|
|
|
"""
|
|
|
|
payload = FakePayload("\r\n".join([
|
|
|
|
'--boundary',
|
|
|
|
'Content-Disposition: form-data; name="name"',
|
|
|
|
'',
|
|
|
|
'value',
|
|
|
|
'--boundary--',
|
|
|
|
]))
|
|
|
|
request = WSGIRequest({
|
|
|
|
'REQUEST_METHOD': 'POST',
|
|
|
|
'CONTENT_TYPE': 'multipart/form-data; boundary=boundary',
|
|
|
|
'CONTENT_LENGTH': len(payload),
|
|
|
|
'wsgi.input': payload,
|
|
|
|
})
|
|
|
|
self.assertFalse(request.POST._mutable)
|
|
|
|
|
2019-03-01 17:53:18 +00:00
|
|
|
def test_multipart_without_boundary(self):
|
|
|
|
request = WSGIRequest({
|
|
|
|
'REQUEST_METHOD': 'POST',
|
|
|
|
'CONTENT_TYPE': 'multipart/form-data;',
|
|
|
|
'CONTENT_LENGTH': 0,
|
|
|
|
'wsgi.input': FakePayload(),
|
|
|
|
})
|
|
|
|
with self.assertRaisesMessage(MultiPartParserError, 'Invalid boundary in multipart: None'):
|
|
|
|
request.POST
|
|
|
|
|
2019-03-01 18:47:09 +00:00
|
|
|
def test_multipart_non_ascii_content_type(self):
|
|
|
|
request = WSGIRequest({
|
|
|
|
'REQUEST_METHOD': 'POST',
|
|
|
|
'CONTENT_TYPE': 'multipart/form-data; boundary = \xe0',
|
|
|
|
'CONTENT_LENGTH': 0,
|
|
|
|
'wsgi.input': FakePayload(),
|
|
|
|
})
|
|
|
|
msg = 'Invalid non-ASCII Content-Type in multipart: multipart/form-data; boundary = à'
|
|
|
|
with self.assertRaisesMessage(MultiPartParserError, msg):
|
|
|
|
request.POST
|
|
|
|
|
2012-02-10 22:51:07 +00:00
|
|
|
def test_POST_connection_error(self):
|
|
|
|
"""
|
|
|
|
If wsgi.input.read() raises an exception while trying to read() the
|
2019-01-28 15:01:35 +00:00
|
|
|
POST, the exception is identifiable (not a generic OSError).
|
2012-02-10 22:51:07 +00:00
|
|
|
"""
|
2012-08-11 09:11:20 +00:00
|
|
|
class ExplodingBytesIO(BytesIO):
|
2012-02-10 22:51:07 +00:00
|
|
|
def read(self, len=0):
|
2019-01-28 15:01:35 +00:00
|
|
|
raise OSError('kaboom!')
|
2012-02-10 22:51:07 +00:00
|
|
|
|
2012-05-19 15:43:34 +00:00
|
|
|
payload = b'name=value'
|
2019-01-02 23:18:19 +00:00
|
|
|
request = WSGIRequest({
|
|
|
|
'REQUEST_METHOD': 'POST',
|
|
|
|
'CONTENT_TYPE': 'application/x-www-form-urlencoded',
|
|
|
|
'CONTENT_LENGTH': len(payload),
|
|
|
|
'wsgi.input': ExplodingBytesIO(payload),
|
|
|
|
})
|
2012-12-24 22:20:38 +00:00
|
|
|
with self.assertRaises(UnreadablePostError):
|
|
|
|
request.body
|
2013-02-05 21:52:29 +00:00
|
|
|
|
2016-08-30 20:26:28 +00:00
|
|
|
def test_set_encoding_clears_POST(self):
|
|
|
|
payload = FakePayload('name=Hello Günter')
|
|
|
|
request = WSGIRequest({
|
|
|
|
'REQUEST_METHOD': 'POST',
|
|
|
|
'CONTENT_TYPE': 'application/x-www-form-urlencoded',
|
|
|
|
'CONTENT_LENGTH': len(payload),
|
|
|
|
'wsgi.input': payload,
|
|
|
|
})
|
|
|
|
self.assertEqual(request.POST, {'name': ['Hello Günter']})
|
|
|
|
request.encoding = 'iso-8859-16'
|
|
|
|
self.assertEqual(request.POST, {'name': ['Hello GĂŒnter']})
|
|
|
|
|
2016-11-17 17:46:42 +00:00
|
|
|
def test_set_encoding_clears_GET(self):
|
|
|
|
request = WSGIRequest({
|
|
|
|
'REQUEST_METHOD': 'GET',
|
|
|
|
'wsgi.input': '',
|
2016-12-01 10:38:01 +00:00
|
|
|
'QUERY_STRING': 'name=Hello%20G%C3%BCnter',
|
2016-11-17 17:46:42 +00:00
|
|
|
})
|
|
|
|
self.assertEqual(request.GET, {'name': ['Hello Günter']})
|
|
|
|
request.encoding = 'iso-8859-16'
|
|
|
|
self.assertEqual(request.GET, {'name': ['Hello G\u0102\u0152nter']})
|
|
|
|
|
2013-06-01 08:26:46 +00:00
|
|
|
def test_FILES_connection_error(self):
|
|
|
|
"""
|
|
|
|
If wsgi.input.read() raises an exception while trying to read() the
|
2019-01-28 15:01:35 +00:00
|
|
|
FILES, the exception is identifiable (not a generic OSError).
|
2013-06-01 08:26:46 +00:00
|
|
|
"""
|
|
|
|
class ExplodingBytesIO(BytesIO):
|
|
|
|
def read(self, len=0):
|
2019-01-28 15:01:35 +00:00
|
|
|
raise OSError('kaboom!')
|
2013-06-01 08:26:46 +00:00
|
|
|
|
|
|
|
payload = b'x'
|
2019-01-02 23:18:19 +00:00
|
|
|
request = WSGIRequest({
|
|
|
|
'REQUEST_METHOD': 'POST',
|
|
|
|
'CONTENT_TYPE': 'multipart/form-data; boundary=foo_',
|
|
|
|
'CONTENT_LENGTH': len(payload),
|
|
|
|
'wsgi.input': ExplodingBytesIO(payload),
|
|
|
|
})
|
2013-06-01 08:26:46 +00:00
|
|
|
with self.assertRaises(UnreadablePostError):
|
|
|
|
request.FILES
|
|
|
|
|
2015-09-03 18:52:49 +00:00
|
|
|
@override_settings(ALLOWED_HOSTS=['example.com'])
|
|
|
|
def test_get_raw_uri(self):
|
|
|
|
factory = RequestFactory(HTTP_HOST='evil.com')
|
|
|
|
request = factory.get('////absolute-uri')
|
|
|
|
self.assertEqual(request.get_raw_uri(), 'http://evil.com//absolute-uri')
|
|
|
|
|
|
|
|
request = factory.get('/?foo=bar')
|
|
|
|
self.assertEqual(request.get_raw_uri(), 'http://evil.com/?foo=bar')
|
|
|
|
|
|
|
|
request = factory.get('/path/with:colons')
|
|
|
|
self.assertEqual(request.get_raw_uri(), 'http://evil.com/path/with:colons')
|
|
|
|
|
2013-02-28 16:05:25 +00:00
|
|
|
|
2013-07-13 08:16:40 +00:00
|
|
|
class HostValidationTests(SimpleTestCase):
|
|
|
|
poisoned_hosts = [
|
|
|
|
'example.com@evil.tld',
|
|
|
|
'example.com:dr.frankenstein@evil.tld',
|
|
|
|
'example.com:dr.frankenstein@evil.tld:80',
|
|
|
|
'example.com:80/badpath',
|
|
|
|
'example.com: recovermypassword.com',
|
|
|
|
]
|
|
|
|
|
|
|
|
@override_settings(
|
|
|
|
USE_X_FORWARDED_HOST=False,
|
|
|
|
ALLOWED_HOSTS=[
|
|
|
|
'forward.com', 'example.com', 'internal.com', '12.34.56.78',
|
|
|
|
'[2001:19f0:feee::dead:beef:cafe]', 'xn--4ca9at.com',
|
2016-08-11 14:41:10 +00:00
|
|
|
'.multitenant.com', 'INSENSITIVE.com', '[::ffff:169.254.169.254]',
|
2013-10-18 09:02:43 +00:00
|
|
|
])
|
2013-07-13 08:16:40 +00:00
|
|
|
def test_http_get_host(self):
|
|
|
|
# Check if X_FORWARDED_HOST is provided.
|
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {
|
|
|
|
'HTTP_X_FORWARDED_HOST': 'forward.com',
|
|
|
|
'HTTP_HOST': 'example.com',
|
|
|
|
'SERVER_NAME': 'internal.com',
|
|
|
|
'SERVER_PORT': 80,
|
|
|
|
}
|
|
|
|
# X_FORWARDED_HOST is ignored.
|
|
|
|
self.assertEqual(request.get_host(), 'example.com')
|
|
|
|
|
|
|
|
# Check if X_FORWARDED_HOST isn't provided.
|
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {
|
|
|
|
'HTTP_HOST': 'example.com',
|
|
|
|
'SERVER_NAME': 'internal.com',
|
|
|
|
'SERVER_PORT': 80,
|
|
|
|
}
|
|
|
|
self.assertEqual(request.get_host(), 'example.com')
|
|
|
|
|
|
|
|
# Check if HTTP_HOST isn't provided.
|
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {
|
|
|
|
'SERVER_NAME': 'internal.com',
|
|
|
|
'SERVER_PORT': 80,
|
|
|
|
}
|
|
|
|
self.assertEqual(request.get_host(), 'internal.com')
|
|
|
|
|
|
|
|
# Check if HTTP_HOST isn't provided, and we're on a nonstandard port
|
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {
|
|
|
|
'SERVER_NAME': 'internal.com',
|
|
|
|
'SERVER_PORT': 8042,
|
|
|
|
}
|
|
|
|
self.assertEqual(request.get_host(), 'internal.com:8042')
|
|
|
|
|
|
|
|
legit_hosts = [
|
|
|
|
'example.com',
|
|
|
|
'example.com:80',
|
|
|
|
'12.34.56.78',
|
|
|
|
'12.34.56.78:443',
|
|
|
|
'[2001:19f0:feee::dead:beef:cafe]',
|
|
|
|
'[2001:19f0:feee::dead:beef:cafe]:8080',
|
2015-12-02 23:55:50 +00:00
|
|
|
'xn--4ca9at.com', # Punycode for öäü.com
|
2013-07-13 08:16:40 +00:00
|
|
|
'anything.multitenant.com',
|
|
|
|
'multitenant.com',
|
|
|
|
'insensitive.com',
|
2013-10-24 17:34:40 +00:00
|
|
|
'example.com.',
|
|
|
|
'example.com.:80',
|
2016-08-11 14:41:10 +00:00
|
|
|
'[::ffff:169.254.169.254]',
|
2013-07-13 08:16:40 +00:00
|
|
|
]
|
|
|
|
|
|
|
|
for host in legit_hosts:
|
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {
|
|
|
|
'HTTP_HOST': host,
|
|
|
|
}
|
|
|
|
request.get_host()
|
|
|
|
|
|
|
|
# Poisoned host headers are rejected as suspicious
|
2013-10-24 17:34:40 +00:00
|
|
|
for host in chain(self.poisoned_hosts, ['other.com', 'example.com..']):
|
2017-05-25 12:19:01 +00:00
|
|
|
with self.assertRaises(DisallowedHost):
|
2013-07-13 08:16:40 +00:00
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {
|
|
|
|
'HTTP_HOST': host,
|
|
|
|
}
|
|
|
|
request.get_host()
|
|
|
|
|
|
|
|
@override_settings(USE_X_FORWARDED_HOST=True, ALLOWED_HOSTS=['*'])
|
|
|
|
def test_http_get_host_with_x_forwarded_host(self):
|
|
|
|
# Check if X_FORWARDED_HOST is provided.
|
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {
|
|
|
|
'HTTP_X_FORWARDED_HOST': 'forward.com',
|
|
|
|
'HTTP_HOST': 'example.com',
|
|
|
|
'SERVER_NAME': 'internal.com',
|
|
|
|
'SERVER_PORT': 80,
|
|
|
|
}
|
|
|
|
# X_FORWARDED_HOST is obeyed.
|
|
|
|
self.assertEqual(request.get_host(), 'forward.com')
|
|
|
|
|
|
|
|
# Check if X_FORWARDED_HOST isn't provided.
|
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {
|
|
|
|
'HTTP_HOST': 'example.com',
|
|
|
|
'SERVER_NAME': 'internal.com',
|
|
|
|
'SERVER_PORT': 80,
|
|
|
|
}
|
|
|
|
self.assertEqual(request.get_host(), 'example.com')
|
|
|
|
|
|
|
|
# Check if HTTP_HOST isn't provided.
|
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {
|
|
|
|
'SERVER_NAME': 'internal.com',
|
|
|
|
'SERVER_PORT': 80,
|
|
|
|
}
|
|
|
|
self.assertEqual(request.get_host(), 'internal.com')
|
|
|
|
|
|
|
|
# Check if HTTP_HOST isn't provided, and we're on a nonstandard port
|
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {
|
|
|
|
'SERVER_NAME': 'internal.com',
|
|
|
|
'SERVER_PORT': 8042,
|
|
|
|
}
|
|
|
|
self.assertEqual(request.get_host(), 'internal.com:8042')
|
|
|
|
|
|
|
|
# Poisoned host headers are rejected as suspicious
|
|
|
|
legit_hosts = [
|
|
|
|
'example.com',
|
|
|
|
'example.com:80',
|
|
|
|
'12.34.56.78',
|
|
|
|
'12.34.56.78:443',
|
|
|
|
'[2001:19f0:feee::dead:beef:cafe]',
|
|
|
|
'[2001:19f0:feee::dead:beef:cafe]:8080',
|
2015-12-02 23:55:50 +00:00
|
|
|
'xn--4ca9at.com', # Punycode for öäü.com
|
2013-07-13 08:16:40 +00:00
|
|
|
]
|
|
|
|
|
|
|
|
for host in legit_hosts:
|
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {
|
|
|
|
'HTTP_HOST': host,
|
|
|
|
}
|
|
|
|
request.get_host()
|
|
|
|
|
|
|
|
for host in self.poisoned_hosts:
|
2017-05-25 12:19:01 +00:00
|
|
|
with self.assertRaises(DisallowedHost):
|
2013-07-13 08:16:40 +00:00
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {
|
|
|
|
'HTTP_HOST': host,
|
|
|
|
}
|
|
|
|
request.get_host()
|
|
|
|
|
2015-08-02 23:56:54 +00:00
|
|
|
@override_settings(USE_X_FORWARDED_PORT=False)
|
|
|
|
def test_get_port(self):
|
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {
|
|
|
|
'SERVER_PORT': '8080',
|
|
|
|
'HTTP_X_FORWARDED_PORT': '80',
|
|
|
|
}
|
|
|
|
# Shouldn't use the X-Forwarded-Port header
|
|
|
|
self.assertEqual(request.get_port(), '8080')
|
|
|
|
|
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {
|
|
|
|
'SERVER_PORT': '8080',
|
|
|
|
}
|
|
|
|
self.assertEqual(request.get_port(), '8080')
|
|
|
|
|
|
|
|
@override_settings(USE_X_FORWARDED_PORT=True)
|
|
|
|
def test_get_port_with_x_forwarded_port(self):
|
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {
|
|
|
|
'SERVER_PORT': '8080',
|
|
|
|
'HTTP_X_FORWARDED_PORT': '80',
|
|
|
|
}
|
|
|
|
# Should use the X-Forwarded-Port header
|
|
|
|
self.assertEqual(request.get_port(), '80')
|
|
|
|
|
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {
|
|
|
|
'SERVER_PORT': '8080',
|
|
|
|
}
|
|
|
|
self.assertEqual(request.get_port(), '8080')
|
|
|
|
|
2013-07-13 08:16:40 +00:00
|
|
|
@override_settings(DEBUG=True, ALLOWED_HOSTS=[])
|
2016-10-17 16:14:49 +00:00
|
|
|
def test_host_validation_in_debug_mode(self):
|
|
|
|
"""
|
|
|
|
If ALLOWED_HOSTS is empty and DEBUG is True, variants of localhost are
|
|
|
|
allowed.
|
|
|
|
"""
|
|
|
|
valid_hosts = ['localhost', '127.0.0.1', '[::1]']
|
|
|
|
for host in valid_hosts:
|
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {'HTTP_HOST': host}
|
|
|
|
self.assertEqual(request.get_host(), host)
|
2013-07-13 08:16:40 +00:00
|
|
|
|
2017-05-25 12:19:01 +00:00
|
|
|
# Other hostnames raise a DisallowedHost.
|
|
|
|
with self.assertRaises(DisallowedHost):
|
2016-10-17 16:14:49 +00:00
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {'HTTP_HOST': 'example.com'}
|
|
|
|
request.get_host()
|
2013-07-13 08:16:40 +00:00
|
|
|
|
|
|
|
@override_settings(ALLOWED_HOSTS=[])
|
|
|
|
def test_get_host_suggestion_of_allowed_host(self):
|
|
|
|
"""get_host() makes helpful suggestions if a valid-looking host is not in ALLOWED_HOSTS."""
|
|
|
|
msg_invalid_host = "Invalid HTTP_HOST header: %r."
|
2014-07-06 00:20:19 +00:00
|
|
|
msg_suggestion = msg_invalid_host + " You may need to add %r to ALLOWED_HOSTS."
|
|
|
|
msg_suggestion2 = msg_invalid_host + " The domain name provided is not valid according to RFC 1034/1035"
|
2013-07-13 08:16:40 +00:00
|
|
|
|
2013-11-02 21:02:56 +00:00
|
|
|
for host in [ # Valid-looking hosts
|
2013-07-13 08:16:40 +00:00
|
|
|
'example.com',
|
|
|
|
'12.34.56.78',
|
|
|
|
'[2001:19f0:feee::dead:beef:cafe]',
|
2015-12-02 23:55:50 +00:00
|
|
|
'xn--4ca9at.com', # Punycode for öäü.com
|
2013-07-13 08:16:40 +00:00
|
|
|
]:
|
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {'HTTP_HOST': host}
|
2017-05-25 12:19:01 +00:00
|
|
|
with self.assertRaisesMessage(DisallowedHost, msg_suggestion % (host, host)):
|
2016-01-04 08:50:08 +00:00
|
|
|
request.get_host()
|
2013-07-13 08:16:40 +00:00
|
|
|
|
2013-11-02 21:02:56 +00:00
|
|
|
for domain, port in [ # Valid-looking hosts with a port number
|
2013-07-13 08:16:40 +00:00
|
|
|
('example.com', 80),
|
|
|
|
('12.34.56.78', 443),
|
|
|
|
('[2001:19f0:feee::dead:beef:cafe]', 8080),
|
|
|
|
]:
|
|
|
|
host = '%s:%s' % (domain, port)
|
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {'HTTP_HOST': host}
|
2017-05-25 12:19:01 +00:00
|
|
|
with self.assertRaisesMessage(DisallowedHost, msg_suggestion % (host, domain)):
|
2016-01-04 08:50:08 +00:00
|
|
|
request.get_host()
|
2013-07-13 08:16:40 +00:00
|
|
|
|
|
|
|
for host in self.poisoned_hosts:
|
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {'HTTP_HOST': host}
|
2017-05-25 12:19:01 +00:00
|
|
|
with self.assertRaisesMessage(DisallowedHost, msg_invalid_host % host):
|
2016-01-04 08:50:08 +00:00
|
|
|
request.get_host()
|
2013-07-13 08:16:40 +00:00
|
|
|
|
2013-03-27 16:37:08 +00:00
|
|
|
request = HttpRequest()
|
|
|
|
request.META = {'HTTP_HOST': "invalid_hostname.com"}
|
2017-05-25 12:19:01 +00:00
|
|
|
with self.assertRaisesMessage(DisallowedHost, msg_suggestion2 % "invalid_hostname.com"):
|
2016-01-04 08:50:08 +00:00
|
|
|
request.get_host()
|
2013-11-03 23:34:11 +00:00
|
|
|
|
2016-11-29 23:17:10 +00:00
|
|
|
def test_split_domain_port_removes_trailing_dot(self):
|
|
|
|
domain, port = split_domain_port('example.com.:8080')
|
|
|
|
self.assertEqual(domain, 'example.com')
|
|
|
|
self.assertEqual(port, '8080')
|
|
|
|
|
2013-11-03 23:34:11 +00:00
|
|
|
|
2018-01-10 15:56:02 +00:00
|
|
|
class BuildAbsoluteURITests(SimpleTestCase):
|
|
|
|
factory = RequestFactory()
|
2013-11-03 23:34:11 +00:00
|
|
|
|
2018-01-10 15:56:02 +00:00
|
|
|
def test_absolute_url(self):
|
|
|
|
request = HttpRequest()
|
|
|
|
url = 'https://www.example.com/asdf'
|
|
|
|
self.assertEqual(request.build_absolute_uri(location=url), url)
|
2013-11-03 23:34:11 +00:00
|
|
|
|
2018-01-10 15:56:02 +00:00
|
|
|
def test_host_retrieval(self):
|
|
|
|
request = HttpRequest()
|
|
|
|
request.get_host = lambda: 'www.example.com'
|
|
|
|
request.path = ''
|
2013-11-03 23:34:11 +00:00
|
|
|
self.assertEqual(
|
2018-01-10 15:56:02 +00:00
|
|
|
request.build_absolute_uri(location='/path/with:colons'),
|
|
|
|
'http://www.example.com/path/with:colons'
|
2013-11-03 23:34:11 +00:00
|
|
|
)
|
|
|
|
|
2018-01-10 15:56:02 +00:00
|
|
|
def test_request_path_begins_with_two_slashes(self):
|
|
|
|
# //// creates a request with a path beginning with //
|
2013-11-03 23:34:11 +00:00
|
|
|
request = self.factory.get('////absolute-uri')
|
2018-01-10 15:56:02 +00:00
|
|
|
tests = (
|
|
|
|
# location isn't provided
|
|
|
|
(None, 'http://testserver//absolute-uri'),
|
|
|
|
# An absolute URL
|
|
|
|
('http://example.com/?foo=bar', 'http://example.com/?foo=bar'),
|
|
|
|
# A schema-relative URL
|
|
|
|
('//example.com/?foo=bar', 'http://example.com/?foo=bar'),
|
2018-01-10 15:59:10 +00:00
|
|
|
# Relative URLs
|
2018-01-10 15:56:02 +00:00
|
|
|
('/foo/bar/', 'http://testserver/foo/bar/'),
|
2018-01-10 15:59:10 +00:00
|
|
|
('/foo/./bar/', 'http://testserver/foo/bar/'),
|
|
|
|
('/foo/../bar/', 'http://testserver/bar/'),
|
|
|
|
('///foo/bar/', 'http://testserver/foo/bar/'),
|
2013-11-03 23:34:11 +00:00
|
|
|
)
|
2018-01-10 15:56:02 +00:00
|
|
|
for location, expected_url in tests:
|
|
|
|
with self.subTest(location=location):
|
|
|
|
self.assertEqual(request.build_absolute_uri(location=location), expected_url)
|
2018-05-04 23:37:01 +00:00
|
|
|
|
|
|
|
|
|
|
|
class RequestHeadersTests(SimpleTestCase):
|
|
|
|
ENVIRON = {
|
|
|
|
# Non-headers are ignored.
|
|
|
|
'PATH_INFO': '/somepath/',
|
|
|
|
'REQUEST_METHOD': 'get',
|
|
|
|
'wsgi.input': BytesIO(b''),
|
|
|
|
'SERVER_NAME': 'internal.com',
|
|
|
|
'SERVER_PORT': 80,
|
|
|
|
# These non-HTTP prefixed headers are included.
|
|
|
|
'CONTENT_TYPE': 'text/html',
|
|
|
|
'CONTENT_LENGTH': '100',
|
|
|
|
# All HTTP-prefixed headers are included.
|
|
|
|
'HTTP_ACCEPT': '*',
|
|
|
|
'HTTP_HOST': 'example.com',
|
|
|
|
'HTTP_USER_AGENT': 'python-requests/1.2.0',
|
|
|
|
}
|
|
|
|
|
|
|
|
def test_base_request_headers(self):
|
|
|
|
request = HttpRequest()
|
|
|
|
request.META = self.ENVIRON
|
|
|
|
self.assertEqual(dict(request.headers), {
|
|
|
|
'Content-Type': 'text/html',
|
|
|
|
'Content-Length': '100',
|
|
|
|
'Accept': '*',
|
|
|
|
'Host': 'example.com',
|
|
|
|
'User-Agent': 'python-requests/1.2.0',
|
|
|
|
})
|
|
|
|
|
|
|
|
def test_wsgi_request_headers(self):
|
|
|
|
request = WSGIRequest(self.ENVIRON)
|
|
|
|
self.assertEqual(dict(request.headers), {
|
|
|
|
'Content-Type': 'text/html',
|
|
|
|
'Content-Length': '100',
|
|
|
|
'Accept': '*',
|
|
|
|
'Host': 'example.com',
|
|
|
|
'User-Agent': 'python-requests/1.2.0',
|
|
|
|
})
|
|
|
|
|
|
|
|
def test_wsgi_request_headers_getitem(self):
|
|
|
|
request = WSGIRequest(self.ENVIRON)
|
|
|
|
self.assertEqual(request.headers['User-Agent'], 'python-requests/1.2.0')
|
|
|
|
self.assertEqual(request.headers['user-agent'], 'python-requests/1.2.0')
|
2019-05-09 14:26:52 +00:00
|
|
|
self.assertEqual(request.headers['user_agent'], 'python-requests/1.2.0')
|
2018-05-04 23:37:01 +00:00
|
|
|
self.assertEqual(request.headers['Content-Type'], 'text/html')
|
|
|
|
self.assertEqual(request.headers['Content-Length'], '100')
|
|
|
|
|
|
|
|
def test_wsgi_request_headers_get(self):
|
|
|
|
request = WSGIRequest(self.ENVIRON)
|
|
|
|
self.assertEqual(request.headers.get('User-Agent'), 'python-requests/1.2.0')
|
|
|
|
self.assertEqual(request.headers.get('user-agent'), 'python-requests/1.2.0')
|
|
|
|
self.assertEqual(request.headers.get('Content-Type'), 'text/html')
|
|
|
|
self.assertEqual(request.headers.get('Content-Length'), '100')
|
|
|
|
|
|
|
|
|
|
|
|
class HttpHeadersTests(SimpleTestCase):
|
|
|
|
def test_basic(self):
|
|
|
|
environ = {
|
|
|
|
'CONTENT_TYPE': 'text/html',
|
|
|
|
'CONTENT_LENGTH': '100',
|
|
|
|
'HTTP_HOST': 'example.com',
|
|
|
|
}
|
|
|
|
headers = HttpHeaders(environ)
|
|
|
|
self.assertEqual(sorted(headers), ['Content-Length', 'Content-Type', 'Host'])
|
|
|
|
self.assertEqual(headers, {
|
|
|
|
'Content-Type': 'text/html',
|
|
|
|
'Content-Length': '100',
|
|
|
|
'Host': 'example.com',
|
|
|
|
})
|
|
|
|
|
|
|
|
def test_parse_header_name(self):
|
|
|
|
tests = (
|
|
|
|
('PATH_INFO', None),
|
|
|
|
('HTTP_ACCEPT', 'Accept'),
|
|
|
|
('HTTP_USER_AGENT', 'User-Agent'),
|
|
|
|
('HTTP_X_FORWARDED_PROTO', 'X-Forwarded-Proto'),
|
|
|
|
('CONTENT_TYPE', 'Content-Type'),
|
|
|
|
('CONTENT_LENGTH', 'Content-Length'),
|
|
|
|
)
|
|
|
|
for header, expected in tests:
|
|
|
|
with self.subTest(header=header):
|
|
|
|
self.assertEqual(HttpHeaders.parse_header_name(header), expected)
|