Greeter

{{ self.order_link('name', 'Name') }}	{{ self.order_link('map', 'Map') }}	{{ self.order_link('gametype', 'Gametype') }}	{{ self.order_link('players', 'Players') }}	{{ self.order_link('progression', 'Progression') }}
{{ server.name }}	{{ server.map }}	{{ server.gametype }}	{{ server.player_count }} / {{ server.max_players }}	{{ '%d%%' % server.progression if server.progression >= 0 else '?' }}

Date	Change Note		Actions
${format_datetime(revision.timestamp)}	${revision.change_note}	+ + +	+ show + \| + revert + +

Date	Page	Change Note
${format_datetime(entry.timestamp)}	${entry.title}	${entry.change_note}

Python Version +	%(python_version)s +
Platform +	%(platform)s [%(os)s] +
API Version +	%(api_version)s +
Byteorder +	%(byteorder)s +
Werkzeug Version +	%(werkzeug_version)s +

' in data + assert 'raise KeyError("outer")' in data + + +def test_get_machine_id(): + rv = get_machine_id() + assert isinstance(rv, bytes) + + +@pytest.mark.filterwarnings("ignore::pytest.PytestUnraisableExceptionWarning") +@pytest.mark.parametrize("crash", (True, False)) +@pytest.mark.dev_server +def test_basic(dev_server, crash): + c = dev_server(use_debugger=True) + r = c.request("/crash" if crash else "") + assert r.status == (500 if crash else 200) + + if crash: + assert b"The debugger caught an exception in your WSGI application" in r.data + else: + assert r.json["PATH_INFO"] == "/" + + +def test_console_closure_variables(monkeypatch): + # restore the original display hook + monkeypatch.setattr(sys, "displayhook", console._displayhook) + c = console.Console() + c.eval("y = 5") + c.eval("x = lambda: y") + ret = c.eval("x()") + assert ret == ">>> x()\n5\n" + + +@pytest.mark.timeout(2) +def test_chained_exception_cycle(): + try: + try: + raise ValueError() + except ValueError: + raise TypeError() # noqa: B904 + except TypeError as e: + # create a cycle and make it available outside the except block + e.__context__.__context__ = error = e + + # if cycles aren't broken, this will time out + tb = DebugTraceback(error) + assert len(tb.all_tracebacks) == 2 + + +def test_exception_without_traceback(): + try: + raise Exception("msg1") + except Exception as e: + # filter_hidden_frames should skip this since it has no traceback + e.__context__ = Exception("msg2") + DebugTraceback(e) diff --git a/tests/test_exceptions.py b/tests/test_exceptions.py new file mode 100644 index 0000000..d8fed96 --- /dev/null +++ b/tests/test_exceptions.py @@ -0,0 +1,172 @@ +from datetime import datetime + +import pytest +from markupsafe import escape +from markupsafe import Markup + +from werkzeug import exceptions +from werkzeug.datastructures import Headers +from werkzeug.datastructures import WWWAuthenticate +from werkzeug.exceptions import HTTPException +from werkzeug.wrappers import Response + + +def test_proxy_exception(): + orig_resp = Response("Hello World") + with pytest.raises(exceptions.HTTPException) as excinfo: + exceptions.abort(orig_resp) + resp = excinfo.value.get_response({}) + assert resp is orig_resp + assert resp.get_data() == b"Hello World" + + +@pytest.mark.parametrize( + "test", + [ + (exceptions.BadRequest, 400), + (exceptions.Unauthorized, 401, 'Basic "test realm"'), + (exceptions.Forbidden, 403), + (exceptions.NotFound, 404), + (exceptions.MethodNotAllowed, 405, ["GET", "HEAD"]), + (exceptions.NotAcceptable, 406), + (exceptions.RequestTimeout, 408), + (exceptions.Gone, 410), + (exceptions.LengthRequired, 411), + (exceptions.PreconditionFailed, 412), + (exceptions.RequestEntityTooLarge, 413), + (exceptions.RequestURITooLarge, 414), + (exceptions.UnsupportedMediaType, 415), + (exceptions.UnprocessableEntity, 422), + (exceptions.Locked, 423), + (exceptions.InternalServerError, 500), + (exceptions.NotImplemented, 501), + (exceptions.BadGateway, 502), + (exceptions.ServiceUnavailable, 503), + ], +) +def test_aborter_general(test): + exc_type = test[0] + args = test[1:] + + with pytest.raises(exc_type) as exc_info: + exceptions.abort(*args) + assert type(exc_info.value) is exc_type + + +def test_abort_description_markup(): + with pytest.raises(HTTPException) as exc_info: + exceptions.abort(400, Markup("<")) + + assert "<" in str(exc_info.value) + + +def test_aborter_custom(): + myabort = exceptions.Aborter({1: exceptions.NotFound}) + pytest.raises(LookupError, myabort, 404) + pytest.raises(exceptions.NotFound, myabort, 1) + + myabort = exceptions.Aborter(extra={1: exceptions.NotFound}) + pytest.raises(exceptions.NotFound, myabort, 404) + pytest.raises(exceptions.NotFound, myabort, 1) + + +def test_exception_repr(): + exc = exceptions.NotFound() + assert str(exc) == ( + "404 Not Found: The requested URL was not found on the server." + " If you entered the URL manually please check your spelling" + " and try again." + ) + assert repr(exc) == "" + + exc = exceptions.NotFound("Not There") + assert str(exc) == "404 Not Found: Not There" + assert repr(exc) == "" + + exc = exceptions.HTTPException("An error message") + assert str(exc) == "??? Unknown Error: An error message" + assert repr(exc) == "" + + +def test_method_not_allowed_methods(): + exc = exceptions.MethodNotAllowed(["GET", "HEAD", "POST"]) + h = dict(exc.get_headers({})) + assert h["Allow"] == "GET, HEAD, POST" + assert "The method is not allowed" in exc.get_description() + + +def test_unauthorized_www_authenticate(): + basic = WWWAuthenticate() + basic.set_basic("test") + digest = WWWAuthenticate() + digest.set_digest("test", "test") + + exc = exceptions.Unauthorized(www_authenticate=basic) + h = Headers(exc.get_headers({})) + assert h["WWW-Authenticate"] == str(basic) + + exc = exceptions.Unauthorized(www_authenticate=[digest, basic]) + h = Headers(exc.get_headers({})) + assert h.get_all("WWW-Authenticate") == [str(digest), str(basic)] + + exc = exceptions.Unauthorized() + h = Headers(exc.get_headers({})) + assert "WWW-Authenticate" not in h + + +def test_response_header_content_type_should_contain_charset(): + exc = exceptions.HTTPException("An error message") + h = exc.get_response({}) + assert h.headers["Content-Type"] == "text/html; charset=utf-8" + + +@pytest.mark.parametrize( + ("cls", "value", "expect"), + [ + (exceptions.TooManyRequests, 20, "20"), + ( + exceptions.ServiceUnavailable, + datetime(2020, 1, 4, 18, 52, 16), + "Sat, 04 Jan 2020 18:52:16 GMT", + ), + ], +) +def test_retry_after_mixin(cls, value, expect): + e = cls(retry_after=value) + h = dict(e.get_headers({})) + assert h["Retry-After"] == expect + + +@pytest.mark.parametrize( + "cls", + sorted( + (e for e in HTTPException.__subclasses__() if e.code and e.code >= 400), + key=lambda e: e.code, # type: ignore + ), +) +def test_passing_response(cls): + class TestResponse(Response): + pass + + exc = cls(response=TestResponse()) + rp = exc.get_response({}) + assert isinstance(rp, TestResponse) + + +def test_description_none(): + HTTPException().get_response() + + +@pytest.mark.parametrize( + "cls", + sorted( + (e for e in HTTPException.__subclasses__() if e.code), + key=lambda e: e.code, # type: ignore + ), +) +def test_response_body(cls): + exc = cls() + response_body = exc.get_body() + assert response_body.startswith("\n\n") + assert f"{exc.code} {escape(exc.name)}" in response_body + assert exc.get_description() in response_body diff --git a/tests/test_formparser.py b/tests/test_formparser.py new file mode 100644 index 0000000..49010b4 --- /dev/null +++ b/tests/test_formparser.py @@ -0,0 +1,448 @@ +import csv +import io +from os.path import dirname +from os.path import join + +import pytest + +from werkzeug import formparser +from werkzeug.datastructures import MultiDict +from werkzeug.exceptions import RequestEntityTooLarge +from werkzeug.formparser import FormDataParser +from werkzeug.formparser import parse_form_data +from werkzeug.test import Client +from werkzeug.test import create_environ +from werkzeug.wrappers import Request +from werkzeug.wrappers import Response + + +@Request.application +def form_data_consumer(request): + result_object = request.args["object"] + if result_object == "text": + return Response(repr(request.form["text"])) + f = request.files[result_object] + return Response( + b"\n".join( + ( + repr(f.filename).encode("ascii"), + repr(f.name).encode("ascii"), + repr(f.content_type).encode("ascii"), + f.stream.read(), + ) + ) + ) + + +def get_contents(filename): + with open(filename, "rb") as f: + return f.read() + + +class TestFormParser: + def test_limiting(self): + data = b"foo=Hello+World&bar=baz" + req = Request.from_values( + input_stream=io.BytesIO(data), + content_length=len(data), + content_type="application/x-www-form-urlencoded", + method="POST", + ) + req.max_content_length = 400 + assert req.form["foo"] == "Hello World" + + req = Request.from_values( + input_stream=io.BytesIO(data), + content_length=len(data), + content_type="application/x-www-form-urlencoded", + method="POST", + ) + req.max_form_memory_size = 7 + pytest.raises(RequestEntityTooLarge, lambda: req.form["foo"]) + + req = Request.from_values( + input_stream=io.BytesIO(data), + content_length=len(data), + content_type="application/x-www-form-urlencoded", + method="POST", + ) + req.max_form_memory_size = 400 + assert req.form["foo"] == "Hello World" + + data = ( + b"--foo\r\nContent-Disposition: form-field; name=foo\r\n\r\n" + b"Hello World\r\n" + b"--foo\r\nContent-Disposition: form-field; name=bar\r\n\r\n" + b"bar=baz\r\n--foo--" + ) + req = Request.from_values( + input_stream=io.BytesIO(data), + content_length=len(data), + content_type="multipart/form-data; boundary=foo", + method="POST", + ) + req.max_content_length = 4 + pytest.raises(RequestEntityTooLarge, lambda: req.form["foo"]) + + # when the request entity is too large, the input stream should be + # drained so that firefox (and others) do not report connection reset + # when run through gunicorn + # a sufficiently large stream is necessary for block-based reads + input_stream = io.BytesIO(b"foo=" + b"x" * 128 * 1024) + req = Request.from_values( + input_stream=input_stream, + content_length=len(data), + content_type="multipart/form-data; boundary=foo", + method="POST", + ) + req.max_content_length = 4 + pytest.raises(RequestEntityTooLarge, lambda: req.form["foo"]) + # ensure that the stream is exhausted + assert input_stream.read() == b"" + + req = Request.from_values( + input_stream=io.BytesIO(data), + content_length=len(data), + content_type="multipart/form-data; boundary=foo", + method="POST", + ) + req.max_content_length = 400 + assert req.form["foo"] == "Hello World" + + req = Request.from_values( + input_stream=io.BytesIO(data), + content_length=len(data), + content_type="multipart/form-data; boundary=foo", + method="POST", + ) + req.max_form_memory_size = 7 + pytest.raises(RequestEntityTooLarge, lambda: req.form["foo"]) + + req = Request.from_values( + input_stream=io.BytesIO(data), + content_length=len(data), + content_type="multipart/form-data; boundary=foo", + method="POST", + ) + req.max_form_memory_size = 400 + assert req.form["foo"] == "Hello World" + + def test_missing_multipart_boundary(self): + data = ( + b"--foo\r\nContent-Disposition: form-field; name=foo\r\n\r\n" + b"Hello World\r\n" + b"--foo\r\nContent-Disposition: form-field; name=bar\r\n\r\n" + b"bar=baz\r\n--foo--" + ) + req = Request.from_values( + input_stream=io.BytesIO(data), + content_length=len(data), + content_type="multipart/form-data", + method="POST", + ) + assert req.form == {} + + def test_parse_form_data_put_without_content(self): + # A PUT without a Content-Type header returns empty data + + # Both rfc1945 and rfc2616 (1.0 and 1.1) say "Any HTTP/[1.0/1.1] message + # containing an entity-body SHOULD include a Content-Type header field + # defining the media type of that body." In the case where either + # headers are omitted, parse_form_data should still work. + env = create_environ("/foo", "http://example.org/", method="PUT") + + stream, form, files = formparser.parse_form_data(env) + assert stream.read() == b"" + assert len(form) == 0 + assert len(files) == 0 + + def test_parse_form_data_get_without_content(self): + env = create_environ("/foo", "http://example.org/", method="GET") + + stream, form, files = formparser.parse_form_data(env) + assert stream.read() == b"" + assert len(form) == 0 + assert len(files) == 0 + + @pytest.mark.parametrize( + ("no_spooled", "size"), ((False, 100), (False, 3000), (True, 100), (True, 3000)) + ) + def test_default_stream_factory(self, no_spooled, size, monkeypatch): + if no_spooled: + monkeypatch.setattr("werkzeug.formparser.SpooledTemporaryFile", None) + + data = b"a,b,c\n" * size + with Request.from_values( + data={"foo": (io.BytesIO(data), "test.txt")}, method="POST" + ) as req: + reader = csv.reader(io.TextIOWrapper(req.files["foo"])) + # This fails if file_storage doesn't implement IOBase. + # https://github.com/pallets/werkzeug/issues/1344 + # https://github.com/python/cpython/pull/3249 + assert sum(1 for _ in reader) == size + + def test_parse_bad_content_type(self): + parser = FormDataParser() + assert parser.parse("", "bad-mime-type", 0) == ( + "", + MultiDict([]), + MultiDict([]), + ) + + def test_parse_from_environ(self): + parser = FormDataParser() + stream, _, _ = parser.parse_from_environ({"wsgi.input": ""}) + assert stream is not None + + +@pytest.mark.filterwarnings("ignore::pytest.PytestUnraisableExceptionWarning") +class TestMultiPart: + def test_basic(self): + resources = join(dirname(__file__), "multipart") + client = Client(form_data_consumer) + + repository = [ + ( + "firefox3-2png1txt", + "---------------------------186454651713519341951581030105", + [ + ("anchor.png", "file1", "image/png", "file1.png"), + ("application_edit.png", "file2", "image/png", "file2.png"), + ], + "example text", + ), + ( + "firefox3-2pnglongtext", + "---------------------------14904044739787191031754711748", + [ + ("accept.png", "file1", "image/png", "file1.png"), + ("add.png", "file2", "image/png", "file2.png"), + ], + "--long text\r\n--with boundary\r\n--lookalikes--", + ), + ( + "opera8-2png1txt", + "----------zEO9jQKmLc2Cq88c23Dx19", + [ + ("arrow_branch.png", "file1", "image/png", "file1.png"), + ("award_star_bronze_1.png", "file2", "image/png", "file2.png"), + ], + "blafasel öäü", + ), + ( + "webkit3-2png1txt", + "----WebKitFormBoundaryjdSFhcARk8fyGNy6", + [ + ("gtk-apply.png", "file1", "image/png", "file1.png"), + ("gtk-no.png", "file2", "image/png", "file2.png"), + ], + "this is another text with ümläüts", + ), + ( + "ie6-2png1txt", + "---------------------------7d91b03a20128", + [ + ("file1.png", "file1", "image/x-png", "file1.png"), + ("file2.png", "file2", "image/x-png", "file2.png"), + ], + "ie6 sucks :-/", + ), + ] + + for name, boundary, files, text in repository: + folder = join(resources, name) + data = get_contents(join(folder, "request.http")) + for filename, field, content_type, fsname in files: + with client.post( + f"/?object={field}", + data=data, + content_type=f'multipart/form-data; boundary="{boundary}"', + content_length=len(data), + ) as response: + lines = response.get_data().split(b"\n", 3) + assert lines[0] == repr(filename).encode("ascii") + assert lines[1] == repr(field).encode("ascii") + assert lines[2] == repr(content_type).encode("ascii") + assert lines[3] == get_contents(join(folder, fsname)) + + with client.post( + "/?object=text", + data=data, + content_type=f'multipart/form-data; boundary="{boundary}"', + content_length=len(data), + ) as response: + assert response.get_data() == repr(text).encode("utf-8") + + @pytest.mark.filterwarnings("ignore::pytest.PytestUnraisableExceptionWarning") + def test_ie7_unc_path(self): + client = Client(form_data_consumer) + data_file = join(dirname(__file__), "multipart", "ie7_full_path_request.http") + data = get_contents(data_file) + boundary = "---------------------------7da36d1b4a0164" + with client.post( + "/?object=cb_file_upload_multiple", + data=data, + content_type=f'multipart/form-data; boundary="{boundary}"', + content_length=len(data), + ) as response: + lines = response.get_data().split(b"\n", 3) + assert lines[0] == b"'Sellersburg Town Council Meeting 02-22-2010doc.doc'" + + def test_end_of_file(self): + # This test looks innocent but it was actually timing out in + # the Werkzeug 0.5 release version (#394) + data = ( + b"--foo\r\n" + b'Content-Disposition: form-data; name="test"; filename="test.txt"\r\n' + b"Content-Type: text/plain\r\n\r\n" + b"file contents and no end" + ) + with Request.from_values( + input_stream=io.BytesIO(data), + content_length=len(data), + content_type="multipart/form-data; boundary=foo", + method="POST", + ) as data: + assert not data.files + assert not data.form + + def test_file_no_content_type(self): + data = ( + b"--foo\r\n" + b'Content-Disposition: form-data; name="test"; filename="test.txt"\r\n\r\n' + b"file contents\r\n--foo--" + ) + with Request.from_values( + input_stream=io.BytesIO(data), + content_length=len(data), + content_type="multipart/form-data; boundary=foo", + method="POST", + ) as data: + assert data.files["test"].filename == "test.txt" + assert data.files["test"].read() == b"file contents" + + def test_extra_newline(self): + # this test looks innocent but it was actually timing out in + # the Werkzeug 0.5 release version (#394) + data = ( + b"\r\n\r\n--foo\r\n" + b'Content-Disposition: form-data; name="foo"\r\n\r\n' + b"a string\r\n" + b"--foo--" + ) + data = Request.from_values( + input_stream=io.BytesIO(data), + content_length=len(data), + content_type="multipart/form-data; boundary=foo", + method="POST", + ) + assert not data.files + assert data.form["foo"] == "a string" + + def test_headers(self): + data = ( + b"--foo\r\n" + b'Content-Disposition: form-data; name="foo"; filename="foo.txt"\r\n' + b"X-Custom-Header: blah\r\n" + b"Content-Type: text/plain; charset=utf-8\r\n\r\n" + b"file contents, just the contents\r\n" + b"--foo--" + ) + with Request.from_values( + input_stream=io.BytesIO(data), + content_length=len(data), + content_type="multipart/form-data; boundary=foo", + method="POST", + ) as req: + foo = req.files["foo"] + assert foo.mimetype == "text/plain" + assert foo.mimetype_params == {"charset": "utf-8"} + assert foo.headers["content-type"] == foo.content_type + assert foo.content_type == "text/plain; charset=utf-8" + assert foo.headers["x-custom-header"] == "blah" + + @pytest.mark.parametrize("ending", [b"\n", b"\r", b"\r\n"]) + def test_nonstandard_line_endings(self, ending: bytes): + data = ending.join( + ( + b"--foo", + b"Content-Disposition: form-data; name=foo", + b"", + b"this is just bar", + b"--foo", + b"Content-Disposition: form-data; name=bar", + b"", + b"blafasel", + b"--foo--", + ) + ) + req = Request.from_values( + input_stream=io.BytesIO(data), + content_length=len(data), + content_type="multipart/form-data; boundary=foo", + method="POST", + ) + assert req.form["foo"] == "this is just bar" + assert req.form["bar"] == "blafasel" + + def test_failures(self): + def parse_multipart(stream, boundary, content_length): + parser = formparser.MultiPartParser(content_length) + return parser.parse(stream, boundary, content_length) + + data = b"--foo\r\n\r\nHello World\r\n--foo--" + pytest.raises(ValueError, parse_multipart, io.BytesIO(data), b"foo", len(data)) + + data = ( + b"--foo\r\nContent-Disposition: form-field; name=foo\r\n\r\nHello World\r\n" + ) + pytest.raises(ValueError, parse_multipart, io.BytesIO(data), b"foo", len(data)) + + def test_empty_multipart(self): + environ = {} + data = b"--boundary--" + environ["REQUEST_METHOD"] = "POST" + environ["CONTENT_TYPE"] = "multipart/form-data; boundary=boundary" + environ["CONTENT_LENGTH"] = str(len(data)) + environ["wsgi.input"] = io.BytesIO(data) + stream, form, files = parse_form_data(environ, silent=False) + rv = stream.read() + assert rv == b"" + assert form == MultiDict() + assert files == MultiDict() + + +class TestMultiPartParser: + def test_constructor_not_pass_stream_factory_and_cls(self): + parser = formparser.MultiPartParser() + + assert parser.stream_factory is formparser.default_stream_factory + assert parser.cls is MultiDict + + def test_constructor_pass_stream_factory_and_cls(self): + def stream_factory(): + pass + + parser = formparser.MultiPartParser(stream_factory=stream_factory, cls=dict) + + assert parser.stream_factory is stream_factory + assert parser.cls is dict + + def test_file_rfc2231_filename_continuations(self): + data = ( + b"--foo\r\n" + b"Content-Type: text/plain; charset=utf-8\r\n" + b"Content-Disposition: form-data; name=rfc2231;\r\n" + b" filename*0*=ascii''a%20b%20;\r\n" + b" filename*1*=c%20d%20;\r\n" + b' filename*2="e f.txt"\r\n\r\n' + b"file contents\r\n--foo--" + ) + with Request.from_values( + input_stream=io.BytesIO(data), + content_length=len(data), + content_type="multipart/form-data; boundary=foo", + method="POST", + ) as request: + assert request.files["rfc2231"].filename == "a b c d e f.txt" + assert request.files["rfc2231"].read() == b"file contents" diff --git a/tests/test_http.py b/tests/test_http.py new file mode 100644 index 0000000..3760dc1 --- /dev/null +++ b/tests/test_http.py @@ -0,0 +1,717 @@ +import base64 +from datetime import date +from datetime import datetime +from datetime import timedelta +from datetime import timezone + +import pytest + +from werkzeug import datastructures +from werkzeug import http +from werkzeug._internal import _wsgi_encoding_dance +from werkzeug.test import create_environ + + +class TestHTTPUtility: + def test_accept(self): + a = http.parse_accept_header("en-us,ru;q=0.5") + assert list(a.values()) == ["en-us", "ru"] + assert a.best == "en-us" + assert a.find("ru") == 1 + pytest.raises(ValueError, a.index, "de") + assert a.to_header() == "en-us,ru;q=0.5" + + def test_mime_accept(self): + a = http.parse_accept_header( + "text/xml,application/xml," + "application/xhtml+xml," + "application/foo;quiet=no; bar=baz;q=0.6," + "text/html;q=0.9,text/plain;q=0.8," + "image/png,*/*;q=0.5", + datastructures.MIMEAccept, + ) + pytest.raises(ValueError, lambda: a["missing"]) + assert a["image/png"] == 1 + assert a["text/plain"] == 0.8 + assert a["foo/bar"] == 0.5 + assert a["application/foo;quiet=no; bar=baz"] == 0.6 + assert a[a.find("foo/bar")] == ("*/*", 0.5) + + def test_accept_matches(self): + a = http.parse_accept_header( + "text/xml,application/xml,application/xhtml+xml," + "text/html;q=0.9,text/plain;q=0.8," + "image/png", + datastructures.MIMEAccept, + ) + assert ( + a.best_match(["text/html", "application/xhtml+xml"]) + == "application/xhtml+xml" + ) + assert a.best_match(["text/html"]) == "text/html" + assert a.best_match(["foo/bar"]) is None + assert a.best_match(["foo/bar", "bar/foo"], default="foo/bar") == "foo/bar" + assert a.best_match(["application/xml", "text/xml"]) == "application/xml" + + def test_accept_mime_specificity(self): + a = http.parse_accept_header( + "text/*, text/html, text/html;level=1, */*", datastructures.MIMEAccept + ) + assert a.best_match(["text/html; version=1", "text/html"]) == "text/html" + assert a.best_match(["text/html", "text/html; level=1"]) == "text/html; level=1" + + def test_charset_accept(self): + a = http.parse_accept_header( + "ISO-8859-1,utf-8;q=0.7,*;q=0.7", datastructures.CharsetAccept + ) + assert a["iso-8859-1"] == a["iso8859-1"] + assert a["iso-8859-1"] == 1 + assert a["UTF8"] == 0.7 + assert a["ebcdic"] == 0.7 + + def test_language_accept(self): + a = http.parse_accept_header( + "de-AT,de;q=0.8,en;q=0.5", datastructures.LanguageAccept + ) + assert a.best == "de-AT" + assert "de_AT" in a + assert "en" in a + assert a["de-at"] == 1 + assert a["en"] == 0.5 + + def test_set_header(self): + hs = http.parse_set_header('foo, Bar, "Blah baz", Hehe') + assert "blah baz" in hs + assert "foobar" not in hs + assert "foo" in hs + assert list(hs) == ["foo", "Bar", "Blah baz", "Hehe"] + hs.add("Foo") + assert hs.to_header() == 'foo, Bar, "Blah baz", Hehe' + + def test_list_header(self): + hl = http.parse_list_header("foo baz, blah") + assert hl == ["foo baz", "blah"] + + def test_dict_header(self): + d = http.parse_dict_header('foo="bar baz", blah=42') + assert d == {"foo": "bar baz", "blah": "42"} + + def test_cache_control_header(self): + cc = http.parse_cache_control_header("max-age=0, no-cache") + assert cc.max_age == 0 + assert cc.no_cache + cc = http.parse_cache_control_header( + 'private, community="UCI"', None, datastructures.ResponseCacheControl + ) + assert cc.private + assert cc["community"] == "UCI" + + c = datastructures.ResponseCacheControl() + assert c.no_cache is None + assert c.private is None + c.no_cache = True + assert c.no_cache == "*" + c.private = True + assert c.private == "*" + del c.private + assert c.private is None + # max_age is an int, other types are converted + c.max_age = 3.1 + assert c.max_age == 3 + del c.max_age + c.s_maxage = 3.1 + assert c.s_maxage == 3 + del c.s_maxage + assert c.to_header() == "no-cache" + + def test_csp_header(self): + csp = http.parse_csp_header( + "default-src 'self'; script-src 'unsafe-inline' *; img-src" + ) + assert csp.default_src == "'self'" + assert csp.script_src == "'unsafe-inline' *" + assert csp.img_src is None + + def test_authorization_header(self): + a = http.parse_authorization_header("Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==") + assert a.type == "basic" + assert a.username == "Aladdin" + assert a.password == "open sesame" + + a = http.parse_authorization_header( + "Basic 0YDRg9GB0YHQutC40IE60JHRg9C60LLRiw==" + ) + assert a.type == "basic" + assert a.username == "русскиЁ" + assert a.password == "Буквы" + + a = http.parse_authorization_header("Basic 5pmu6YCa6K+dOuS4reaWhw==") + assert a.type == "basic" + assert a.username == "普通话" + assert a.password == "中文" + + a = http.parse_authorization_header( + '''Digest username="Mufasa", + realm="testrealm@host.invalid", + nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", + uri="/dir/index.html", + qop=auth, + nc=00000001, + cnonce="0a4f113b", + response="6629fae49393a05397450978507c4ef1", + opaque="5ccc069c403ebaf9f0171e9517f40e41"''' + ) + assert a.type == "digest" + assert a.username == "Mufasa" + assert a.realm == "testrealm@host.invalid" + assert a.nonce == "dcd98b7102dd2f0e8b11d0f600bfb0c093" + assert a.uri == "/dir/index.html" + assert a.qop == "auth" + assert a.nc == "00000001" + assert a.cnonce == "0a4f113b" + assert a.response == "6629fae49393a05397450978507c4ef1" + assert a.opaque == "5ccc069c403ebaf9f0171e9517f40e41" + + a = http.parse_authorization_header( + '''Digest username="Mufasa", + realm="testrealm@host.invalid", + nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", + uri="/dir/index.html", + response="e257afa1414a3340d93d30955171dd0e", + opaque="5ccc069c403ebaf9f0171e9517f40e41"''' + ) + assert a.type == "digest" + assert a.username == "Mufasa" + assert a.realm == "testrealm@host.invalid" + assert a.nonce == "dcd98b7102dd2f0e8b11d0f600bfb0c093" + assert a.uri == "/dir/index.html" + assert a.response == "e257afa1414a3340d93d30955171dd0e" + assert a.opaque == "5ccc069c403ebaf9f0171e9517f40e41" + + assert http.parse_authorization_header("") is None + assert http.parse_authorization_header(None) is None + assert http.parse_authorization_header("foo") is None + + def test_bad_authorization_header_encoding(self): + """If the base64 encoded bytes can't be decoded as UTF-8""" + content = base64.b64encode(b"\xffser:pass").decode() + assert http.parse_authorization_header(f"Basic {content}") is None + + def test_www_authenticate_header(self): + wa = http.parse_www_authenticate_header('Basic realm="WallyWorld"') + assert wa.type == "basic" + assert wa.realm == "WallyWorld" + wa.realm = "Foo Bar" + assert wa.to_header() == 'Basic realm="Foo Bar"' + + wa = http.parse_www_authenticate_header( + '''Digest + realm="testrealm@host.com", + qop="auth,auth-int", + nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093", + opaque="5ccc069c403ebaf9f0171e9517f40e41"''' + ) + assert wa.type == "digest" + assert wa.realm == "testrealm@host.com" + assert "auth" in wa.qop + assert "auth-int" in wa.qop + assert wa.nonce == "dcd98b7102dd2f0e8b11d0f600bfb0c093" + assert wa.opaque == "5ccc069c403ebaf9f0171e9517f40e41" + + wa = http.parse_www_authenticate_header("broken") + assert wa.type == "broken" + + assert not http.parse_www_authenticate_header("").type + assert not http.parse_www_authenticate_header("") + + def test_etags(self): + assert http.quote_etag("foo") == '"foo"' + assert http.quote_etag("foo", True) == 'W/"foo"' + assert http.unquote_etag('"foo"') == ("foo", False) + assert http.unquote_etag('W/"foo"') == ("foo", True) + es = http.parse_etags('"foo", "bar", W/"baz", blar') + assert sorted(es) == ["bar", "blar", "foo"] + assert "foo" in es + assert "baz" not in es + assert es.contains_weak("baz") + assert "blar" in es + assert es.contains_raw('W/"baz"') + assert es.contains_raw('"foo"') + assert sorted(es.to_header().split(", ")) == [ + '"bar"', + '"blar"', + '"foo"', + 'W/"baz"', + ] + + def test_etags_nonzero(self): + etags = http.parse_etags('W/"foo"') + assert bool(etags) + assert etags.contains_raw('W/"foo"') + + def test_remove_entity_headers(self): + now = http.http_date() + headers1 = [ + ("Date", now), + ("Content-Type", "text/html"), + ("Content-Length", "0"), + ] + headers2 = datastructures.Headers(headers1) + + http.remove_entity_headers(headers1) + assert headers1 == [("Date", now)] + + http.remove_entity_headers(headers2) + assert headers2 == datastructures.Headers([("Date", now)]) + + def test_remove_hop_by_hop_headers(self): + headers1 = [("Connection", "closed"), ("Foo", "bar"), ("Keep-Alive", "wtf")] + headers2 = datastructures.Headers(headers1) + + http.remove_hop_by_hop_headers(headers1) + assert headers1 == [("Foo", "bar")] + + http.remove_hop_by_hop_headers(headers2) + assert headers2 == datastructures.Headers([("Foo", "bar")]) + + def test_parse_options_header(self): + assert http.parse_options_header(None) == ("", {}) + assert http.parse_options_header("") == ("", {}) + assert http.parse_options_header(r'something; foo="other\"thing"') == ( + "something", + {"foo": 'other"thing'}, + ) + assert http.parse_options_header(r'something; foo="other\"thing"; meh=42') == ( + "something", + {"foo": 'other"thing', "meh": "42"}, + ) + assert http.parse_options_header( + r'something; foo="other\"thing"; meh=42; bleh' + ) == ("something", {"foo": 'other"thing', "meh": "42", "bleh": None}) + assert http.parse_options_header( + 'something; foo="other;thing"; meh=42; bleh' + ) == ("something", {"foo": "other;thing", "meh": "42", "bleh": None}) + assert http.parse_options_header('something; foo="otherthing"; meh=; bleh') == ( + "something", + {"foo": "otherthing", "meh": None, "bleh": None}, + ) + # Issue #404 + assert http.parse_options_header( + 'multipart/form-data; name="foo bar"; filename="bar foo"' + ) == ("multipart/form-data", {"name": "foo bar", "filename": "bar foo"}) + # Examples from RFC + assert http.parse_options_header("audio/*; q=0.2, audio/basic") == ( + "audio/*", + {"q": "0.2"}, + ) + + assert http.parse_options_header( + "text/plain; q=0.5, text/html\n text/x-dvi; q=0.8, text/x-c" + ) == ("text/plain", {"q": "0.5"}) + # Issue #932 + assert http.parse_options_header( + "form-data; name=\"a_file\"; filename*=UTF-8''" + '"%c2%a3%20and%20%e2%82%ac%20rates"' + ) == ("form-data", {"name": "a_file", "filename": "\xa3 and \u20ac rates"}) + assert http.parse_options_header( + "form-data; name*=UTF-8''\"%C5%AAn%C4%ADc%C5%8Dde%CC%BD\"; " + 'filename="some_file.txt"' + ) == ( + "form-data", + {"name": "\u016an\u012dc\u014dde\u033d", "filename": "some_file.txt"}, + ) + + def test_parse_options_header_value_with_quotes(self): + assert http.parse_options_header( + 'form-data; name="file"; filename="t\'es\'t.txt"' + ) == ("form-data", {"name": "file", "filename": "t'es't.txt"}) + assert http.parse_options_header( + "form-data; name=\"file\"; filename*=UTF-8''\"'🐍'.txt\"" + ) == ("form-data", {"name": "file", "filename": "'🐍'.txt"}) + + def test_parse_options_header_broken_values(self): + # Issue #995 + assert http.parse_options_header(" ") == ("", {}) + assert http.parse_options_header(" , ") == ("", {}) + assert http.parse_options_header(" ; ") == ("", {}) + assert http.parse_options_header(" ,; ") == ("", {}) + assert http.parse_options_header(" , a ") == ("", {}) + assert http.parse_options_header(" ; a ") == ("", {}) + + def test_parse_options_header_case_insensitive(self): + _, options = http.parse_options_header(r'something; fileName="File.ext"') + assert options["filename"] == "File.ext" + + def test_dump_options_header(self): + assert http.dump_options_header("foo", {"bar": 42}) == "foo; bar=42" + assert http.dump_options_header("foo", {"bar": 42, "fizz": None}) in ( + "foo; bar=42; fizz", + "foo; fizz; bar=42", + ) + + def test_dump_header(self): + assert http.dump_header([1, 2, 3]) == "1, 2, 3" + assert http.dump_header([1, 2, 3], allow_token=False) == '"1", "2", "3"' + assert http.dump_header({"foo": "bar"}, allow_token=False) == 'foo="bar"' + assert http.dump_header({"foo": "bar"}) == "foo=bar" + + def test_is_resource_modified(self): + env = create_environ() + + # any method is allowed + env["REQUEST_METHOD"] = "POST" + assert http.is_resource_modified(env, etag="testing") + env["REQUEST_METHOD"] = "GET" + + # etagify from data + pytest.raises(TypeError, http.is_resource_modified, env, data="42", etag="23") + env["HTTP_IF_NONE_MATCH"] = http.generate_etag(b"awesome") + assert not http.is_resource_modified(env, data=b"awesome") + + env["HTTP_IF_MODIFIED_SINCE"] = http.http_date(datetime(2008, 1, 1, 12, 30)) + assert not http.is_resource_modified( + env, last_modified=datetime(2008, 1, 1, 12, 00) + ) + assert http.is_resource_modified( + env, last_modified=datetime(2008, 1, 1, 13, 00) + ) + + def test_is_resource_modified_for_range_requests(self): + env = create_environ() + + env["HTTP_IF_MODIFIED_SINCE"] = http.http_date(datetime(2008, 1, 1, 12, 30)) + env["HTTP_IF_RANGE"] = http.generate_etag(b"awesome_if_range") + # Range header not present, so If-Range should be ignored + assert not http.is_resource_modified( + env, + data=b"not_the_same", + ignore_if_range=False, + last_modified=datetime(2008, 1, 1, 12, 30), + ) + + env["HTTP_RANGE"] = "" + assert not http.is_resource_modified( + env, data=b"awesome_if_range", ignore_if_range=False + ) + assert http.is_resource_modified( + env, data=b"not_the_same", ignore_if_range=False + ) + + env["HTTP_IF_RANGE"] = http.http_date(datetime(2008, 1, 1, 13, 30)) + assert http.is_resource_modified( + env, last_modified=datetime(2008, 1, 1, 14, 00), ignore_if_range=False + ) + assert not http.is_resource_modified( + env, last_modified=datetime(2008, 1, 1, 13, 30), ignore_if_range=False + ) + assert http.is_resource_modified( + env, last_modified=datetime(2008, 1, 1, 13, 30), ignore_if_range=True + ) + + def test_parse_cookie(self): + cookies = http.parse_cookie( + "dismiss-top=6; CP=null*; PHPSESSID=0a539d42abc001cdc762809248d4beed;" + 'a=42; b="\\";"; ; fo234{=bar;blub=Blah; "__Secure-c"=d' + ) + assert cookies.to_dict() == { + "CP": "null*", + "PHPSESSID": "0a539d42abc001cdc762809248d4beed", + "a": "42", + "dismiss-top": "6", + "b": '";', + "fo234{": "bar", + "blub": "Blah", + '"__Secure-c"': "d", + } + + def test_dump_cookie(self): + rv = http.dump_cookie( + "foo", "bar baz blub", 360, httponly=True, sync_expires=False + ) + assert set(rv.split("; ")) == { + "HttpOnly", + "Max-Age=360", + "Path=/", + 'foo="bar baz blub"', + } + assert http.dump_cookie("key", "xxx/") == "key=xxx/; Path=/" + assert http.dump_cookie("key", "xxx=") == "key=xxx=; Path=/" + + def test_bad_cookies(self): + cookies = http.parse_cookie( + "first=IamTheFirst ; a=1; oops ; a=2 ;second = andMeTwo;" + ) + expect = { + "first": ["IamTheFirst"], + "a": ["1", "2"], + "oops": [""], + "second": ["andMeTwo"], + } + assert cookies.to_dict(flat=False) == expect + assert cookies["a"] == "1" + assert cookies.getlist("a") == ["1", "2"] + + def test_empty_keys_are_ignored(self): + cookies = http.parse_cookie("spam=ham; duck=mallard; ; ") + expect = {"spam": "ham", "duck": "mallard"} + assert cookies.to_dict() == expect + + def test_cookie_quoting(self): + val = http.dump_cookie("foo", "?foo") + assert val == 'foo="?foo"; Path=/' + assert http.parse_cookie(val).to_dict() == {"foo": "?foo", "Path": "/"} + assert http.parse_cookie(r'foo="foo\054bar"').to_dict(), {"foo": "foo,bar"} + + def test_parse_set_cookie_directive(self): + val = 'foo="?foo"; version="0.1";' + assert http.parse_cookie(val).to_dict() == {"foo": "?foo", "version": "0.1"} + + def test_cookie_domain_resolving(self): + val = http.dump_cookie("foo", "bar", domain="\N{SNOWMAN}.com") + assert val == "foo=bar; Domain=xn--n3h.com; Path=/" + + def test_cookie_unicode_dumping(self): + val = http.dump_cookie("foo", "\N{SNOWMAN}") + h = datastructures.Headers() + h.add("Set-Cookie", val) + assert h["Set-Cookie"] == 'foo="\\342\\230\\203"; Path=/' + + cookies = http.parse_cookie(h["Set-Cookie"]) + assert cookies["foo"] == "\N{SNOWMAN}" + + def test_cookie_unicode_keys(self): + # Yes, this is technically against the spec but happens + val = http.dump_cookie("fö", "fö") + assert val == _wsgi_encoding_dance('fö="f\\303\\266"; Path=/', "utf-8") + cookies = http.parse_cookie(val) + assert cookies["fö"] == "fö" + + def test_cookie_unicode_parsing(self): + # This is submitted by Firefox if you set a Unicode cookie. + cookies = http.parse_cookie("fÃ¶=fÃ¶") + assert cookies["fö"] == "fö" + + def test_cookie_domain_encoding(self): + val = http.dump_cookie("foo", "bar", domain="\N{SNOWMAN}.com") + assert val == "foo=bar; Domain=xn--n3h.com; Path=/" + + val = http.dump_cookie("foo", "bar", domain=".\N{SNOWMAN}.com") + assert val == "foo=bar; Domain=.xn--n3h.com; Path=/" + + val = http.dump_cookie("foo", "bar", domain=".foo.com") + assert val == "foo=bar; Domain=.foo.com; Path=/" + + def test_cookie_maxsize(self, recwarn): + val = http.dump_cookie("foo", "bar" * 1360 + "b") + assert len(recwarn) == 0 + assert len(val) == 4093 + + http.dump_cookie("foo", "bar" * 1360 + "ba") + assert len(recwarn) == 1 + w = recwarn.pop() + assert "cookie is too large" in str(w.message) + + http.dump_cookie("foo", b"w" * 502, max_size=512) + assert len(recwarn) == 1 + w = recwarn.pop() + assert "the limit is 512 bytes" in str(w.message) + + @pytest.mark.parametrize( + ("samesite", "expected"), + ( + ("strict", "foo=bar; Path=/; SameSite=Strict"), + ("lax", "foo=bar; Path=/; SameSite=Lax"), + ("none", "foo=bar; Path=/; SameSite=None"), + (None, "foo=bar; Path=/"), + ), + ) + def test_cookie_samesite_attribute(self, samesite, expected): + value = http.dump_cookie("foo", "bar", samesite=samesite) + assert value == expected + + def test_cookie_samesite_invalid(self): + with pytest.raises(ValueError): + http.dump_cookie("foo", "bar", samesite="invalid") + + +class TestRange: + def test_if_range_parsing(self): + rv = http.parse_if_range_header('"Test"') + assert rv.etag == "Test" + assert rv.date is None + assert rv.to_header() == '"Test"' + + # weak information is dropped + rv = http.parse_if_range_header('W/"Test"') + assert rv.etag == "Test" + assert rv.date is None + assert rv.to_header() == '"Test"' + + # broken etags are supported too + rv = http.parse_if_range_header("bullshit") + assert rv.etag == "bullshit" + assert rv.date is None + assert rv.to_header() == '"bullshit"' + + rv = http.parse_if_range_header("Thu, 01 Jan 1970 00:00:00 GMT") + assert rv.etag is None + assert rv.date == datetime(1970, 1, 1, tzinfo=timezone.utc) + assert rv.to_header() == "Thu, 01 Jan 1970 00:00:00 GMT" + + for x in "", None: + rv = http.parse_if_range_header(x) + assert rv.etag is None + assert rv.date is None + assert rv.to_header() == "" + + def test_range_parsing(self): + rv = http.parse_range_header("bytes=52") + assert rv is None + + rv = http.parse_range_header("bytes=52-") + assert rv.units == "bytes" + assert rv.ranges == [(52, None)] + assert rv.to_header() == "bytes=52-" + + rv = http.parse_range_header("bytes=52-99") + assert rv.units == "bytes" + assert rv.ranges == [(52, 100)] + assert rv.to_header() == "bytes=52-99" + + rv = http.parse_range_header("bytes=52-99,-1000") + assert rv.units == "bytes" + assert rv.ranges == [(52, 100), (-1000, None)] + assert rv.to_header() == "bytes=52-99,-1000" + + rv = http.parse_range_header("bytes = 1 - 100") + assert rv.units == "bytes" + assert rv.ranges == [(1, 101)] + assert rv.to_header() == "bytes=1-100" + + rv = http.parse_range_header("AWesomes=0-999") + assert rv.units == "awesomes" + assert rv.ranges == [(0, 1000)] + assert rv.to_header() == "awesomes=0-999" + + rv = http.parse_range_header("bytes=-") + assert rv is None + + rv = http.parse_range_header("bytes=bad") + assert rv is None + + rv = http.parse_range_header("bytes=bad-1") + assert rv is None + + rv = http.parse_range_header("bytes=-bad") + assert rv is None + + rv = http.parse_range_header("bytes=52-99, bad") + assert rv is None + + def test_content_range_parsing(self): + rv = http.parse_content_range_header("bytes 0-98/*") + assert rv.units == "bytes" + assert rv.start == 0 + assert rv.stop == 99 + assert rv.length is None + assert rv.to_header() == "bytes 0-98/*" + + rv = http.parse_content_range_header("bytes 0-98/*asdfsa") + assert rv is None + + rv = http.parse_content_range_header("bytes 0-99/100") + assert rv.to_header() == "bytes 0-99/100" + rv.start = None + rv.stop = None + assert rv.units == "bytes" + assert rv.to_header() == "bytes */100" + + rv = http.parse_content_range_header("bytes */100") + assert rv.start is None + assert rv.stop is None + assert rv.length == 100 + assert rv.units == "bytes" + + +class TestRegression: + def test_best_match_works(self): + # was a bug in 0.6 + rv = http.parse_accept_header( + "foo=,application/xml,application/xhtml+xml," + "text/html;q=0.9,text/plain;q=0.8," + "image/png,*/*;q=0.5", + datastructures.MIMEAccept, + ).best_match(["foo/bar"]) + assert rv == "foo/bar" + + +@pytest.mark.parametrize( + "value", + [ + "Basic V2Vya3pldWc6V2VrcnpldWc=", + 'Digest username=Mufasa, realm="testrealm@host.invalid",' + ' nonce=dcd98b7102dd2f0e8b11d0f600bfb0c093, uri="/dir/index.html", qop=auth,' + " nc=00000001, cnonce=0a4f113b, response=6629fae49393a05397450978507c4ef1," + " opaque=5ccc069c403ebaf9f0171e9517f40e41", + ], +) +def test_authorization_to_header(value: str) -> None: + parsed = http.parse_authorization_header(value) + assert parsed is not None + assert parsed.to_header() == value + + +@pytest.mark.parametrize( + ("value", "expect"), + [ + ( + "Sun, 06 Nov 1994 08:49:37 GMT ", + datetime(1994, 11, 6, 8, 49, 37, tzinfo=timezone.utc), + ), + ( + "Sunday, 06-Nov-94 08:49:37 GMT", + datetime(1994, 11, 6, 8, 49, 37, tzinfo=timezone.utc), + ), + ( + " Sun Nov 6 08:49:37 1994", + datetime(1994, 11, 6, 8, 49, 37, tzinfo=timezone.utc), + ), + ("foo", None), + ( + " Sun 02 Feb 1343 08:49:37 GMT", + datetime(1343, 2, 2, 8, 49, 37, tzinfo=timezone.utc), + ), + ( + "Thu, 01 Jan 1970 00:00:00 GMT", + datetime(1970, 1, 1, tzinfo=timezone.utc), + ), + ("Thu, 33 Jan 1970 00:00:00 GMT", None), + ], +) +def test_parse_date(value, expect): + assert http.parse_date(value) == expect + + +@pytest.mark.parametrize( + ("value", "expect"), + [ + ( + datetime(1994, 11, 6, 8, 49, 37, tzinfo=timezone.utc), + "Sun, 06 Nov 1994 08:49:37 GMT", + ), + ( + datetime(1994, 11, 6, 8, 49, 37, tzinfo=timezone(timedelta(hours=-8))), + "Sun, 06 Nov 1994 16:49:37 GMT", + ), + (datetime(1994, 11, 6, 8, 49, 37), "Sun, 06 Nov 1994 08:49:37 GMT"), + (0, "Thu, 01 Jan 1970 00:00:00 GMT"), + (datetime(1970, 1, 1), "Thu, 01 Jan 1970 00:00:00 GMT"), + (datetime(1, 1, 1), "Mon, 01 Jan 0001 00:00:00 GMT"), + (datetime(999, 1, 1), "Tue, 01 Jan 0999 00:00:00 GMT"), + (datetime(1000, 1, 1), "Wed, 01 Jan 1000 00:00:00 GMT"), + (datetime(2020, 1, 1), "Wed, 01 Jan 2020 00:00:00 GMT"), + (date(2020, 1, 1), "Wed, 01 Jan 2020 00:00:00 GMT"), + ], +) +def test_http_date(value, expect): + assert http.http_date(value) == expect diff --git a/tests/test_internal.py b/tests/test_internal.py new file mode 100644 index 0000000..6e673fd --- /dev/null +++ b/tests/test_internal.py @@ -0,0 +1,56 @@ +from warnings import filterwarnings +from warnings import resetwarnings + +import pytest + +from werkzeug import _internal as internal +from werkzeug.test import create_environ +from werkzeug.wrappers import Request +from werkzeug.wrappers import Response + + +def test_easteregg(): + req = Request.from_values("/?macgybarchakku") + resp = Response.force_type(internal._easteregg(None), req) + assert b"About Werkzeug" in resp.get_data() + assert b"the Swiss Army knife of Python web development" in resp.get_data() + + +def test_wrapper_internals(): + req = Request.from_values(data={"foo": "bar"}, method="POST") + req._load_form_data() + assert req.form.to_dict() == {"foo": "bar"} + + # second call does not break + req._load_form_data() + assert req.form.to_dict() == {"foo": "bar"} + + # check reprs + assert repr(req) == "" + resp = Response() + assert repr(resp) == "" + resp.set_data("Hello World!") + assert repr(resp) == "" + resp.response = iter(["Test"]) + assert repr(resp) == "" + + # string data does not set content length + response = Response(["Hällo Wörld"]) + headers = response.get_wsgi_headers(create_environ()) + assert "Content-Length" not in headers + + response = Response(["Hällo Wörld".encode()]) + headers = response.get_wsgi_headers(create_environ()) + assert "Content-Length" in headers + + # check for internal warnings + filterwarnings("error", category=Warning) + response = Response() + environ = create_environ() + response.response = "What the...?" + pytest.raises(Warning, lambda: list(response.iter_encoded())) + pytest.raises(Warning, lambda: list(response.get_app_iter(environ))) + response.direct_passthrough = True + pytest.raises(Warning, lambda: list(response.iter_encoded())) + pytest.raises(Warning, lambda: list(response.get_app_iter(environ))) + resetwarnings() diff --git a/tests/test_local.py b/tests/test_local.py new file mode 100644 index 0000000..2af69d2 --- /dev/null +++ b/tests/test_local.py @@ -0,0 +1,615 @@ +import asyncio +import copy +import math +import operator +import time +from contextvars import ContextVar +from threading import Thread + +import pytest + +from werkzeug import local + +# Since the tests are creating local instances, use global context vars +# to avoid accumulating anonymous context vars that can't be collected. +_cv_ns = ContextVar("werkzeug.tests.ns") +_cv_stack = ContextVar("werkzeug.tests.stack") +_cv_val = ContextVar("werkzeug.tests.val") + + +@pytest.fixture(autouse=True) +def reset_context_vars(): + ns_token = _cv_ns.set({}) + stack_token = _cv_stack.set([]) + yield + _cv_ns.reset(ns_token) + _cv_stack.reset(stack_token) + + +def test_basic_local(): + ns = local.Local(_cv_ns) + ns.foo = 0 + values = [] + + def value_setter(idx): + time.sleep(0.01 * idx) + ns.foo = idx + time.sleep(0.02) + values.append(ns.foo) + + threads = [Thread(target=value_setter, args=(x,)) for x in [1, 2, 3]] + for thread in threads: + thread.start() + for thread in threads: + thread.join() + assert sorted(values) == [1, 2, 3] + + def delfoo(): + del ns.foo + + delfoo() + pytest.raises(AttributeError, lambda: ns.foo) + pytest.raises(AttributeError, delfoo) + + local.release_local(ns) + + +def test_basic_local_asyncio(): + ns = local.Local(_cv_ns) + ns.foo = 0 + values = [] + + async def value_setter(idx): + await asyncio.sleep(0.01 * idx) + ns.foo = idx + await asyncio.sleep(0.02) + values.append(ns.foo) + + async def main(): + futures = [asyncio.ensure_future(value_setter(i)) for i in [1, 2, 3]] + await asyncio.gather(*futures) + + asyncio.run(main()) + assert sorted(values) == [1, 2, 3] + + def delfoo(): + del ns.foo + + delfoo() + pytest.raises(AttributeError, lambda: ns.foo) + pytest.raises(AttributeError, delfoo) + + local.release_local(ns) + + +def test_local_release(): + ns = local.Local(_cv_ns) + ns.foo = 42 + local.release_local(ns) + assert not hasattr(ns, "foo") + + ls = local.LocalStack(_cv_stack) + ls.push(42) + local.release_local(ls) + assert ls.top is None + + +def test_local_stack(): + ls = local.LocalStack(_cv_stack) + assert ls.top is None + ls.push(42) + assert ls.top == 42 + ls.push(23) + assert ls.top == 23 + ls.pop() + assert ls.top == 42 + ls.pop() + assert ls.top is None + assert ls.pop() is None + assert ls.pop() is None + + proxy = ls() + ls.push([1, 2]) + assert proxy == [1, 2] + ls.push((1, 2)) + assert proxy == (1, 2) + ls.pop() + ls.pop() + assert repr(proxy) == "" + + +def test_local_stack_asyncio(): + ls = local.LocalStack(_cv_stack) + ls.push(1) + + async def task(): + ls.push(1) + assert len(ls._storage.get()) == 2 + + async def main(): + futures = [asyncio.ensure_future(task()) for _ in range(3)] + await asyncio.gather(*futures) + + asyncio.run(main()) + + +def test_proxy_local(): + ns = local.Local(_cv_ns) + ns.foo = [] + p = local.LocalProxy(ns, "foo") + p.append(42) + p.append(23) + p[1:] = [1, 2, 3] + assert p == [42, 1, 2, 3] + assert p == ns.foo + ns.foo += [1] + assert list(p) == [42, 1, 2, 3, 1] + p_from_local = ns("foo") + p_from_local.append(2) + assert p == p_from_local + assert p._get_current_object() is ns.foo + + +def test_proxy_callable(): + value = 42 + p = local.LocalProxy(lambda: value) + assert p == 42 + value = [23] + p.append(42) + assert p == [23, 42] + assert value == [23, 42] + assert p._get_current_object() is value + + +def test_proxy_wrapped(): + class SomeClassWithWrapped: + __wrapped__ = "wrapped" + + proxy = local.LocalProxy(_cv_val) + assert proxy.__wrapped__ is _cv_val + _cv_val.set(42) + + with pytest.raises(AttributeError): + proxy.__wrapped__ + + ns = local.Local(_cv_ns) + ns.foo = SomeClassWithWrapped() + ns.bar = 42 + + assert ns("foo").__wrapped__ == "wrapped" + + with pytest.raises(AttributeError): + ns("bar").__wrapped__ + + +def test_proxy_doc(): + def example(): + """example doc""" + + assert local.LocalProxy(lambda: example).__doc__ == "example doc" + # The __doc__ descriptor shouldn't block the LocalProxy's class doc. + assert local.LocalProxy.__doc__.startswith("A proxy") + + +def test_proxy_fallback(): + local_stack = local.LocalStack(_cv_stack) + local_proxy = local_stack() + + assert repr(local_proxy) == "" + assert isinstance(local_proxy, local.LocalProxy) + assert local_proxy.__class__ is local.LocalProxy + assert "LocalProxy" in local_proxy.__doc__ + + local_stack.push(42) + + assert repr(local_proxy) == "42" + assert isinstance(local_proxy, int) + assert local_proxy.__class__ is int + assert "int(" in local_proxy.__doc__ + + +def test_proxy_unbound(): + ns = local.Local(_cv_ns) + p = ns("value") + assert repr(p) == "" + assert not p + assert dir(p) == [] + + +def _make_proxy(value): + ns = local.Local(_cv_ns) + ns.value = value + p = ns("value") + return ns, p + + +def test_proxy_type(): + _, p = _make_proxy([]) + assert isinstance(p, list) + assert p.__class__ is list + assert issubclass(type(p), local.LocalProxy) + assert type(p) is local.LocalProxy + + +def test_proxy_string_representations(): + class Example: + def __repr__(self): + return "a" + + def __bytes__(self): + return b"b" + + def __index__(self): + return 23 + + _, p = _make_proxy(Example()) + assert str(p) == "a" + assert repr(p) == "a" + assert bytes(p) == b"b" + # __index__ + assert bin(p) == "0b10111" + assert oct(p) == "0o27" + assert hex(p) == "0x17" + + +def test_proxy_hash(): + ns, p = _make_proxy("abc") + assert hash(ns.value) == hash(p) + + +@pytest.mark.parametrize( + "op", + [ + operator.lt, + operator.le, + operator.eq, + operator.ne, + operator.gt, + operator.ge, + operator.add, + operator.sub, + operator.mul, + operator.truediv, + operator.floordiv, + operator.mod, + divmod, + pow, + operator.lshift, + operator.rshift, + operator.and_, + operator.or_, + operator.xor, + ], +) +def test_proxy_binop_int(op): + _, p = _make_proxy(2) + assert op(p, 3) == op(2, 3) + # r-op + assert op(3, p) == op(3, 2) + + +@pytest.mark.parametrize("op", [operator.neg, operator.pos, abs, operator.invert]) +def test_proxy_uop_int(op): + _, p = _make_proxy(-2) + assert op(p) == op(-2) + + +def test_proxy_numeric(): + class Example: + def __complex__(self): + return 1 + 2j + + def __int__(self): + return 1 + + def __float__(self): + return 2.1 + + def __round__(self, n=None): + if n is not None: + return 3.3 + + return 3 + + def __trunc__(self): + return 4 + + def __floor__(self): + return 5 + + def __ceil__(self): + return 6 + + def __index__(self): + return 2 + + _, p = _make_proxy(Example()) + assert complex(p) == 1 + 2j + assert int(p) == 1 + assert float(p) == 2.1 + assert round(p) == 3 + assert round(p, 2) == 3.3 + assert math.trunc(p) == 4 + assert math.floor(p) == 5 + assert math.ceil(p) == 6 + assert [1, 2, 3][p] == 3 # __index__ + + +@pytest.mark.parametrize( + "op", + [ + operator.iadd, + operator.isub, + operator.imul, + operator.imatmul, + operator.itruediv, + operator.ifloordiv, + operator.imod, + operator.ipow, + operator.ilshift, + operator.irshift, + operator.iand, + operator.ior, + operator.ixor, + ], +) +def test_proxy_iop(op): + class Example: + value = 1 + + def fake_op(self, other): + self.value = other + return self + + __iadd__ = fake_op + __isub__ = fake_op + __imul__ = fake_op + __imatmul__ = fake_op + __itruediv__ = fake_op + __ifloordiv__ = fake_op + __imod__ = fake_op + __ipow__ = fake_op + __ilshift__ = fake_op + __irshift__ = fake_op + __iand__ = fake_op + __ior__ = fake_op + __ixor__ = fake_op + + ns, p = _make_proxy(Example()) + p_out = op(p, 2) + assert type(p_out) is local.LocalProxy + assert p.value == 2 + assert ns.value.value == 2 + + +def test_proxy_matmul(): + class Example: + def __matmul__(self, other): + return 2 * other + + def __rmatmul__(self, other): + return 2 * other + + _, p = _make_proxy(Example()) + assert p @ 3 == 6 + assert 4 @ p == 8 + + +def test_proxy_str(): + _, p = _make_proxy("{act} %s") + assert p + " world" == "{act} %s world" + assert "say " + p == "say {act} %s" + assert p * 2 == "{act} %s{act} %s" + assert 2 * p == p * 2 + assert p % ("world",) == "{act} world" + assert p.format(act="test") == "test %s" + + +def test_proxy_list(): + _, p = _make_proxy([1, 2, 3]) + assert len(p) == 3 + assert p[0] == 1 + assert 3 in p + assert 4 not in p + assert tuple(p) == (1, 2, 3) + assert list(reversed(p)) == [3, 2, 1] + p[0] = 4 + assert p == [4, 2, 3] + del p[-1] + assert p == [4, 2] + p += [5] + assert p[-1] == 5 + p *= 2 + assert len(p) == 6 + p[:] = [] + assert not p + p.append(1) + assert p + assert p + [2] == [1, 2] + assert [2] + p == [2, 1] + + +def test_proxy_copy(): + class Foo: + def __copy__(self): + return self + + def __deepcopy__(self, memo): + return self + + ns, p = _make_proxy(Foo()) + assert copy.copy(p) is ns.value + assert copy.deepcopy(p) is ns.value + + a = [] + _, p = _make_proxy([a]) + assert copy.copy(p) == [a] + assert copy.copy(p)[0] is a + assert copy.deepcopy(p) == [a] + assert copy.deepcopy(p)[0] is not a + + +def test_proxy_iterator(): + a = [1, 2, 3] + _, p = _make_proxy(iter(a)) + assert next(p) == 1 + + +def test_proxy_length_hint(): + class Example: + def __length_hint__(self): + return 2 + + _, p = _make_proxy(Example()) + assert operator.length_hint(p) == 2 + + +def test_proxy_context_manager(): + class Example: + value = 2 + + def __enter__(self): + self.value += 1 + return self + + def __exit__(self, exc_type, exc_val, exc_tb): + self.value -= 1 + + _, p = _make_proxy(Example()) + assert p.value == 2 + + with p: + assert p.value == 3 + + assert p.value == 2 + + +def test_proxy_class(): + class Meta(type): + def __instancecheck__(cls, instance): + return True + + def __subclasscheck__(cls, subclass): + return True + + class Parent: + pass + + class Example(Parent, metaclass=Meta): + pass + + class Child(Example): + pass + + _, p = _make_proxy(Example) + assert type(p()) is Example + assert isinstance(1, p) + assert issubclass(int, p) + assert p.__mro__ == (Example, Parent, object) + assert p.__bases__ == (Parent,) + assert p.__subclasses__() == [Child] + + +def test_proxy_attributes(): + class Example: + def __init__(self): + object.__setattr__(self, "values", {}) + + def __getattribute__(self, name): + if name == "ham": + return "eggs" + + return super().__getattribute__(name) + + def __getattr__(self, name): + return self.values.get(name) + + def __setattr__(self, name, value): + self.values[name] = value + + def __delattr__(self, name): + del self.values[name] + + def __dir__(self): + return sorted(self.values.keys()) + + _, p = _make_proxy(Example()) + assert p.nothing is None + assert p.__dict__ == {"values": {}} + assert dir(p) == [] + + p.x = 1 + assert p.x == 1 + assert dir(p) == ["x"] + + del p.x + assert dir(p) == [] + + assert p.ham == "eggs" + p.ham = "spam" + assert p.ham == "eggs" + assert p.values["ham"] == "spam" + + +def test_proxy_await(): + async def get(): + return 1 + + _, p = _make_proxy(get()) + + async def main(): + return await p + + out = asyncio.run(main()) + assert out == 1 + + +def test_proxy_aiter(): + class Example: + value = 3 + + def __aiter__(self): + return self + + async def __anext__(self): + if self.value: + self.value -= 1 + return self.value + + raise StopAsyncIteration + + _, p = _make_proxy(Example()) + + async def main(): + out = [] + + async for v in p: + out.append(v) + + return out + + out = asyncio.run(main()) + assert out == [2, 1, 0] + + +def test_proxy_async_context_manager(): + class Example: + value = 2 + + async def __aenter__(self): + self.value += 1 + return self + + async def __aexit__(self, exc_type, exc_val, exc_tb): + self.value -= 1 + + _, p = _make_proxy(Example()) + + async def main(): + async with p: + assert p.value == 3 + + assert p.value == 2 + return True + + assert asyncio.run(main()) diff --git a/tests/test_routing.py b/tests/test_routing.py new file mode 100644 index 0000000..15d25a7 --- /dev/null +++ b/tests/test_routing.py @@ -0,0 +1,1490 @@ +import gc +import typing as t +import uuid + +import pytest + +from werkzeug import routing as r +from werkzeug.datastructures import ImmutableDict +from werkzeug.datastructures import MultiDict +from werkzeug.exceptions import MethodNotAllowed +from werkzeug.exceptions import NotFound +from werkzeug.test import create_environ +from werkzeug.wrappers import Response + + +def test_basic_routing(): + map = r.Map( + [ + r.Rule("/", endpoint="index"), + r.Rule("/foo", endpoint="foo"), + r.Rule("/bar/", endpoint="bar"), + r.Rule("/ws", endpoint="ws", websocket=True), + r.Rule("/", endpoint="indexws", websocket=True), + ] + ) + adapter = map.bind("example.org", "/") + assert adapter.match("/") == ("index", {}) + assert adapter.match("/foo") == ("foo", {}) + assert adapter.match("/bar/") == ("bar", {}) + pytest.raises(r.RequestRedirect, lambda: adapter.match("/bar")) + pytest.raises(NotFound, lambda: adapter.match("/blub")) + + adapter = map.bind("example.org", "/", url_scheme="ws") + assert adapter.match("/") == ("indexws", {}) + + adapter = map.bind("example.org", "/test") + with pytest.raises(r.RequestRedirect) as excinfo: + adapter.match("/bar") + assert excinfo.value.new_url == "http://example.org/test/bar/" + + adapter = map.bind("example.org", "/") + with pytest.raises(r.RequestRedirect) as excinfo: + adapter.match("/bar") + assert excinfo.value.new_url == "http://example.org/bar/" + + adapter = map.bind("example.org", "/") + with pytest.raises(r.RequestRedirect) as excinfo: + adapter.match("/bar", query_args={"aha": "muhaha"}) + assert excinfo.value.new_url == "http://example.org/bar/?aha=muhaha" + + adapter = map.bind("example.org", "/") + with pytest.raises(r.RequestRedirect) as excinfo: + adapter.match("/bar", query_args="aha=muhaha") + assert excinfo.value.new_url == "http://example.org/bar/?aha=muhaha" + + adapter = map.bind_to_environ(create_environ("/bar?foo=bar", "http://example.org/")) + with pytest.raises(r.RequestRedirect) as excinfo: + adapter.match() + assert excinfo.value.new_url == "http://example.org/bar/?foo=bar" + + adapter = map.bind("example.org", "/ws", url_scheme="wss") + assert adapter.match("/ws", websocket=True) == ("ws", {}) + with pytest.raises(r.WebsocketMismatch): + adapter.match("/ws", websocket=False) + with pytest.raises(r.WebsocketMismatch): + adapter.match("/foo", websocket=True) + + adapter = map.bind_to_environ( + create_environ( + "/ws?foo=bar", + "http://example.org/", + headers=[("Connection", "Upgrade"), ("upgrade", "WebSocket")], + ) + ) + assert adapter.match("/ws") == ("ws", {}) + with pytest.raises(r.WebsocketMismatch): + adapter.match("/ws", websocket=False) + + adapter = map.bind_to_environ( + create_environ( + "/ws?foo=bar", + "http://example.org/", + headers=[("Connection", "keep-alive, Upgrade"), ("upgrade", "websocket")], + ) + ) + assert adapter.match("/ws") == ("ws", {}) + with pytest.raises(r.WebsocketMismatch): + adapter.match("/ws", websocket=False) + + +def test_merge_slashes_match(): + url_map = r.Map( + [ + r.Rule("/no/tail", endpoint="no_tail"), + r.Rule("/yes/tail/", endpoint="yes_tail"), + r.Rule("/with/", endpoint="with_path"), + r.Rule("/no//merge", endpoint="no_merge", merge_slashes=False), + ] + ) + adapter = url_map.bind("localhost", "/") + + with pytest.raises(r.RequestRedirect) as excinfo: + adapter.match("/no//tail") + + assert excinfo.value.new_url.endswith("/no/tail") + + with pytest.raises(r.RequestRedirect) as excinfo: + adapter.match("/yes//tail") + + assert excinfo.value.new_url.endswith("/yes/tail/") + + with pytest.raises(r.RequestRedirect) as excinfo: + adapter.match("/yes/tail//") + + assert excinfo.value.new_url.endswith("/yes/tail/") + + assert adapter.match("/no/tail")[0] == "no_tail" + assert adapter.match("/yes/tail/")[0] == "yes_tail" + + _, rv = adapter.match("/with/http://example.com/") + assert rv["path"] == "http://example.com/" + _, rv = adapter.match("/with/x//y") + assert rv["path"] == "x//y" + + assert adapter.match("/no//merge")[0] == "no_merge" + + +@pytest.mark.parametrize( + ("path", "expected"), + [("/merge/%//path", "/merge/%25/path"), ("/merge//st/path", "/merge/st/path")], +) +def test_merge_slash_encoding(path, expected): + """This test is to make sure URLs are not double-encoded + when a redirect is thrown with `merge_slash = True`""" + url_map = r.Map( + [ + r.Rule("/merge//path"), + ] + ) + adapter = url_map.bind("localhost", "/") + + with pytest.raises(r.RequestRedirect) as excinfo: + adapter.match(path) + + assert excinfo.value.new_url.endswith(expected) + + +def test_merge_slashes_build(): + url_map = r.Map( + [ + r.Rule("/yes//merge", endpoint="yes_merge"), + r.Rule("/no//merge", endpoint="no_merge", merge_slashes=False), + ] + ) + adapter = url_map.bind("localhost", "/") + assert adapter.build("yes_merge") == "/yes/merge" + assert adapter.build("no_merge") == "/no//merge" + + +def test_strict_slashes_redirect(): + map = r.Map( + [ + r.Rule("/bar/", endpoint="get", methods=["GET"]), + r.Rule("/bar", endpoint="post", methods=["POST"]), + r.Rule("/foo/", endpoint="foo", methods=["POST"]), + ] + ) + adapter = map.bind("example.org", "/") + + # Check if the actual routes works + assert adapter.match("/bar/", method="GET") == ("get", {}) + assert adapter.match("/bar", method="POST") == ("post", {}) + + # Check if exceptions are correct + pytest.raises(r.RequestRedirect, adapter.match, "/bar", method="GET") + pytest.raises(MethodNotAllowed, adapter.match, "/bar/", method="POST") + with pytest.raises(r.RequestRedirect) as error_info: + adapter.match("/foo", method="POST") + assert error_info.value.code == 308 + + # Check differently defined order + map = r.Map( + [ + r.Rule("/bar", endpoint="post", methods=["POST"]), + r.Rule("/bar/", endpoint="get", methods=["GET"]), + ] + ) + adapter = map.bind("example.org", "/") + + # Check if the actual routes works + assert adapter.match("/bar/", method="GET") == ("get", {}) + assert adapter.match("/bar", method="POST") == ("post", {}) + + # Check if exceptions are correct + pytest.raises(r.RequestRedirect, adapter.match, "/bar", method="GET") + pytest.raises(MethodNotAllowed, adapter.match, "/bar/", method="POST") + + # Check what happens when only slash route is defined + map = r.Map([r.Rule("/bar/", endpoint="get", methods=["GET"])]) + adapter = map.bind("example.org", "/") + + # Check if the actual routes works + assert adapter.match("/bar/", method="GET") == ("get", {}) + + # Check if exceptions are correct + pytest.raises(r.RequestRedirect, adapter.match, "/bar", method="GET") + pytest.raises(MethodNotAllowed, adapter.match, "/bar/", method="POST") + + +def test_strict_slashes_leaves_dont_consume(): + # See issue #1074 + map = r.Map( + [ + r.Rule("/path1", endpoint="leaf"), + r.Rule("/path1/", endpoint="branch"), + r.Rule("/path2", endpoint="leaf", strict_slashes=False), + r.Rule("/path2/", endpoint="branch"), + r.Rule("/path3", endpoint="leaf"), + r.Rule("/path3/", endpoint="branch", strict_slashes=False), + r.Rule("/path4", endpoint="leaf", strict_slashes=False), + r.Rule("/path4/", endpoint="branch", strict_slashes=False), + r.Rule("/path5", endpoint="leaf"), + ], + strict_slashes=False, + ) + + adapter = map.bind("example.org", "/") + + assert adapter.match("/path1", method="GET") == ("leaf", {}) + assert adapter.match("/path1/", method="GET") == ("branch", {}) + assert adapter.match("/path2", method="GET") == ("leaf", {}) + assert adapter.match("/path2/", method="GET") == ("branch", {}) + assert adapter.match("/path3", method="GET") == ("leaf", {}) + assert adapter.match("/path3/", method="GET") == ("branch", {}) + assert adapter.match("/path4", method="GET") == ("leaf", {}) + assert adapter.match("/path4/", method="GET") == ("branch", {}) + assert adapter.match("/path5/", method="GET") == ("leaf", {}) + + +def test_environ_defaults(): + environ = create_environ("/foo") + assert environ["PATH_INFO"] == "/foo" + m = r.Map([r.Rule("/foo", endpoint="foo"), r.Rule("/bar", endpoint="bar")]) + a = m.bind_to_environ(environ) + assert a.match("/foo") == ("foo", {}) + assert a.match() == ("foo", {}) + assert a.match("/bar") == ("bar", {}) + pytest.raises(NotFound, a.match, "/bars") + + +def test_environ_nonascii_pathinfo(): + environ = create_environ("/лошадь") + m = r.Map([r.Rule("/", endpoint="index"), r.Rule("/лошадь", endpoint="horse")]) + a = m.bind_to_environ(environ) + assert a.match("/") == ("index", {}) + assert a.match("/лошадь") == ("horse", {}) + pytest.raises(NotFound, a.match, "/барсук") + + +def test_basic_building(): + map = r.Map( + [ + r.Rule("/", endpoint="index"), + r.Rule("/foo", endpoint="foo"), + r.Rule("/bar/", endpoint="bar"), + r.Rule("/bar/", endpoint="bari"), + r.Rule("/bar/", endpoint="barf"), + r.Rule("/bar/", endpoint="barp"), + r.Rule("/hehe", endpoint="blah", subdomain="blah"), + r.Rule("/ws", endpoint="ws", websocket=True), + ] + ) + adapter = map.bind("example.org", "/", subdomain="blah") + + assert adapter.build("index", {}) == "http://example.org/" + assert adapter.build("foo", {}) == "http://example.org/foo" + assert adapter.build("bar", {"baz": "blub"}) == "http://example.org/bar/blub" + assert adapter.build("bari", {"bazi": 50}) == "http://example.org/bar/50" + assert adapter.build("barf", {"bazf": 0.815}) == "http://example.org/bar/0.815" + assert adapter.build("barp", {"bazp": "la/di"}) == "http://example.org/bar/la/di" + assert adapter.build("blah", {}) == "/hehe" + pytest.raises(r.BuildError, lambda: adapter.build("urks")) + + adapter = map.bind("example.org", "/test", subdomain="blah") + assert adapter.build("index", {}) == "http://example.org/test/" + assert adapter.build("foo", {}) == "http://example.org/test/foo" + assert adapter.build("bar", {"baz": "blub"}) == "http://example.org/test/bar/blub" + assert adapter.build("bari", {"bazi": 50}) == "http://example.org/test/bar/50" + assert adapter.build("barf", {"bazf": 0.815}) == "http://example.org/test/bar/0.815" + assert ( + adapter.build("barp", {"bazp": "la/di"}) == "http://example.org/test/bar/la/di" + ) + assert adapter.build("blah", {}) == "/test/hehe" + + adapter = map.bind("example.org") + assert adapter.build("foo", {}) == "/foo" + assert adapter.build("foo", {}, force_external=True) == "http://example.org/foo" + adapter = map.bind("example.org", url_scheme="") + assert adapter.build("foo", {}) == "/foo" + assert adapter.build("foo", {}, force_external=True) == "//example.org/foo" + assert ( + adapter.build("foo", {}, url_scheme="https", force_external=True) + == "https://example.org/foo" + ) + + adapter = map.bind("example.org", url_scheme="ws") + assert adapter.build("ws", {}) == "ws://example.org/ws" + assert adapter.build("foo", {}, force_external=True) == "http://example.org/foo" + assert adapter.build("foo", {}) == "/foo" + assert adapter.build("ws", {}, url_scheme="https") == "wss://example.org/ws" + + +def test_long_build(): + long_args = {f"v{x}": x for x in range(10000)} + map = r.Map( + [ + r.Rule( + "".join(f"/<{k}>" for k in long_args.keys()), + endpoint="bleep", + build_only=True, + ) + ] + ) + adapter = map.bind("localhost", "/") + url = f"{adapter.build('bleep', long_args)}/" + for v in long_args.values(): + assert f"/{v}" in url + + +def test_defaults(): + map = r.Map( + [ + r.Rule("/foo/", defaults={"page": 1}, endpoint="foo"), + r.Rule("/foo/", endpoint="foo"), + ] + ) + adapter = map.bind("example.org", "/") + + assert adapter.match("/foo/") == ("foo", {"page": 1}) + pytest.raises(r.RequestRedirect, lambda: adapter.match("/foo/1")) + assert adapter.match("/foo/2") == ("foo", {"page": 2}) + assert adapter.build("foo", {}) == "/foo/" + assert adapter.build("foo", {"page": 1}) == "/foo/" + assert adapter.build("foo", {"page": 2}) == "/foo/2" + + +def test_negative(): + map = r.Map( + [ + r.Rule("/foos/", endpoint="foos"), + r.Rule("/bars/", endpoint="bars"), + r.Rule("/foo/", endpoint="foo"), + r.Rule("/bar/", endpoint="bar"), + ] + ) + adapter = map.bind("example.org", "/") + + assert adapter.match("/foos/-2") == ("foos", {"page": -2}) + assert adapter.match("/foos/-50") == ("foos", {"page": -50}) + assert adapter.match("/bars/-2.0") == ("bars", {"page": -2.0}) + assert adapter.match("/bars/-0.185") == ("bars", {"page": -0.185}) + + # Make sure signed values are rejected in unsigned mode + pytest.raises(NotFound, lambda: adapter.match("/foo/-2")) + pytest.raises(NotFound, lambda: adapter.match("/foo/-50")) + pytest.raises(NotFound, lambda: adapter.match("/bar/-0.185")) + pytest.raises(NotFound, lambda: adapter.match("/bar/-2.0")) + + +def test_greedy(): + map = r.Map( + [ + r.Rule("/foo", endpoint="foo"), + r.Rule("/", endpoint="bar"), + r.Rule("//", endpoint="bar"), + ] + ) + adapter = map.bind("example.org", "/") + + assert adapter.match("/foo") == ("foo", {}) + assert adapter.match("/blub") == ("bar", {"bar": "blub"}) + assert adapter.match("/he/he") == ("bar", {"bar": "he", "blub": "he"}) + + assert adapter.build("foo", {}) == "/foo" + assert adapter.build("bar", {"bar": "blub"}) == "/blub" + assert adapter.build("bar", {"bar": "blub", "blub": "bar"}) == "/blub/bar" + + +def test_path(): + map = r.Map( + [ + r.Rule("/", defaults={"name": "FrontPage"}, endpoint="page"), + r.Rule("/Special", endpoint="special"), + r.Rule("/", endpoint="year"), + r.Rule("/:foo", endpoint="foopage"), + r.Rule("/:", endpoint="twopage"), + r.Rule("/", endpoint="page"), + r.Rule("//edit", endpoint="editpage"), + r.Rule("//silly/", endpoint="sillypage"), + r.Rule("//silly//edit", endpoint="editsillypage"), + r.Rule("/Talk:", endpoint="talk"), + r.Rule("/User:", endpoint="user"), + r.Rule("/User:/", endpoint="userpage"), + r.Rule( + "/User:/comment/-", + endpoint="usercomment", + ), + r.Rule("/Files/", endpoint="files"), + r.Rule("///", endpoint="admin"), + ] + ) + adapter = map.bind("example.org", "/") + + assert adapter.match("/") == ("page", {"name": "FrontPage"}) + pytest.raises(r.RequestRedirect, lambda: adapter.match("/FrontPage")) + assert adapter.match("/Special") == ("special", {}) + assert adapter.match("/2007") == ("year", {"year": 2007}) + assert adapter.match("/Some:foo") == ("foopage", {"name": "Some"}) + assert adapter.match("/Some:bar") == ("twopage", {"name": "Some", "name2": "bar"}) + assert adapter.match("/Some/Page") == ("page", {"name": "Some/Page"}) + assert adapter.match("/Some/Page/edit") == ("editpage", {"name": "Some/Page"}) + assert adapter.match("/Foo/silly/bar") == ( + "sillypage", + {"name": "Foo", "name2": "bar"}, + ) + assert adapter.match("/Foo/silly/bar/edit") == ( + "editsillypage", + {"name": "Foo", "name2": "bar"}, + ) + assert adapter.match("/Talk:Foo/Bar") == ("talk", {"name": "Foo/Bar"}) + assert adapter.match("/User:thomas") == ("user", {"username": "thomas"}) + assert adapter.match("/User:thomas/projects/werkzeug") == ( + "userpage", + {"username": "thomas", "name": "projects/werkzeug"}, + ) + assert adapter.match("/User:thomas/comment/123-456") == ( + "usercomment", + {"username": "thomas", "id": 123, "replyId": 456}, + ) + assert adapter.match("/Files/downloads/werkzeug/0.2.zip") == ( + "files", + {"file": "downloads/werkzeug/0.2.zip"}, + ) + assert adapter.match("/Jerry/eats/cheese") == ( + "admin", + {"admin": "Jerry", "manage": "eats", "things": "cheese"}, + ) + + +def test_dispatch(): + env = create_environ("/") + map = r.Map([r.Rule("/", endpoint="root"), r.Rule("/foo/", endpoint="foo")]) + adapter = map.bind_to_environ(env) + + raise_this = None + + def view_func(endpoint, values): + if raise_this is not None: + raise raise_this + return Response(repr((endpoint, values))) + + def dispatch(path, quiet=False): + return Response.force_type( + adapter.dispatch(view_func, path, catch_http_exceptions=quiet), env + ) + + assert dispatch("/").data == b"('root', {})" + assert dispatch("/foo").status_code == 308 + raise_this = NotFound() + pytest.raises(NotFound, lambda: dispatch("/bar")) + assert dispatch("/bar", True).status_code == 404 + + +def test_http_host_before_server_name(): + env = { + "HTTP_HOST": "wiki.example.com", + "SERVER_NAME": "web0.example.com", + "SERVER_PORT": "80", + "SCRIPT_NAME": "", + "PATH_INFO": "", + "REQUEST_METHOD": "GET", + "wsgi.url_scheme": "http", + } + map = r.Map([r.Rule("/", endpoint="index", subdomain="wiki")]) + adapter = map.bind_to_environ(env, server_name="example.com") + assert adapter.match("/") == ("index", {}) + assert adapter.build("index", force_external=True) == "http://wiki.example.com/" + assert adapter.build("index") == "/" + + env["HTTP_HOST"] = "admin.example.com" + adapter = map.bind_to_environ(env, server_name="example.com") + assert adapter.build("index") == "http://wiki.example.com/" + + +def test_invalid_subdomain_warning(): + env = create_environ("/foo") + env["SERVER_NAME"] = env["HTTP_HOST"] = "foo.example.com" + m = r.Map([r.Rule("/foo", endpoint="foo")]) + with pytest.warns(UserWarning) as record: + a = m.bind_to_environ(env, server_name="bar.example.com") + assert a.subdomain == "" + assert len(record) == 1 + + +@pytest.mark.parametrize( + ("base", "name"), + (("http://localhost", "localhost:80"), ("https://localhost", "localhost:443")), +) +def test_server_name_match_default_port(base, name): + environ = create_environ("/foo", base_url=base) + map = r.Map([r.Rule("/foo", endpoint="foo")]) + adapter = map.bind_to_environ(environ, server_name=name) + assert adapter.match() == ("foo", {}) + + +def test_adapter_url_parameter_sorting(): + map = r.Map( + [r.Rule("/", endpoint="index")], sort_parameters=True, sort_key=lambda x: x[1] + ) + adapter = map.bind("localhost", "/") + assert ( + adapter.build("index", {"x": 20, "y": 10, "z": 30}, force_external=True) + == "http://localhost/?y=10&x=20&z=30" + ) + + +def test_request_direct_charset_bug(): + map = r.Map([r.Rule("/öäü/")]) + adapter = map.bind("localhost", "/") + + with pytest.raises(r.RequestRedirect) as excinfo: + adapter.match("/öäü") + assert excinfo.value.new_url == "http://localhost/%C3%B6%C3%A4%C3%BC/" + + +def test_request_redirect_default(): + map = r.Map([r.Rule("/foo", defaults={"bar": 42}), r.Rule("/foo/")]) + adapter = map.bind("localhost", "/") + + with pytest.raises(r.RequestRedirect) as excinfo: + adapter.match("/foo/42") + assert excinfo.value.new_url == "http://localhost/foo" + + +def test_request_redirect_default_subdomain(): + map = r.Map( + [ + r.Rule("/foo", defaults={"bar": 42}, subdomain="test"), + r.Rule("/foo/", subdomain="other"), + ] + ) + adapter = map.bind("localhost", "/", subdomain="other") + + with pytest.raises(r.RequestRedirect) as excinfo: + adapter.match("/foo/42") + assert excinfo.value.new_url == "http://test.localhost/foo" + + +def test_adapter_match_return_rule(): + rule = r.Rule("/foo/", endpoint="foo") + map = r.Map([rule]) + adapter = map.bind("localhost", "/") + assert adapter.match("/foo/", return_rule=True) == (rule, {}) + + +def test_server_name_interpolation(): + server_name = "example.invalid" + map = r.Map( + [r.Rule("/", endpoint="index"), r.Rule("/", endpoint="alt", subdomain="alt")] + ) + + env = create_environ("/", f"http://{server_name}/") + adapter = map.bind_to_environ(env, server_name=server_name) + assert adapter.match() == ("index", {}) + + env = create_environ("/", f"http://alt.{server_name}/") + adapter = map.bind_to_environ(env, server_name=server_name) + assert adapter.match() == ("alt", {}) + + env = create_environ("/", f"http://{server_name}/") + + with pytest.warns(UserWarning): + adapter = map.bind_to_environ(env, server_name="foo") + assert adapter.subdomain == "" + + +def test_rule_emptying(): + rule = r.Rule("/foo", {"meh": "muh"}, "x", ["POST"], False, "x", True, None) + rule2 = rule.empty() + assert rule.__dict__ == rule2.__dict__ + rule.methods.add("GET") + assert rule.__dict__ != rule2.__dict__ + rule.methods.discard("GET") + rule.defaults["meh"] = "aha" + assert rule.__dict__ != rule2.__dict__ + + +def test_rule_unhashable(): + rule = r.Rule("/foo", {"meh": "muh"}, "x", ["POST"], False, "x", True, None) + pytest.raises(TypeError, hash, rule) + + +def test_rule_templates(): + testcase = r.RuleTemplate( + [ + r.Submount( + "/test/$app", + [ + r.Rule("/foo/", endpoint="handle_foo"), + r.Rule("/bar/", endpoint="handle_bar"), + r.Rule("/baz/", endpoint="handle_baz"), + ], + ), + r.EndpointPrefix( + "${app}", + [ + r.Rule("/${app}-blah", endpoint="bar"), + r.Rule("/${app}-meh", endpoint="baz"), + ], + ), + r.Subdomain( + "$app", + [r.Rule("/blah", endpoint="x_bar"), r.Rule("/meh", endpoint="x_baz")], + ), + ] + ) + + url_map = r.Map( + [ + testcase(app="test1"), + testcase(app="test2"), + testcase(app="test3"), + testcase(app="test4"), + ] + ) + + out = sorted((x.rule, x.subdomain, x.endpoint) for x in url_map.iter_rules()) + + assert out == [ + ("/blah", "test1", "x_bar"), + ("/blah", "test2", "x_bar"), + ("/blah", "test3", "x_bar"), + ("/blah", "test4", "x_bar"), + ("/meh", "test1", "x_baz"), + ("/meh", "test2", "x_baz"), + ("/meh", "test3", "x_baz"), + ("/meh", "test4", "x_baz"), + ("/test/test1/bar/", "", "handle_bar"), + ("/test/test1/baz/", "", "handle_baz"), + ("/test/test1/foo/", "", "handle_foo"), + ("/test/test2/bar/", "", "handle_bar"), + ("/test/test2/baz/", "", "handle_baz"), + ("/test/test2/foo/", "", "handle_foo"), + ("/test/test3/bar/", "", "handle_bar"), + ("/test/test3/baz/", "", "handle_baz"), + ("/test/test3/foo/", "", "handle_foo"), + ("/test/test4/bar/", "", "handle_bar"), + ("/test/test4/baz/", "", "handle_baz"), + ("/test/test4/foo/", "", "handle_foo"), + ("/test1-blah", "", "test1bar"), + ("/test1-meh", "", "test1baz"), + ("/test2-blah", "", "test2bar"), + ("/test2-meh", "", "test2baz"), + ("/test3-blah", "", "test3bar"), + ("/test3-meh", "", "test3baz"), + ("/test4-blah", "", "test4bar"), + ("/test4-meh", "", "test4baz"), + ] + + +def test_non_string_parts(): + m = r.Map([r.Rule("/", endpoint="foo")]) + a = m.bind("example.com") + assert a.build("foo", {"foo": 42}) == "/42" + + +def test_complex_routing_rules(): + m = r.Map( + [ + r.Rule("/", endpoint="index"), + r.Rule("/", endpoint="an_int"), + r.Rule("/", endpoint="a_string"), + r.Rule("/foo/", endpoint="nested"), + r.Rule("/foobar/", endpoint="nestedbar"), + r.Rule("/foo//", endpoint="nested_show"), + r.Rule("/foo//edit", endpoint="nested_edit"), + r.Rule("/users/", endpoint="users", defaults={"page": 1}), + r.Rule("/users/page/", endpoint="users"), + r.Rule("/foox", endpoint="foox"), + r.Rule("//", endpoint="barx_path_path"), + ] + ) + a = m.bind("example.com") + + assert a.match("/") == ("index", {}) + assert a.match("/42") == ("an_int", {"blub": 42}) + assert a.match("/blub") == ("a_string", {"blub": "blub"}) + assert a.match("/foo/") == ("nested", {}) + assert a.match("/foobar/") == ("nestedbar", {}) + assert a.match("/foo/1/2/3/") == ("nested_show", {"testing": "1/2/3"}) + assert a.match("/foo/1/2/3/edit") == ("nested_edit", {"testing": "1/2/3"}) + assert a.match("/users/") == ("users", {"page": 1}) + assert a.match("/users/page/2") == ("users", {"page": 2}) + assert a.match("/foox") == ("foox", {}) + assert a.match("/1/2/3") == ("barx_path_path", {"bar": "1", "blub": "2/3"}) + + assert a.build("index") == "/" + assert a.build("an_int", {"blub": 42}) == "/42" + assert a.build("a_string", {"blub": "test"}) == "/test" + assert a.build("nested") == "/foo/" + assert a.build("nestedbar") == "/foobar/" + assert a.build("nested_show", {"testing": "1/2/3"}) == "/foo/1/2/3/" + assert a.build("nested_edit", {"testing": "1/2/3"}) == "/foo/1/2/3/edit" + assert a.build("users", {"page": 1}) == "/users/" + assert a.build("users", {"page": 2}) == "/users/page/2" + assert a.build("foox") == "/foox" + assert a.build("barx_path_path", {"bar": "1", "blub": "2/3"}) == "/1/2/3" + + +def test_default_converters(): + class MyMap(r.Map): + default_converters = r.Map.default_converters.copy() + default_converters["foo"] = r.UnicodeConverter + + assert isinstance(r.Map.default_converters, ImmutableDict) + m = MyMap( + [ + r.Rule("/a/", endpoint="a"), + r.Rule("/b/", endpoint="b"), + r.Rule("/c/", endpoint="c"), + ], + converters={"bar": r.UnicodeConverter}, + ) + a = m.bind("example.org", "/") + assert a.match("/a/1") == ("a", {"a": "1"}) + assert a.match("/b/2") == ("b", {"b": "2"}) + assert a.match("/c/3") == ("c", {"c": "3"}) + assert "foo" not in r.Map.default_converters + + +def test_uuid_converter(): + m = r.Map([r.Rule("/a/", endpoint="a")]) + a = m.bind("example.org", "/") + route, kwargs = a.match("/a/a8098c1a-f86e-11da-bd1a-00112444be1e") + assert type(kwargs["a_uuid"]) == uuid.UUID + + +def test_converter_with_tuples(): + """ + Regression test for https://github.com/pallets/werkzeug/issues/709 + """ + + class TwoValueConverter(r.BaseConverter): + part_isolating = False + + def __init__(self, *args, **kwargs): + super().__init__(*args, **kwargs) + self.regex = r"(\w\w+)/(\w\w+)" + + def to_python(self, two_values): + one, two = two_values.split("/") + return one, two + + def to_url(self, values): + return f"{values[0]}/{values[1]}" + + map = r.Map( + [r.Rule("//", endpoint="handler")], + converters={"two": TwoValueConverter}, + ) + a = map.bind("example.org", "/") + route, kwargs = a.match("/qwert/yuiop/") + assert kwargs["foo"] == ("qwert", "yuiop") + + +def test_anyconverter(): + m = r.Map( + [ + r.Rule("/", endpoint="no_dot"), + r.Rule("/", endpoint="yes_dot"), + ] + ) + a = m.bind("example.org", "/") + assert a.match("/a1") == ("no_dot", {"a": "a1"}) + assert a.match("/a2") == ("no_dot", {"a": "a2"}) + assert a.match("/a.1") == ("yes_dot", {"a": "a.1"}) + assert a.match("/a.2") == ("yes_dot", {"a": "a.2"}) + + +def test_any_converter_build_validates_value() -> None: + m = r.Map([r.Rule("/", endpoint="actor")]) + a = m.bind("localhost") + + assert a.build("actor", {"value": "patient"}) == "/patient" + assert a.build("actor", {"value": "provider"}) == "/provider" + + with pytest.raises(ValueError) as exc: + a.build("actor", {"value": "invalid"}) + + assert str(exc.value) == "'invalid' is not one of 'patient', 'provider'" + + +@pytest.mark.parametrize( + ("endpoint", "value", "expect"), + [ + ("int", 1, "/1"), + ("int", None, r.BuildError), + ("int", [1], TypeError), + ("list", [1], "/1"), + ("list", [1, None, 2], "/1.None.2"), + ("list", 1, TypeError), + ], +) +def test_build_values_dict(endpoint, value, expect): + class ListConverter(r.BaseConverter): + def to_url(self, value: t.Any) -> str: + return super().to_url(".".join(map(str, value))) + + url_map = r.Map( + [r.Rule("/", endpoint="int"), r.Rule("/", endpoint="list")], + converters={"list": ListConverter}, + ) + adapter = url_map.bind("localhost") + + if isinstance(expect, str): + assert adapter.build(endpoint, {"v": value}) == expect + else: + with pytest.raises(expect): + adapter.build(endpoint, {"v": value}) + + +@pytest.mark.parametrize( + ("endpoint", "value", "expect"), + [ + ("int", 1, "/1"), + ("int", [1], "/1"), + ("int", [], r.BuildError), + ("int", None, TypeError), + ("int", [None], TypeError), + ("list", 1, TypeError), + ("list", [1], TypeError), + ("list", [[1]], "/1"), + ("list", [1, None, 2], "/1.None.2"), + ], +) +def test_build_values_multidict(endpoint, value, expect): + class ListConverter(r.BaseConverter): + def to_url(self, value: t.Any) -> str: + return super().to_url(".".join(map(str, value))) + + url_map = r.Map( + [r.Rule("/", endpoint="int"), r.Rule("/", endpoint="list")], + converters={"list": ListConverter}, + ) + adapter = url_map.bind("localhost") + + if isinstance(expect, str): + assert adapter.build(endpoint, MultiDict({"v": value})) == expect + else: + with pytest.raises(expect): + adapter.build(endpoint, MultiDict({"v": value})) + + +@pytest.mark.parametrize( + ("value", "expect"), + [ + (None, ""), + ([None], ""), + ([None, None], ""), + ("", "?v="), + ([""], "?v="), + (0, "?v=0"), + (1.0, "?v=1.0"), + ([1, 2], "?v=1&v=2"), + ([1, None, 2], "?v=1&v=2"), + ([1, "", 2], "?v=1&v=&v=2"), + ], +) +def test_build_append_unknown_dict(value, expect): + map = r.Map([r.Rule("/", endpoint="a")]) + adapter = map.bind("localhost") + assert adapter.build("a", {"v": value}) == f"/{expect}" + assert adapter.build("a", {"v": value}, append_unknown=False) == "/" + + +@pytest.mark.parametrize( + ("value", "expect"), + [ + (None, ""), + ([None], ""), + ([None, None], ""), + ("", "?v="), + ([""], "?v="), + (0, "?v=0"), + (1.0, "?v=1.0"), + ([1, 2], "?v=1&v=2"), + ([1, None, 2], "?v=1&v=2"), + ([1, "", 2], "?v=1&v=&v=2"), + ], +) +def test_build_append_unknown_multidict(value, expect): + map = r.Map([r.Rule("/", endpoint="a")]) + adapter = map.bind("localhost") + assert adapter.build("a", MultiDict({"v": value})) == f"/{expect}" + assert adapter.build("a", MultiDict({"v": value}), append_unknown=False) == "/" + + +def test_build_drop_none(): + map = r.Map([r.Rule("/flob/", endpoint="endp")]) + adapter = map.bind("", "/") + params = {"flub": None, "flop": None} + with pytest.raises(r.BuildError): + x = adapter.build("endp", params) + assert not x + params = {"flub": "x", "flop": None} + url = adapter.build("endp", params) + assert "flop" not in url + + +def test_method_fallback(): + map = r.Map( + [ + r.Rule("/", endpoint="index", methods=["GET"]), + r.Rule("/", endpoint="hello_name", methods=["GET"]), + r.Rule("/select", endpoint="hello_select", methods=["POST"]), + r.Rule("/search_get", endpoint="search", methods=["GET"]), + r.Rule("/search_post", endpoint="search", methods=["POST"]), + ] + ) + adapter = map.bind("example.com") + assert adapter.build("index") == "/" + assert adapter.build("index", method="GET") == "/" + assert adapter.build("hello_name", {"name": "foo"}) == "/foo" + assert adapter.build("hello_select") == "/select" + assert adapter.build("hello_select", method="POST") == "/select" + assert adapter.build("search") == "/search_get" + assert adapter.build("search", method="GET") == "/search_get" + assert adapter.build("search", method="POST") == "/search_post" + + +def test_implicit_head(): + url_map = r.Map( + [ + r.Rule("/get", methods=["GET"], endpoint="a"), + r.Rule("/post", methods=["POST"], endpoint="b"), + ] + ) + adapter = url_map.bind("example.org") + assert adapter.match("/get", method="HEAD") == ("a", {}) + pytest.raises(MethodNotAllowed, adapter.match, "/post", method="HEAD") + + +def test_pass_str_as_router_methods(): + with pytest.raises(TypeError): + r.Rule("/get", methods="GET") + + +def test_protocol_joining_bug(): + m = r.Map([r.Rule("/", endpoint="x")]) + a = m.bind("example.org") + assert a.build("x", {"foo": "x:y"}) == "/x:y" + assert a.build("x", {"foo": "x:y"}, force_external=True) == "http://example.org/x:y" + + +def test_allowed_methods_querying(): + m = r.Map( + [r.Rule("/", methods=["GET", "HEAD"]), r.Rule("/foo", methods=["POST"])] + ) + a = m.bind("example.org") + assert sorted(a.allowed_methods("/foo")) == ["GET", "HEAD", "POST"] + + +def test_external_building_with_port(): + map = r.Map([r.Rule("/", endpoint="index")]) + adapter = map.bind("example.org:5000", "/") + built_url = adapter.build("index", {}, force_external=True) + assert built_url == "http://example.org:5000/", built_url + + +def test_external_building_with_port_bind_to_environ(): + map = r.Map([r.Rule("/", endpoint="index")]) + adapter = map.bind_to_environ( + create_environ("/", "http://example.org:5000/"), server_name="example.org:5000" + ) + built_url = adapter.build("index", {}, force_external=True) + assert built_url == "http://example.org:5000/", built_url + + +def test_external_building_with_port_bind_to_environ_wrong_servername(): + map = r.Map([r.Rule("/", endpoint="index")]) + environ = create_environ("/", "http://example.org:5000/") + + with pytest.warns(UserWarning): + adapter = map.bind_to_environ(environ, server_name="example.org") + assert adapter.subdomain == "" + + +def test_converter_parser(): + args, kwargs = r.parse_converter_args("test, a=1, b=3.0") + + assert args == ("test",) + assert kwargs == {"a": 1, "b": 3.0} + + args, kwargs = r.parse_converter_args("") + assert not args and not kwargs + + args, kwargs = r.parse_converter_args("a, b, c,") + assert args == ("a", "b", "c") + assert not kwargs + + args, kwargs = r.parse_converter_args("True, False, None") + assert args == (True, False, None) + + args, kwargs = r.parse_converter_args('"foo", "bar"') + assert args == ("foo", "bar") + + +def test_alias_redirects(): + m = r.Map( + [ + r.Rule("/", endpoint="index"), + r.Rule("/index.html", endpoint="index", alias=True), + r.Rule("/users/", defaults={"page": 1}, endpoint="users"), + r.Rule( + "/users/index.html", defaults={"page": 1}, alias=True, endpoint="users" + ), + r.Rule("/users/page/", endpoint="users"), + r.Rule("/users/page-.html", alias=True, endpoint="users"), + ] + ) + a = m.bind("example.com") + + def ensure_redirect(path, new_url, args=None): + with pytest.raises(r.RequestRedirect) as excinfo: + a.match(path, query_args=args) + assert excinfo.value.new_url == f"http://example.com{new_url}" + + ensure_redirect("/index.html", "/") + ensure_redirect("/users/index.html", "/users/") + ensure_redirect("/users/page-2.html", "/users/page/2") + ensure_redirect("/users/page-1.html", "/users/") + ensure_redirect("/users/page-1.html", "/users/?foo=bar", {"foo": "bar"}) + + assert a.build("index") == "/" + assert a.build("users", {"page": 1}) == "/users/" + assert a.build("users", {"page": 2}) == "/users/page/2" + + +@pytest.mark.parametrize("prefix", ("", "/aaa")) +def test_double_defaults(prefix): + m = r.Map( + [ + r.Rule(f"{prefix}/", defaults={"foo": 1, "bar": False}, endpoint="x"), + r.Rule(f"{prefix}/", defaults={"bar": False}, endpoint="x"), + r.Rule(f"{prefix}/bar/", defaults={"foo": 1, "bar": True}, endpoint="x"), + r.Rule(f"{prefix}/bar/", defaults={"bar": True}, endpoint="x"), + ] + ) + a = m.bind("example.com") + + assert a.match(f"{prefix}/") == ("x", {"foo": 1, "bar": False}) + assert a.match(f"{prefix}/2") == ("x", {"foo": 2, "bar": False}) + assert a.match(f"{prefix}/bar/") == ("x", {"foo": 1, "bar": True}) + assert a.match(f"{prefix}/bar/2") == ("x", {"foo": 2, "bar": True}) + + assert a.build("x", {"foo": 1, "bar": False}) == f"{prefix}/" + assert a.build("x", {"foo": 2, "bar": False}) == f"{prefix}/2" + assert a.build("x", {"bar": False}) == f"{prefix}/" + assert a.build("x", {"foo": 1, "bar": True}) == f"{prefix}/bar/" + assert a.build("x", {"foo": 2, "bar": True}) == f"{prefix}/bar/2" + assert a.build("x", {"bar": True}) == f"{prefix}/bar/" + + +def test_building_bytes(): + m = r.Map( + [ + r.Rule("/", endpoint="a"), + r.Rule("/", defaults={"b": b"\x01\x02\x03"}, endpoint="b"), + ] + ) + a = m.bind("example.org", "/") + assert a.build("a", {"a": b"\x01\x02\x03"}) == "/%01%02%03" + assert a.build("b") == "/%01%02%03" + + +def test_host_matching(): + m = r.Map( + [ + r.Rule("/", endpoint="index", host="www."), + r.Rule("/", endpoint="files", host="files."), + r.Rule("/foo/", defaults={"page": 1}, host="www.", endpoint="x"), + r.Rule("/", host="files.", endpoint="x"), + ], + host_matching=True, + ) + + a = m.bind("www.example.com") + assert a.match("/") == ("index", {"domain": "example.com"}) + assert a.match("/foo/") == ("x", {"domain": "example.com", "page": 1}) + + with pytest.raises(r.RequestRedirect) as excinfo: + a.match("/foo") + assert excinfo.value.new_url == "http://www.example.com/foo/" + + a = m.bind("files.example.com") + assert a.match("/") == ("files", {"domain": "example.com"}) + assert a.match("/2") == ("x", {"domain": "example.com", "page": 2}) + + with pytest.raises(r.RequestRedirect) as excinfo: + a.match("/1") + assert excinfo.value.new_url == "http://www.example.com/foo/" + + +def test_host_matching_building(): + m = r.Map( + [ + r.Rule("/", endpoint="index", host="www.domain.com"), + r.Rule("/", endpoint="foo", host="my.domain.com"), + ], + host_matching=True, + ) + + www = m.bind("www.domain.com") + assert www.match("/") == ("index", {}) + assert www.build("index") == "/" + assert www.build("foo") == "http://my.domain.com/" + + my = m.bind("my.domain.com") + assert my.match("/") == ("foo", {}) + assert my.build("foo") == "/" + assert my.build("index") == "http://www.domain.com/" + + +def test_server_name_casing(): + m = r.Map([r.Rule("/", endpoint="index", subdomain="foo")]) + + env = create_environ() + env["SERVER_NAME"] = env["HTTP_HOST"] = "FOO.EXAMPLE.COM" + a = m.bind_to_environ(env, server_name="example.com") + assert a.match("/") == ("index", {}) + + env = create_environ() + env["SERVER_NAME"] = "127.0.0.1" + env["SERVER_PORT"] = "5000" + del env["HTTP_HOST"] + + with pytest.warns(UserWarning): + a = m.bind_to_environ(env, server_name="example.com") + + with pytest.raises(NotFound): + a.match() + + +def test_redirect_request_exception_code(): + exc = r.RequestRedirect("http://www.google.com/") + exc.code = 307 + env = create_environ() + assert exc.get_response(env).status_code == exc.code + + +def test_redirect_path_quoting(): + url_map = r.Map( + [ + r.Rule("/", defaults={"page": 1}, endpoint="category"), + r.Rule("//page/", endpoint="category"), + ] + ) + adapter = url_map.bind("example.com") + + with pytest.raises(r.RequestRedirect) as excinfo: + adapter.match("/foo bar/page/1") + response = excinfo.value.get_response({}) + assert response.headers["location"] == "http://example.com/foo%20bar" + + +def test_unicode_rules(): + m = r.Map( + [r.Rule("/войти/", endpoint="enter"), r.Rule("/foo+bar/", endpoint="foobar")] + ) + a = m.bind("☃.example.com") + with pytest.raises(r.RequestRedirect) as excinfo: + a.match("/войти") + assert ( + excinfo.value.new_url + == "http://xn--n3h.example.com/%D0%B2%D0%BE%D0%B9%D1%82%D0%B8/" + ) + + endpoint, values = a.match("/войти/") + assert endpoint == "enter" + assert values == {} + + with pytest.raises(r.RequestRedirect) as excinfo: + a.match("/foo+bar") + assert excinfo.value.new_url == "http://xn--n3h.example.com/foo+bar/" + + endpoint, values = a.match("/foo+bar/") + assert endpoint == "foobar" + assert values == {} + + url = a.build("enter", {}, force_external=True) + assert url == "http://xn--n3h.example.com/%D0%B2%D0%BE%D0%B9%D1%82%D0%B8/" + + url = a.build("foobar", {}, force_external=True) + assert url == "http://xn--n3h.example.com/foo+bar/" + + +def test_empty_path_info(): + m = r.Map([r.Rule("/", endpoint="index")]) + + b = m.bind("example.com", script_name="/approot") + with pytest.raises(r.RequestRedirect) as excinfo: + b.match("") + assert excinfo.value.new_url == "http://example.com/approot/" + + a = m.bind("example.com") + with pytest.raises(r.RequestRedirect) as excinfo: + a.match("") + assert excinfo.value.new_url == "http://example.com/" + + +def test_both_bind_and_match_path_info_are_none(): + m = r.Map([r.Rule("/", endpoint="index")]) + ma = m.bind("example.org") + assert ma.match() == ("index", {}) + + +def test_map_repr(): + m = r.Map([r.Rule("/wat", endpoint="enter"), r.Rule("/woop", endpoint="foobar")]) + rv = repr(m) + assert rv == "Map([ enter>, foobar>])" + + +def test_empty_subclass_rules_with_custom_kwargs(): + class CustomRule(r.Rule): + def __init__(self, string=None, custom=None, *args, **kwargs): + self.custom = custom + super().__init__(string, *args, **kwargs) + + rule1 = CustomRule("/foo", endpoint="bar") + try: + rule2 = rule1.empty() + assert rule1.rule == rule2.rule + except TypeError as e: # raised without fix in PR #675 + raise e + + +def test_finding_closest_match_by_endpoint(): + m = r.Map( + [ + r.Rule("/foo/", endpoint="users.here"), + r.Rule("/wat/", endpoint="admin.users"), + r.Rule("/woop", endpoint="foo.users"), + ] + ) + adapter = m.bind("example.com") + assert ( + r.BuildError("admin.user", None, None, adapter).suggested.endpoint + == "admin.users" + ) + + +def test_finding_closest_match_by_values(): + rule_id = r.Rule("/user/id//", endpoint="users") + rule_slug = r.Rule("/user//", endpoint="users") + rule_random = r.Rule("/user/emails//", endpoint="users") + m = r.Map([rule_id, rule_slug, rule_random]) + adapter = m.bind("example.com") + assert r.BuildError("x", {"slug": ""}, None, adapter).suggested == rule_slug + + +def test_finding_closest_match_by_method(): + post = r.Rule("/post/", endpoint="foobar", methods=["POST"]) + get = r.Rule("/get/", endpoint="foobar", methods=["GET"]) + put = r.Rule("/put/", endpoint="foobar", methods=["PUT"]) + m = r.Map([post, get, put]) + adapter = m.bind("example.com") + assert r.BuildError("invalid", {}, "POST", adapter).suggested == post + assert r.BuildError("invalid", {}, "GET", adapter).suggested == get + assert r.BuildError("invalid", {}, "PUT", adapter).suggested == put + + +def test_finding_closest_match_when_none_exist(): + m = r.Map([]) + assert not r.BuildError("invalid", {}, None, m.bind("test.com")).suggested + + +def test_error_message_without_suggested_rule(): + m = r.Map([r.Rule("/foo/", endpoint="world", methods=["GET"])]) + adapter = m.bind("example.com") + + with pytest.raises(r.BuildError) as excinfo: + adapter.build("urks") + assert str(excinfo.value).startswith("Could not build url for endpoint 'urks'.") + + with pytest.raises(r.BuildError) as excinfo: + adapter.build("world", method="POST") + assert str(excinfo.value).startswith( + "Could not build url for endpoint 'world' ('POST')." + ) + + with pytest.raises(r.BuildError) as excinfo: + adapter.build("urks", values={"user_id": 5}) + assert str(excinfo.value).startswith( + "Could not build url for endpoint 'urks' with values ['user_id']." + ) + + +def test_error_message_suggestion(): + m = r.Map([r.Rule("/foo//", endpoint="world", methods=["GET"])]) + adapter = m.bind("example.com") + + with pytest.raises(r.BuildError) as excinfo: + adapter.build("helloworld") + assert "Did you mean 'world' instead?" in str(excinfo.value) + + with pytest.raises(r.BuildError) as excinfo: + adapter.build("world") + assert "Did you forget to specify values ['id']?" in str(excinfo.value) + assert "Did you mean to use methods" not in str(excinfo.value) + + with pytest.raises(r.BuildError) as excinfo: + adapter.build("world", {"id": 2}, method="POST") + assert "Did you mean to use methods ['GET', 'HEAD']?" in str(excinfo.value) + + +def test_no_memory_leak_from_Rule_builder(): + """See #1520""" + + # generate a bunch of objects that *should* get collected + for _ in range(100): + r.Map([r.Rule("/a/")]) + + # ensure that the garbage collection has had a chance to collect cyclic + # objects + for _ in range(5): + gc.collect() + + # assert they got collected! + count = sum(1 for obj in gc.get_objects() if isinstance(obj, r.Rule)) + assert count == 0 + + +def test_build_url_with_arg_self(): + map = r.Map([r.Rule("/foo/", endpoint="foo")]) + adapter = map.bind("example.org", "/", subdomain="blah") + + ret = adapter.build("foo", {"self": "bar"}) + assert ret == "http://example.org/foo/bar" + + +def test_build_url_with_arg_keyword(): + map = r.Map([r.Rule("/foo/", endpoint="foo")]) + adapter = map.bind("example.org", "/", subdomain="blah") + + ret = adapter.build("foo", {"class": "bar"}) + assert ret == "http://example.org/foo/bar" + + +def test_build_url_same_endpoint_multiple_hosts(): + m = r.Map( + [ + r.Rule("/", endpoint="index", host="alpha.example.com"), + r.Rule("/", endpoint="index", host="beta.example.com"), + r.Rule("/", endpoint="gamma", host="gamma.example.com"), + ], + host_matching=True, + ) + + alpha = m.bind("alpha.example.com") + assert alpha.build("index") == "/" + assert alpha.build("gamma") == "http://gamma.example.com/" + + alpha_case = m.bind("AlPhA.ExAmPlE.CoM") + assert alpha_case.build("index") == "/" + assert alpha_case.build("gamma") == "http://gamma.example.com/" + + beta = m.bind("beta.example.com") + assert beta.build("index") == "/" + + beta_case = m.bind("BeTa.ExAmPlE.CoM") + assert beta_case.build("index") == "/" + + +def test_rule_websocket_methods(): + with pytest.raises(ValueError): + r.Rule("/ws", endpoint="ws", websocket=True, methods=["post"]) + with pytest.raises(ValueError): + r.Rule( + "/ws", + endpoint="ws", + websocket=True, + methods=["get", "head", "options", "post"], + ) + r.Rule("/ws", endpoint="ws", websocket=True, methods=["get", "head", "options"]) + + +def test_path_weighting(): + m = r.Map( + [ + r.Rule("//c", endpoint="simple"), + r.Rule("///", endpoint="complex"), + ] + ) + a = m.bind("localhost", path_info="/a/b/c") + + assert a.match() == ("simple", {"path": "a/b"}) + + +def test_newline_match(): + m = r.Map([r.Rule("/hello", endpoint="hello")]) + a = m.bind("localhost") + + with pytest.raises(NotFound): + a.match("/hello\n") + + +def test_weighting(): + m = r.Map( + [ + r.Rule("/", endpoint="int"), + r.Rule("/", endpoint="uuid"), + ] + ) + a = m.bind("localhost") + + assert a.match("/2b5b0911-fdcf-4dd2-921b-28ace88db8a0") == ( + "uuid", + {"value": uuid.UUID("2b5b0911-fdcf-4dd2-921b-28ace88db8a0")}, + ) + + +def test_strict_slashes_false(): + map = r.Map( + [ + r.Rule("/path1", endpoint="leaf_path", strict_slashes=False), + r.Rule("/path2/", endpoint="branch_path", strict_slashes=False), + ], + ) + + adapter = map.bind("example.org", "/") + + assert adapter.match("/path1", method="GET") == ("leaf_path", {}) + assert adapter.match("/path1/", method="GET") == ("leaf_path", {}) + assert adapter.match("/path2", method="GET") == ("branch_path", {}) + assert adapter.match("/path2/", method="GET") == ("branch_path", {}) + + +def test_invalid_rule(): + with pytest.raises(ValueError): + map_ = r.Map([r.Rule("/", endpoint="test")]) + map_.bind("localhost") + + +def test_multiple_converters_per_part(): + map_ = r.Map( + [ + r.Rule("/v.", endpoint="version"), + ], + ) + adapter = map_.bind("localhost") + assert adapter.match("/v1.2") == ("version", {"major": 1, "minor": 2}) + + +def test_static_regex_escape(): + map_ = r.Map( + [ + r.Rule("/.", endpoint="dotted"), + ], + ) + adapter = map_.bind("localhost") + assert adapter.match("/.2") == ("dotted", {"value": 2}) + with pytest.raises(NotFound): + adapter.match("/a2") + + +class RegexConverter(r.BaseConverter): + def __init__(self, url_map, *items): + super().__init__(url_map) + self.regex = items[0] + + +def test_regex(): + map_ = r.Map( + [ + r.Rule(r"/", endpoint="regex"), + ], + converters={"regex": RegexConverter}, + ) + adapter = map_.bind("localhost") + assert adapter.match("/asdfsa.asdfs") == ("regex", {"value": "asdfsa.asdfs"}) diff --git a/tests/test_security.py b/tests/test_security.py new file mode 100644 index 0000000..3e797fc --- /dev/null +++ b/tests/test_security.py @@ -0,0 +1,49 @@ +import os +import posixpath + +import pytest + +from werkzeug.security import check_password_hash +from werkzeug.security import generate_password_hash +from werkzeug.security import safe_join + + +def test_password_hashing(): + hash0 = generate_password_hash("default") + assert check_password_hash(hash0, "default") + assert hash0.startswith("pbkdf2:sha256:260000$") + + hash1 = generate_password_hash("default", "sha1") + hash2 = generate_password_hash("default", method="sha1") + assert hash1 != hash2 + assert check_password_hash(hash1, "default") + assert check_password_hash(hash2, "default") + assert hash1.startswith("sha1$") + assert hash2.startswith("sha1$") + + with pytest.raises(ValueError): + generate_password_hash("default", "sha1", salt_length=0) + + fakehash = generate_password_hash("default", method="plain") + assert fakehash == "plain$$default" + assert check_password_hash(fakehash, "default") + + +def test_safe_join(): + assert safe_join("foo", "bar/baz") == posixpath.join("foo", "bar/baz") + assert safe_join("foo", "../bar/baz") is None + if os.name == "nt": + assert safe_join("foo", "foo\\bar") is None + + +def test_safe_join_os_sep(): + import werkzeug.security as sec + + prev_value = sec._os_alt_seps + sec._os_alt_seps = "*" + assert safe_join("foo", "bar/baz*") is None + sec._os_alt_steps = prev_value + + +def test_safe_join_empty_trusted(): + assert safe_join("", "c:test.txt") == "./c:test.txt" diff --git a/tests/test_send_file.py b/tests/test_send_file.py new file mode 100644 index 0000000..fc4299a --- /dev/null +++ b/tests/test_send_file.py @@ -0,0 +1,209 @@ +import datetime +import io +import pathlib + +import pytest + +from werkzeug.exceptions import NotFound +from werkzeug.http import http_date +from werkzeug.test import EnvironBuilder +from werkzeug.utils import send_file +from werkzeug.utils import send_from_directory + +res_path = pathlib.Path(__file__).parent / "res" +html_path = res_path / "index.html" +txt_path = res_path / "test.txt" + +environ = EnvironBuilder().get_environ() + + +@pytest.mark.parametrize("path", [html_path, str(html_path)]) +def test_path(path): + rv = send_file(path, environ) + assert rv.mimetype == "text/html" + assert rv.direct_passthrough + rv.direct_passthrough = False + assert rv.data == html_path.read_bytes() + rv.close() + + +def test_x_sendfile(): + rv = send_file(html_path, environ, use_x_sendfile=True) + assert rv.headers["x-sendfile"] == str(html_path) + assert rv.data == b"" + rv.close() + + +def test_last_modified(): + last_modified = datetime.datetime(1999, 1, 1, tzinfo=datetime.timezone.utc) + rv = send_file(txt_path, environ, last_modified=last_modified) + assert rv.last_modified == last_modified + rv.close() + + +@pytest.mark.parametrize( + "file_factory", [lambda: txt_path.open("rb"), lambda: io.BytesIO(b"test")] +) +def test_object(file_factory): + rv = send_file(file_factory(), environ, mimetype="text/plain", use_x_sendfile=True) + rv.direct_passthrough = False + assert rv.data + assert rv.mimetype == "text/plain" + assert "x-sendfile" not in rv.headers + rv.close() + + +def test_object_without_mimetype(): + with pytest.raises(TypeError, match="detect the MIME type"): + send_file(io.BytesIO(b"test"), environ) + + +def test_object_mimetype_from_name(): + rv = send_file(io.BytesIO(b"test"), environ, download_name="test.txt") + assert rv.mimetype == "text/plain" + rv.close() + + +@pytest.mark.parametrize( + "file_factory", [lambda: txt_path.open(), lambda: io.StringIO("test")] +) +def test_text_mode_fails(file_factory): + with file_factory() as f, pytest.raises(ValueError, match="binary mode"): + send_file(f, environ, mimetype="text/plain") + + +@pytest.mark.parametrize( + ("as_attachment", "value"), [(False, "inline"), (True, "attachment")] +) +def test_disposition_name(as_attachment, value): + rv = send_file(txt_path, environ, as_attachment=as_attachment) + assert rv.headers["Content-Disposition"] == f"{value}; filename=test.txt" + rv.close() + + +def test_object_attachment_requires_name(): + with pytest.raises(TypeError, match="attachment"): + send_file( + io.BytesIO(b"test"), environ, mimetype="text/plain", as_attachment=True + ) + + rv = send_file( + io.BytesIO(b"test"), environ, as_attachment=True, download_name="test.txt" + ) + assert rv.headers["Content-Disposition"] == "attachment; filename=test.txt" + rv.close() + + +@pytest.mark.parametrize( + ("name", "ascii", "utf8"), + ( + ("index.html", "index.html", None), + ( + "Ñandú／pingüino.txt", + '"Nandu/pinguino.txt"', + "%C3%91and%C3%BA%EF%BC%8Fping%C3%BCino.txt", + ), + # latin-1 isn't ascii, should be quoted + ("Vögel.txt", "Vogel.txt", "V%C3%B6gel.txt"), + # ":/" are not safe in filename* value + ("те:/ст", '":/"', "%D1%82%D0%B5%3A%2F%D1%81%D1%82"), + ), +) +def test_non_ascii_name(name, ascii, utf8): + rv = send_file(html_path, environ, as_attachment=True, download_name=name) + rv.close() + content_disposition = rv.headers["Content-Disposition"] + assert f"filename={ascii}" in content_disposition + + if utf8: + assert f"filename*=UTF-8''{utf8}" in content_disposition + else: + assert "filename*=UTF-8''" not in content_disposition + + +def test_no_cache_conditional_default(): + rv = send_file( + txt_path, + EnvironBuilder( + headers={"If-Modified-Since": http_date(datetime.datetime(2020, 7, 12))} + ).get_environ(), + last_modified=datetime.datetime(2020, 7, 11), + ) + rv.close() + assert "no-cache" in rv.headers["Cache-Control"] + assert not rv.cache_control.public + assert not rv.cache_control.max_age + assert not rv.expires + assert rv.status_code == 304 + + +@pytest.mark.parametrize(("value", "public"), [(0, False), (60, True)]) +def test_max_age(value, public): + rv = send_file(txt_path, environ, max_age=value) + rv.close() + assert ("no-cache" in rv.headers["Cache-Control"]) != public + assert rv.cache_control.public == public + assert rv.cache_control.max_age == value + assert rv.expires + assert rv.status_code == 200 + + +def test_etag(): + rv = send_file(txt_path, environ) + rv.close() + assert rv.headers["ETag"].count("-") == 2 + rv = send_file(txt_path, environ, etag=False) + rv.close() + assert "ETag" not in rv.headers + rv = send_file(txt_path, environ, etag="unique") + rv.close() + assert rv.headers["ETag"] == '"unique"' + + +@pytest.mark.parametrize("as_attachment", (True, False)) +def test_content_encoding(as_attachment): + rv = send_file( + txt_path, environ, download_name="logo.svgz", as_attachment=as_attachment + ) + rv.close() + assert rv.mimetype == "image/svg+xml" + assert rv.content_encoding == ("gzip" if not as_attachment else None) + + +@pytest.mark.parametrize( + ("directory", "path"), + [(str(res_path), "test.txt"), (res_path, pathlib.Path("test.txt"))], +) +def test_from_directory(directory, path): + rv = send_from_directory(directory, path, environ) + rv.direct_passthrough = False + assert rv.data.strip() == b"FOUND" + rv.close() + + +@pytest.mark.parametrize("path", ["../res/test.txt", "nothing.txt", "null\x00.txt"]) +def test_from_directory_not_found(path): + with pytest.raises(NotFound): + send_from_directory(res_path, path, environ) + + +def test_root_path(tmp_path): + # This is a private API, it should only be used by Flask. + d = tmp_path / "d" + d.mkdir() + (d / "test.txt").write_bytes(b"test") + rv = send_file("d/test.txt", environ, _root_path=tmp_path) + rv.direct_passthrough = False + assert rv.data == b"test" + rv.close() + rv = send_from_directory("d", "test.txt", environ, _root_path=tmp_path) + rv.direct_passthrough = False + assert rv.data == b"test" + rv.close() + + +def test_max_age_callable(): + # This is a private API, it should only be used by Flask. + rv = send_file(txt_path, environ, max_age=lambda p: 10) + rv.close() + assert rv.cache_control.max_age == 10 diff --git a/tests/test_serving.py b/tests/test_serving.py new file mode 100644 index 0000000..0494828 --- /dev/null +++ b/tests/test_serving.py @@ -0,0 +1,288 @@ +import http.client +import json +import os +import shutil +import socket +import ssl +import sys +from io import BytesIO +from pathlib import Path + +import pytest + +from werkzeug import run_simple +from werkzeug._reloader import _find_stat_paths +from werkzeug._reloader import _find_watchdog_paths +from werkzeug._reloader import _get_args_for_reloading +from werkzeug.datastructures import FileStorage +from werkzeug.serving import make_ssl_devcert +from werkzeug.test import stream_encode_multipart + + +@pytest.mark.filterwarnings("ignore::pytest.PytestUnraisableExceptionWarning") +@pytest.mark.parametrize( + "kwargs", + [ + pytest.param({}, id="http"), + pytest.param({"ssl_context": "adhoc"}, id="https"), + pytest.param({"use_reloader": True}, id="reloader"), + pytest.param( + {"hostname": "unix"}, + id="unix socket", + marks=pytest.mark.skipif( + not hasattr(socket, "AF_UNIX"), reason="requires unix socket support" + ), + ), + ], +) +@pytest.mark.dev_server +def test_server(tmp_path, dev_server, kwargs: dict): + if kwargs.get("hostname") == "unix": + kwargs["hostname"] = f"unix://{tmp_path / 'test.sock'}" + + client = dev_server(**kwargs) + r = client.request() + assert r.status == 200 + assert r.json["PATH_INFO"] == "/" + + +@pytest.mark.filterwarnings("ignore::pytest.PytestUnraisableExceptionWarning") +@pytest.mark.dev_server +def test_untrusted_host(standard_app): + r = standard_app.request( + "http://missing.test:1337/index.html#ignore", + headers={"x-base-url": standard_app.url}, + ) + assert r.json["HTTP_HOST"] == "missing.test:1337" + assert r.json["PATH_INFO"] == "/index.html" + host, _, port = r.json["HTTP_X_BASE_URL"].rpartition(":") + assert r.json["SERVER_NAME"] == host.partition("http://")[2] + assert r.json["SERVER_PORT"] == port + + +@pytest.mark.filterwarnings("ignore::pytest.PytestUnraisableExceptionWarning") +@pytest.mark.dev_server +def test_double_slash_path(standard_app): + r = standard_app.request("//double-slash") + assert "double-slash" not in r.json["HTTP_HOST"] + assert r.json["PATH_INFO"] == "/double-slash" + + +@pytest.mark.filterwarnings("ignore::pytest.PytestUnraisableExceptionWarning") +@pytest.mark.dev_server +def test_500_error(standard_app): + r = standard_app.request("/crash") + assert r.status == 500 + assert b"Internal Server Error" in r.data + + +@pytest.mark.filterwarnings("ignore::pytest.PytestUnraisableExceptionWarning") +@pytest.mark.dev_server +def test_ssl_dev_cert(tmp_path, dev_server): + client = dev_server(ssl_context=make_ssl_devcert(tmp_path)) + r = client.request() + assert r.json["wsgi.url_scheme"] == "https" + + +@pytest.mark.filterwarnings("ignore::pytest.PytestUnraisableExceptionWarning") +@pytest.mark.dev_server +def test_ssl_object(dev_server): + client = dev_server(ssl_context="custom") + r = client.request() + assert r.json["wsgi.url_scheme"] == "https" + + +@pytest.mark.filterwarnings("ignore::pytest.PytestUnraisableExceptionWarning") +@pytest.mark.parametrize("reloader_type", ["stat", "watchdog"]) +@pytest.mark.skipif( + os.name == "nt" and "CI" in os.environ, reason="unreliable on Windows during CI" +) +@pytest.mark.dev_server +def test_reloader_sys_path(tmp_path, dev_server, reloader_type): + """This tests the general behavior of the reloader. It also tests + that fixing an import error triggers a reload, not just Python + retrying the failed import. + """ + real_path = tmp_path / "real_app.py" + real_path.write_text("syntax error causes import error") + + client = dev_server("reloader", reloader_type=reloader_type) + assert client.request().status == 500 + + shutil.copyfile(Path(__file__).parent / "live_apps" / "standard_app.py", real_path) + client.wait_for_log(f" * Detected change in {str(real_path)!r}, reloading") + client.wait_for_reload() + assert client.request().status == 200 + + +def test_windows_get_args_for_reloading(monkeypatch, tmp_path): + argv = [str(tmp_path / "test.exe"), "run"] + monkeypatch.setattr("sys.executable", str(tmp_path / "python.exe")) + monkeypatch.setattr("sys.argv", argv) + monkeypatch.setattr("__main__.__package__", None) + monkeypatch.setattr("os.name", "nt") + rv = _get_args_for_reloading() + assert rv == argv + + +@pytest.mark.parametrize("find", [_find_stat_paths, _find_watchdog_paths]) +def test_exclude_patterns(find): + # Imported paths under sys.prefix will be included by default. + paths = find(set(), set()) + assert any(p.startswith(sys.prefix) for p in paths) + # Those paths should be excluded due to the pattern. + paths = find(set(), {f"{sys.prefix}*"}) + assert not any(p.startswith(sys.prefix) for p in paths) + + +@pytest.mark.filterwarnings("ignore::pytest.PytestUnraisableExceptionWarning") +@pytest.mark.dev_server +def test_wrong_protocol(standard_app): + """An HTTPS request to an HTTP server doesn't show a traceback. + https://github.com/pallets/werkzeug/pull/838 + """ + conn = http.client.HTTPSConnection(standard_app.addr) + + with pytest.raises(ssl.SSLError): + conn.request("GET", f"https://{standard_app.addr}") + + assert "Traceback" not in standard_app.log.read() + + +@pytest.mark.filterwarnings("ignore::pytest.PytestUnraisableExceptionWarning") +@pytest.mark.dev_server +def test_content_type_and_length(standard_app): + r = standard_app.request() + assert "CONTENT_TYPE" not in r.json + assert "CONTENT_LENGTH" not in r.json + + r = standard_app.request(body=b"{}", headers={"content-type": "application/json"}) + assert r.json["CONTENT_TYPE"] == "application/json" + assert r.json["CONTENT_LENGTH"] == "2" + + +def test_port_is_int(): + with pytest.raises(TypeError, match="port must be an integer"): + run_simple("127.0.0.1", "5000", None) + + +@pytest.mark.filterwarnings("ignore::pytest.PytestUnraisableExceptionWarning") +@pytest.mark.parametrize("send_length", [False, True]) +@pytest.mark.dev_server +def test_chunked_request(monkeypatch, dev_server, send_length): + stream, length, boundary = stream_encode_multipart( + { + "value": "this is text", + "file": FileStorage( + BytesIO(b"this is a file"), + filename="test.txt", + content_type="text/plain", + ), + } + ) + client = dev_server("data") + # Small block size to produce multiple chunks. + conn = client.connect(blocksize=128) + conn.putrequest("POST", "/") + conn.putheader("Transfer-Encoding", "chunked") + conn.putheader("Content-Type", f"multipart/form-data; boundary={boundary}") + + # Sending the content-length header with chunked is invalid, but if + # a client does send it the server should ignore it. Previously the + # multipart parser would crash. Python's higher-level functions + # won't send the header, which is why we use conn.put in this test. + if send_length: + conn.putheader("Content-Length", "invalid") + expect_content_len = "invalid" + else: + expect_content_len = None + + conn.endheaders(stream, encode_chunked=True) + r = conn.getresponse() + data = json.load(r) + r.close() + assert data["form"]["value"] == "this is text" + assert data["files"]["file"] == "this is a file" + environ = data["environ"] + assert environ["HTTP_TRANSFER_ENCODING"] == "chunked" + assert environ.get("CONTENT_LENGTH") == expect_content_len + assert environ["wsgi.input_terminated"] + + +@pytest.mark.filterwarnings("ignore::pytest.PytestUnraisableExceptionWarning") +@pytest.mark.dev_server +def test_multiple_headers_concatenated(standard_app): + """A header key can be sent multiple times. The server will join all + the values with commas. + + https://tools.ietf.org/html/rfc3875#section-4.1.18 + """ + # conn.request doesn't support multiple values. + conn = standard_app.connect() + conn.putrequest("GET", "/") + conn.putheader("XYZ", "a ") # trailing space is preserved + conn.putheader("X-Ignore-1", "ignore value") + conn.putheader("XYZ", " b") # leading space is collapsed + conn.putheader("X-Ignore-2", "ignore value") + conn.putheader("XYZ", "c ") + conn.putheader("X-Ignore-3", "ignore value") + conn.putheader("XYZ", "d") + conn.endheaders() + r = conn.getresponse() + data = json.load(r) + r.close() + assert data["HTTP_XYZ"] == "a ,b,c ,d" + + +@pytest.mark.filterwarnings("ignore::pytest.PytestUnraisableExceptionWarning") +@pytest.mark.dev_server +def test_multiline_header_folding(standard_app): + """A header value can be split over multiple lines with a leading + tab. The server will remove the newlines and preserve the tabs. + + https://tools.ietf.org/html/rfc2616#section-2.2 + """ + # conn.request doesn't support multiline values. + conn = standard_app.connect() + conn.putrequest("GET", "/") + conn.putheader("XYZ", "first", "second", "third") + conn.endheaders() + r = conn.getresponse() + data = json.load(r) + r.close() + assert data["HTTP_XYZ"] == "first\tsecond\tthird" + + +@pytest.mark.parametrize("endpoint", ["", "crash"]) +@pytest.mark.dev_server +def test_streaming_close_response(dev_server, endpoint): + """When using HTTP/1.0, chunked encoding is not supported. Fall + back to Connection: close, but this allows no reliable way to + distinguish between complete and truncated responses. + """ + r = dev_server("streaming").request("/" + endpoint) + assert r.getheader("connection") == "close" + assert r.data == "".join(str(x) + "\n" for x in range(5)).encode() + + +@pytest.mark.dev_server +def test_streaming_chunked_response(dev_server): + """When using HTTP/1.1, use Transfer-Encoding: chunked for streamed + responses, since it can distinguish the end of the response without + closing the connection. + + https://tools.ietf.org/html/rfc2616#section-3.6.1 + """ + r = dev_server("streaming", threaded=True).request("/") + assert r.getheader("transfer-encoding") == "chunked" + assert r.data == "".join(str(x) + "\n" for x in range(5)).encode() + + +@pytest.mark.filterwarnings("ignore::pytest.PytestUnraisableExceptionWarning") +@pytest.mark.dev_server +def test_streaming_chunked_truncation(dev_server): + """When using HTTP/1.1, chunked encoding allows the client to detect + content truncated by a prematurely closed connection. + """ + with pytest.raises(http.client.IncompleteRead): + dev_server("streaming", threaded=True).request("/crash") diff --git a/tests/test_test.py b/tests/test_test.py new file mode 100644 index 0000000..02d637e --- /dev/null +++ b/tests/test_test.py @@ -0,0 +1,871 @@ +import json +import sys +from functools import partial +from io import BytesIO + +import pytest + +from werkzeug.datastructures import Authorization +from werkzeug.datastructures import FileStorage +from werkzeug.datastructures import Headers +from werkzeug.datastructures import MultiDict +from werkzeug.formparser import parse_form_data +from werkzeug.http import parse_authorization_header +from werkzeug.test import Client +from werkzeug.test import ClientRedirectError +from werkzeug.test import create_environ +from werkzeug.test import EnvironBuilder +from werkzeug.test import run_wsgi_app +from werkzeug.test import stream_encode_multipart +from werkzeug.utils import redirect +from werkzeug.wrappers import Request +from werkzeug.wrappers import Response + + +def cookie_app(environ, start_response): + """A WSGI application which sets a cookie, and returns as a response any + cookie which exists. + """ + response = Response(environ.get("HTTP_COOKIE", "No Cookie"), mimetype="text/plain") + response.set_cookie("test", "test") + return response(environ, start_response) + + +def redirect_loop_app(environ, start_response): + response = redirect("http://localhost/some/redirect/") + return response(environ, start_response) + + +def redirect_with_get_app(environ, start_response): + req = Request(environ) + if req.url not in ( + "http://localhost/", + "http://localhost/first/request", + "http://localhost/some/redirect/", + ): + raise AssertionError(f'redirect_demo_app() did not expect URL "{req.url}"') + if "/some/redirect" not in req.url: + response = redirect("http://localhost/some/redirect/") + else: + response = Response(f"current url: {req.url}") + return response(environ, start_response) + + +def external_redirect_demo_app(environ, start_response): + response = redirect("http://example.com/") + return response(environ, start_response) + + +def external_subdomain_redirect_demo_app(environ, start_response): + if "test.example.com" in environ["HTTP_HOST"]: + response = Response("redirected successfully to subdomain") + else: + response = redirect("http://test.example.com/login") + return response(environ, start_response) + + +def multi_value_post_app(environ, start_response): + req = Request(environ) + assert req.form["field"] == "val1", req.form["field"] + assert req.form.getlist("field") == ["val1", "val2"], req.form.getlist("field") + response = Response("ok") + return response(environ, start_response) + + +def test_cookie_forging(): + c = Client(cookie_app) + c.set_cookie("localhost", "foo", "bar") + response = c.open() + assert response.text == "foo=bar" + + +def test_set_cookie_app(): + c = Client(cookie_app) + response = c.open() + assert "Set-Cookie" in response.headers + + +def test_cookiejar_stores_cookie(): + c = Client(cookie_app) + c.open() + assert "test" in c.cookie_jar._cookies["localhost.local"]["/"] + + +def test_no_initial_cookie(): + c = Client(cookie_app) + response = c.open() + assert response.text == "No Cookie" + + +def test_resent_cookie(): + c = Client(cookie_app) + c.open() + response = c.open() + assert response.text == "test=test" + + +def test_disable_cookies(): + c = Client(cookie_app, use_cookies=False) + c.open() + response = c.open() + assert response.text == "No Cookie" + + +def test_cookie_for_different_path(): + c = Client(cookie_app) + c.open("/path1") + response = c.open("/path2") + assert response.text == "test=test" + + +def test_environ_builder_basics(): + b = EnvironBuilder() + assert b.content_type is None + b.method = "POST" + assert b.content_type is None + b.form["test"] = "normal value" + assert b.content_type == "application/x-www-form-urlencoded" + b.files.add_file("test", BytesIO(b"test contents"), "test.txt") + assert b.files["test"].content_type == "text/plain" + b.form["test_int"] = 1 + assert b.content_type == "multipart/form-data" + + req = b.get_request() + b.close() + + assert req.url == "http://localhost/" + assert req.method == "POST" + assert req.form["test"] == "normal value" + assert req.files["test"].content_type == "text/plain" + assert req.files["test"].filename == "test.txt" + assert req.files["test"].read() == b"test contents" + req.close() + + +def test_environ_builder_data(): + b = EnvironBuilder(data="foo") + assert b.input_stream.getvalue() == b"foo" + b = EnvironBuilder(data=b"foo") + assert b.input_stream.getvalue() == b"foo" + + b = EnvironBuilder(data={"foo": "bar"}) + assert b.form["foo"] == "bar" + b = EnvironBuilder(data={"foo": ["bar1", "bar2"]}) + assert b.form.getlist("foo") == ["bar1", "bar2"] + + def check_list_content(b, length): + foo = b.files.getlist("foo") + assert len(foo) == length + for obj in foo: + assert isinstance(obj, FileStorage) + + b = EnvironBuilder(data={"foo": BytesIO()}) + check_list_content(b, 1) + b = EnvironBuilder(data={"foo": [BytesIO(), BytesIO()]}) + check_list_content(b, 2) + + b = EnvironBuilder(data={"foo": (BytesIO(),)}) + check_list_content(b, 1) + b = EnvironBuilder(data={"foo": [(BytesIO(),), (BytesIO(),)]}) + check_list_content(b, 2) + + +def test_environ_builder_json(): + @Request.application + def app(request): + assert request.content_type == "application/json" + return Response(json.loads(request.get_data(as_text=True))["foo"]) + + c = Client(app) + response = c.post("/", json={"foo": "bar"}) + assert response.text == "bar" + + with pytest.raises(TypeError): + c.post("/", json={"foo": "bar"}, data={"baz": "qux"}) + + +def test_environ_builder_headers(): + b = EnvironBuilder( + environ_base={"HTTP_USER_AGENT": "Foo/0.1"}, + environ_overrides={"wsgi.version": (1, 1)}, + ) + b.headers["X-Beat-My-Horse"] = "very well sir" + env = b.get_environ() + assert env["HTTP_USER_AGENT"] == "Foo/0.1" + assert env["HTTP_X_BEAT_MY_HORSE"] == "very well sir" + assert env["wsgi.version"] == (1, 1) + + b.headers["User-Agent"] = "Bar/1.0" + env = b.get_environ() + assert env["HTTP_USER_AGENT"] == "Bar/1.0" + + +def test_environ_builder_headers_content_type(): + b = EnvironBuilder(headers={"Content-Type": "text/plain"}) + env = b.get_environ() + assert env["CONTENT_TYPE"] == "text/plain" + assert "HTTP_CONTENT_TYPE" not in env + b = EnvironBuilder(content_type="text/html", headers={"Content-Type": "text/plain"}) + env = b.get_environ() + assert env["CONTENT_TYPE"] == "text/html" + assert "HTTP_CONTENT_TYPE" not in env + b = EnvironBuilder() + env = b.get_environ() + assert "CONTENT_TYPE" not in env + assert "HTTP_CONTENT_TYPE" not in env + + +def test_envrion_builder_multiple_headers(): + h = Headers() + h.add("FOO", "bar") + h.add("FOO", "baz") + b = EnvironBuilder(headers=h) + env = b.get_environ() + assert env["HTTP_FOO"] == "bar, baz" + + +def test_environ_builder_paths(): + b = EnvironBuilder(path="/foo", base_url="http://example.com/") + assert b.base_url == "http://example.com/" + assert b.path == "/foo" + assert b.script_root == "" + assert b.host == "example.com" + + b = EnvironBuilder(path="/foo", base_url="http://example.com/bar") + assert b.base_url == "http://example.com/bar/" + assert b.path == "/foo" + assert b.script_root == "/bar" + assert b.host == "example.com" + + b.host = "localhost" + assert b.base_url == "http://localhost/bar/" + b.base_url = "http://localhost:8080/" + assert b.host == "localhost:8080" + assert b.server_name == "localhost" + assert b.server_port == 8080 + + b.host = "foo.invalid" + b.url_scheme = "https" + b.script_root = "/test" + env = b.get_environ() + assert env["SERVER_NAME"] == "foo.invalid" + assert env["SERVER_PORT"] == "443" + assert env["SCRIPT_NAME"] == "/test" + assert env["PATH_INFO"] == "/foo" + assert env["HTTP_HOST"] == "foo.invalid" + assert env["wsgi.url_scheme"] == "https" + assert b.base_url == "https://foo.invalid/test/" + + +def test_environ_builder_content_type(): + builder = EnvironBuilder() + assert builder.content_type is None + builder.method = "POST" + assert builder.content_type is None + builder.method = "PUT" + assert builder.content_type is None + builder.method = "PATCH" + assert builder.content_type is None + builder.method = "DELETE" + assert builder.content_type is None + builder.method = "GET" + assert builder.content_type is None + builder.form["foo"] = "bar" + assert builder.content_type == "application/x-www-form-urlencoded" + builder.files.add_file("data", BytesIO(b"foo"), "test.txt") + assert builder.content_type == "multipart/form-data" + req = builder.get_request() + builder.close() + assert req.form["foo"] == "bar" + assert req.files["data"].read() == b"foo" + req.close() + + +def test_basic_auth(): + builder = EnvironBuilder(auth=("username", "password")) + request = builder.get_request() + auth = parse_authorization_header(request.headers["Authorization"]) + assert auth.username == "username" + assert auth.password == "password" + + +def test_auth_object(): + builder = EnvironBuilder( + auth=Authorization("digest", {"username": "u", "password": "p"}) + ) + request = builder.get_request() + assert request.headers["Authorization"].startswith("Digest ") + + +def test_environ_builder_stream_switch(): + d = MultiDict(dict(foo="bar", blub="blah", hu="hum")) + for use_tempfile in False, True: + stream, length, boundary = stream_encode_multipart( + d, use_tempfile, threshold=150 + ) + assert isinstance(stream, BytesIO) != use_tempfile + + form = parse_form_data( + { + "wsgi.input": stream, + "CONTENT_LENGTH": str(length), + "CONTENT_TYPE": f'multipart/form-data; boundary="{boundary}"', + } + )[1] + assert form == d + stream.close() + + +def test_environ_builder_unicode_file_mix(): + for use_tempfile in False, True: + f = FileStorage(BytesIO(rb"\N{SNOWMAN}"), "snowman.txt") + d = MultiDict(dict(f=f, s="\N{SNOWMAN}")) + stream, length, boundary = stream_encode_multipart( + d, use_tempfile, threshold=150 + ) + assert isinstance(stream, BytesIO) != use_tempfile + + _, form, files = parse_form_data( + { + "wsgi.input": stream, + "CONTENT_LENGTH": str(length), + "CONTENT_TYPE": f'multipart/form-data; boundary="{boundary}"', + } + ) + assert form["s"] == "\N{SNOWMAN}" + assert files["f"].name == "f" + assert files["f"].filename == "snowman.txt" + assert files["f"].read() == rb"\N{SNOWMAN}" + stream.close() + files["f"].close() + + +def test_create_environ(): + env = create_environ("/foo?bar=baz", "http://example.org/") + expected = { + "wsgi.multiprocess": False, + "wsgi.version": (1, 0), + "wsgi.run_once": False, + "wsgi.errors": sys.stderr, + "wsgi.multithread": False, + "wsgi.url_scheme": "http", + "SCRIPT_NAME": "", + "SERVER_NAME": "example.org", + "REQUEST_METHOD": "GET", + "HTTP_HOST": "example.org", + "PATH_INFO": "/foo", + "SERVER_PORT": "80", + "SERVER_PROTOCOL": "HTTP/1.1", + "QUERY_STRING": "bar=baz", + } + for key, value in iter(expected.items()): + assert env[key] == value + assert env["wsgi.input"].read(0) == b"" + assert create_environ("/foo", "http://example.com/")["SCRIPT_NAME"] == "" + + +def test_create_environ_query_string_error(): + with pytest.raises(ValueError): + create_environ("/foo?bar=baz", query_string={"a": "b"}) + + +def test_builder_from_environ(): + environ = create_environ( + "/ㄱ", + base_url="https://example.com/base", + query_string={"name": "Werkzeug"}, + data={"foo": "ㄴ"}, + headers={"X-Foo": "ㄷ"}, + ) + builder = EnvironBuilder.from_environ(environ) + + try: + new_environ = builder.get_environ() + finally: + builder.close() + + assert new_environ == environ + + +def test_file_closing(): + closed = [] + + class SpecialInput: + def read(self, size): + return "" + + def close(self): + closed.append(self) + + create_environ(data={"foo": SpecialInput()}) + assert len(closed) == 1 + builder = EnvironBuilder() + builder.files.add_file("blah", SpecialInput()) + builder.close() + assert len(closed) == 2 + + +def test_follow_redirect(): + env = create_environ("/", base_url="http://localhost") + c = Client(redirect_with_get_app) + response = c.open(environ_overrides=env, follow_redirects=True) + assert response.status == "200 OK" + assert response.text == "current url: http://localhost/some/redirect/" + + # Test that the :cls:`Client` is aware of user defined response wrappers + c = Client(redirect_with_get_app) + resp = c.get("/", follow_redirects=True) + assert resp.status_code == 200 + assert resp.text == "current url: http://localhost/some/redirect/" + + # test with URL other than '/' to make sure redirected URL's are correct + c = Client(redirect_with_get_app) + resp = c.get("/first/request", follow_redirects=True) + assert resp.status_code == 200 + assert resp.text == "current url: http://localhost/some/redirect/" + + +def test_follow_local_redirect(): + class LocalResponse(Response): + autocorrect_location_header = False + + def local_redirect_app(environ, start_response): + req = Request(environ) + if "/from/location" in req.url: + response = redirect("/to/location", Response=LocalResponse) + else: + response = Response(f"current path: {req.path}") + return response(environ, start_response) + + c = Client(local_redirect_app) + resp = c.get("/from/location", follow_redirects=True) + assert resp.status_code == 200 + assert resp.text == "current path: /to/location" + + +@pytest.mark.parametrize( + ("code", "keep"), ((302, False), (301, False), (307, True), (308, True)) +) +def test_follow_redirect_body(code, keep): + @Request.application + def app(request): + if request.url == "http://localhost/some/redirect/": + assert request.method == "POST" if keep else "GET" + assert request.headers["X-Foo"] == "bar" + + if keep: + assert request.form["foo"] == "bar" + else: + assert not request.form + + return Response(f"current url: {request.url}") + + return redirect("http://localhost/some/redirect/", code=code) + + c = Client(app) + response = c.post( + "/", follow_redirects=True, data={"foo": "bar"}, headers={"X-Foo": "bar"} + ) + assert response.status_code == 200 + assert response.text == "current url: http://localhost/some/redirect/" + + +def test_follow_external_redirect(): + env = create_environ("/", base_url="http://localhost") + c = Client(external_redirect_demo_app) + pytest.raises( + RuntimeError, lambda: c.get(environ_overrides=env, follow_redirects=True) + ) + + +def test_follow_external_redirect_on_same_subdomain(): + env = create_environ("/", base_url="http://example.com") + c = Client(external_subdomain_redirect_demo_app, allow_subdomain_redirects=True) + c.get(environ_overrides=env, follow_redirects=True) + + # check that this does not work for real external domains + env = create_environ("/", base_url="http://localhost") + pytest.raises( + RuntimeError, lambda: c.get(environ_overrides=env, follow_redirects=True) + ) + + # check that subdomain redirects fail if no `allow_subdomain_redirects` is applied + c = Client(external_subdomain_redirect_demo_app) + pytest.raises( + RuntimeError, lambda: c.get(environ_overrides=env, follow_redirects=True) + ) + + +def test_follow_redirect_loop(): + c = Client(redirect_loop_app) + with pytest.raises(ClientRedirectError): + c.get("/", follow_redirects=True) + + +def test_follow_redirect_non_root_base_url(): + @Request.application + def app(request): + if request.path == "/redirect": + return redirect("done") + + return Response(request.path) + + c = Client(app) + response = c.get( + "/redirect", base_url="http://localhost/other", follow_redirects=True + ) + assert response.text == "/done" + + +def test_follow_redirect_exhaust_intermediate(): + class Middleware: + def __init__(self, app): + self.app = app + self.active = 0 + + def __call__(self, environ, start_response): + # Test client must exhaust response stream, otherwise the + # cleanup code that decrements this won't have run by the + # time the next request is started. + assert not self.active + self.active += 1 + try: + yield from self.app(environ, start_response) + finally: + self.active -= 1 + + app = Middleware(redirect_with_get_app) + client = Client(Middleware(redirect_with_get_app)) + response = client.get("/", follow_redirects=True, buffered=False) + assert response.text == "current url: http://localhost/some/redirect/" + assert not app.active + + +def test_redirects_are_tracked(): + @Request.application + def app(request): + if request.path == "/first": + return redirect("/second") + + if request.path == "/second": + return redirect("/third") + + return Response("done") + + c = Client(app) + response = c.get("/first", follow_redirects=True) + assert response.text == "done" + assert len(response.history) == 2 + + assert response.history[-1].request.path == "/second" + assert response.history[-1].status_code == 302 + assert response.history[-1].location == "/third" + assert len(response.history[-1].history) == 1 + assert response.history[-1].history[-1] is response.history[-2] + + assert response.history[-2].request.path == "/first" + assert response.history[-2].status_code == 302 + assert response.history[-2].location == "/second" + assert len(response.history[-2].history) == 0 + + +def test_cookie_across_redirect(): + @Request.application + def app(request): + if request.path == "/": + return Response(request.cookies.get("auth", "out")) + + if request.path == "/in": + rv = redirect("/") + rv.set_cookie("auth", "in") + return rv + + if request.path == "/out": + rv = redirect("/") + rv.delete_cookie("auth") + return rv + + c = Client(app) + assert c.get("/").text == "out" + assert c.get("/in", follow_redirects=True).text == "in" + assert c.get("/").text == "in" + assert c.get("/out", follow_redirects=True).text == "out" + assert c.get("/").text == "out" + + +def test_path_info_script_name_unquoting(): + def test_app(environ, start_response): + start_response("200 OK", [("Content-Type", "text/plain")]) + return [f"{environ['PATH_INFO']}\n{environ['SCRIPT_NAME']}"] + + c = Client(test_app) + resp = c.get("/foo%40bar") + assert resp.text == "/foo@bar\n" + c = Client(test_app) + resp = c.get("/foo%40bar", "http://localhost/bar%40baz") + assert resp.text == "/foo@bar\n/bar@baz" + + +def test_multi_value_submit(): + c = Client(multi_value_post_app) + data = {"field": ["val1", "val2"]} + resp = c.post("/", data=data) + assert resp.status_code == 200 + c = Client(multi_value_post_app) + data = MultiDict({"field": ["val1", "val2"]}) + resp = c.post("/", data=data) + assert resp.status_code == 200 + + +def test_iri_support(): + b = EnvironBuilder("/föö-bar", base_url="http://☃.net/") + assert b.path == "/f%C3%B6%C3%B6-bar" + assert b.base_url == "http://xn--n3h.net/" + + +@pytest.mark.parametrize("buffered", (True, False)) +@pytest.mark.parametrize("iterable", (True, False)) +def test_run_wsgi_apps(buffered, iterable): + leaked_data = [] + + def simple_app(environ, start_response): + start_response("200 OK", [("Content-Type", "text/html")]) + return ["Hello World!"] + + def yielding_app(environ, start_response): + start_response("200 OK", [("Content-Type", "text/html")]) + yield "Hello " + yield "World!" + + def late_start_response(environ, start_response): + yield "Hello " + yield "World" + start_response("200 OK", [("Content-Type", "text/html")]) + yield "!" + + def depends_on_close(environ, start_response): + leaked_data.append("harhar") + start_response("200 OK", [("Content-Type", "text/html")]) + + class Rv: + def __iter__(self): + yield "Hello " + yield "World" + yield "!" + + def close(self): + assert leaked_data.pop() == "harhar" + + return Rv() + + for app in (simple_app, yielding_app, late_start_response, depends_on_close): + if iterable: + app = iterable_middleware(app) + app_iter, status, headers = run_wsgi_app(app, {}, buffered=buffered) + assert status == "200 OK" + assert list(headers) == [("Content-Type", "text/html")] + assert "".join(app_iter) == "Hello World!" + + if hasattr(app_iter, "close"): + app_iter.close() + assert not leaked_data + + +@pytest.mark.parametrize("buffered", (True, False)) +@pytest.mark.parametrize("iterable", (True, False)) +def test_lazy_start_response_empty_response_app(buffered, iterable): + class app: + def __init__(self, environ, start_response): + self.start_response = start_response + + def __iter__(self): + return self + + def __next__(self): + self.start_response("200 OK", [("Content-Type", "text/html")]) + raise StopIteration + + if iterable: + app = iterable_middleware(app) + app_iter, status, headers = run_wsgi_app(app, {}, buffered=buffered) + assert status == "200 OK" + assert list(headers) == [("Content-Type", "text/html")] + assert "".join(app_iter) == "" + + +def test_run_wsgi_app_closing_iterator(): + got_close = [] + + class CloseIter: + def __init__(self): + self.iterated = False + + def __iter__(self): + return self + + def close(self): + got_close.append(None) + + def __next__(self): + if self.iterated: + raise StopIteration() + self.iterated = True + return "bar" + + def bar(environ, start_response): + start_response("200 OK", [("Content-Type", "text/plain")]) + return CloseIter() + + app_iter, status, headers = run_wsgi_app(bar, {}) + assert status == "200 OK" + assert list(headers) == [("Content-Type", "text/plain")] + assert next(app_iter) == "bar" + pytest.raises(StopIteration, partial(next, app_iter)) + app_iter.close() + + assert run_wsgi_app(bar, {}, True)[0] == ["bar"] + + assert len(got_close) == 2 + + +def iterable_middleware(app): + """Guarantee that the app returns an iterable""" + + def inner(environ, start_response): + rv = app(environ, start_response) + + class Iterable: + def __iter__(self): + return iter(rv) + + if hasattr(rv, "close"): + + def close(self): + rv.close() + + return Iterable() + + return inner + + +def test_multiple_cookies(): + @Request.application + def test_app(request): + response = Response(repr(sorted(request.cookies.items()))) + response.set_cookie("test1", b"foo") + response.set_cookie("test2", b"bar") + return response + + client = Client(test_app) + resp = client.get("/") + assert resp.text == "[]" + resp = client.get("/") + assert resp.text == repr([("test1", "foo"), ("test2", "bar")]) + + +def test_correct_open_invocation_on_redirect(): + class MyClient(Client): + counter = 0 + + def open(self, *args, **kwargs): + self.counter += 1 + env = kwargs.setdefault("environ_overrides", {}) + env["werkzeug._foo"] = self.counter + return Client.open(self, *args, **kwargs) + + @Request.application + def test_app(request): + return Response(str(request.environ["werkzeug._foo"])) + + c = MyClient(test_app, response_wrapper=Response) + assert c.get("/").text == "1" + assert c.get("/").text == "2" + assert c.get("/").text == "3" + + +def test_correct_encoding(): + req = Request.from_values("/\N{SNOWMAN}", "http://example.com/foo") + assert req.script_root == "/foo" + assert req.path == "/\N{SNOWMAN}" + + +def test_full_url_requests_with_args(): + base = "http://example.com/" + + @Request.application + def test_app(request): + return Response(request.args["x"]) + + client = Client(test_app) + resp = client.get("/?x=42", base) + assert resp.text == "42" + resp = client.get("http://www.example.com/?x=23", base) + assert resp.text == "23" + + +def test_delete_requests_with_form(): + @Request.application + def test_app(request): + return Response(request.form.get("x", None)) + + client = Client(test_app) + resp = client.delete("/", data={"x": 42}) + assert resp.text == "42" + + +def test_post_with_file_descriptor(tmpdir): + c = Client(Response()) + f = tmpdir.join("some-file.txt") + f.write("foo") + with open(f.strpath) as data: + resp = c.post("/", data=data) + assert resp.status_code == 200 + with open(f.strpath, mode="rb") as data: + resp = c.post("/", data=data) + assert resp.status_code == 200 + + +def test_content_type(): + @Request.application + def test_app(request): + return Response(request.content_type) + + client = Client(test_app) + + resp = client.get("/", data=b"testing", mimetype="text/css") + assert resp.text == "text/css; charset=utf-8" + + resp = client.get("/", data=b"testing", mimetype="application/octet-stream") + assert resp.text == "application/octet-stream" + + +def test_raw_request_uri(): + @Request.application + def app(request): + path_info = request.path + request_uri = request.environ["REQUEST_URI"] + return Response("\n".join((path_info, request_uri))) + + client = Client(app) + response = client.get("/hello%2fworld") + data = response.text + assert data == "/hello/world\n/hello%2fworld" + + response = client.get("/?a=b") + assert response.text == "/\n/?a=b" + + response = client.get("/%3f?") # escaped ? in path, and empty query string + assert response.text == "/?\n/%3f?" + + +def no_response_headers_app(environ, start_response): + """A WSGI application which returns a resposne with no headers.""" + response = Response("Response") + response.headers.clear() + return response(environ, start_response) + + +def test_no_content_type_header_addition(): + c = Client(no_response_headers_app) + response = c.open() + assert response.headers == Headers([("Content-Length", "8")]) diff --git a/tests/test_urls.py b/tests/test_urls.py new file mode 100644 index 0000000..a409709 --- /dev/null +++ b/tests/test_urls.py @@ -0,0 +1,385 @@ +import io + +import pytest + +from werkzeug import urls +from werkzeug.datastructures import OrderedMultiDict + + +def test_parsing(): + url = urls.url_parse("http://anon:hunter2@[2001:db8:0:1]:80/a/b/c") + assert url.netloc == "anon:hunter2@[2001:db8:0:1]:80" + assert url.username == "anon" + assert url.password == "hunter2" + assert url.port == 80 + assert url.ascii_host == "2001:db8:0:1" + + assert url.get_file_location() == (None, None) # no file scheme + + +@pytest.mark.parametrize("implicit_format", (True, False)) +@pytest.mark.parametrize("localhost", ("127.0.0.1", "::1", "localhost")) +def test_fileurl_parsing_windows(implicit_format, localhost, monkeypatch): + if implicit_format: + pathformat = None + monkeypatch.setattr("os.name", "nt") + else: + pathformat = "windows" + monkeypatch.delattr("os.name") # just to make sure it won't get used + + url = urls.url_parse("file:///C:/Documents and Settings/Foobar/stuff.txt") + assert url.netloc == "" + assert url.scheme == "file" + assert url.get_file_location(pathformat) == ( + None, + r"C:\Documents and Settings\Foobar\stuff.txt", + ) + + url = urls.url_parse("file://///server.tld/file.txt") + assert url.get_file_location(pathformat) == ("server.tld", r"file.txt") + + url = urls.url_parse("file://///server.tld") + assert url.get_file_location(pathformat) == ("server.tld", "") + + url = urls.url_parse(f"file://///{localhost}") + assert url.get_file_location(pathformat) == (None, "") + + url = urls.url_parse(f"file://///{localhost}/file.txt") + assert url.get_file_location(pathformat) == (None, r"file.txt") + + +def test_replace(): + url = urls.url_parse("http://de.wikipedia.org/wiki/Troll") + assert url.replace(query="foo=bar") == urls.url_parse( + "http://de.wikipedia.org/wiki/Troll?foo=bar" + ) + assert url.replace(scheme="https") == urls.url_parse( + "https://de.wikipedia.org/wiki/Troll" + ) + + +def test_quoting(): + assert urls.url_quote("\xf6\xe4\xfc") == "%C3%B6%C3%A4%C3%BC" + assert urls.url_unquote(urls.url_quote('#%="\xf6')) == '#%="\xf6' + assert urls.url_quote_plus("foo bar") == "foo+bar" + assert urls.url_unquote_plus("foo+bar") == "foo bar" + assert urls.url_quote_plus("foo+bar") == "foo%2Bbar" + assert urls.url_unquote_plus("foo%2Bbar") == "foo+bar" + assert urls.url_encode({b"a": None, b"b": b"foo bar"}) == "b=foo+bar" + assert urls.url_encode({"a": None, "b": "foo bar"}) == "b=foo+bar" + assert ( + urls.url_fix("http://de.wikipedia.org/wiki/Elf (Begriffsklärung)") + == "http://de.wikipedia.org/wiki/Elf%20(Begriffskl%C3%A4rung)" + ) + assert urls.url_quote_plus(42) == "42" + assert urls.url_quote(b"\xff") == "%FF" + + +def test_bytes_unquoting(): + assert ( + urls.url_unquote(urls.url_quote('#%="\xf6', charset="latin1"), charset=None) + == b'#%="\xf6' + ) + + +def test_url_decoding(): + x = urls.url_decode(b"foo=42&bar=23&uni=H%C3%A4nsel") + assert x["foo"] == "42" + assert x["bar"] == "23" + assert x["uni"] == "Hänsel" + + x = urls.url_decode(b"foo=42;bar=23;uni=H%C3%A4nsel", separator=b";") + assert x["foo"] == "42" + assert x["bar"] == "23" + assert x["uni"] == "Hänsel" + + x = urls.url_decode(b"%C3%9Ch=H%C3%A4nsel") + assert x["Üh"] == "Hänsel" + + +def test_url_bytes_decoding(): + x = urls.url_decode(b"foo=42&bar=23&uni=H%C3%A4nsel", charset=None) + assert x[b"foo"] == b"42" + assert x[b"bar"] == b"23" + assert x[b"uni"] == "Hänsel".encode() + + +def test_stream_decoding_string_fails(): + pytest.raises(TypeError, urls.url_decode_stream, "testing") + + +def test_url_encoding(): + assert urls.url_encode({"foo": "bar 45"}) == "foo=bar+45" + d = {"foo": 1, "bar": 23, "blah": "Hänsel"} + assert urls.url_encode(d, sort=True) == "bar=23&blah=H%C3%A4nsel&foo=1" + assert ( + urls.url_encode(d, sort=True, separator=";") == "bar=23;blah=H%C3%A4nsel;foo=1" + ) + + +def test_sorted_url_encode(): + assert ( + urls.url_encode( + {"a": 42, "b": 23, 1: 1, 2: 2}, sort=True, key=lambda i: str(i[0]) + ) + == "1=1&2=2&a=42&b=23" + ) + assert ( + urls.url_encode( + {"A": 1, "a": 2, "B": 3, "b": 4}, + sort=True, + key=lambda x: x[0].lower() + x[0], + ) + == "A=1&a=2&B=3&b=4" + ) + + +def test_streamed_url_encoding(): + out = io.StringIO() + urls.url_encode_stream({"foo": "bar 45"}, out) + assert out.getvalue() == "foo=bar+45" + + d = {"foo": 1, "bar": 23, "blah": "Hänsel"} + out = io.StringIO() + urls.url_encode_stream(d, out, sort=True) + assert out.getvalue() == "bar=23&blah=H%C3%A4nsel&foo=1" + out = io.StringIO() + urls.url_encode_stream(d, out, sort=True, separator=";") + assert out.getvalue() == "bar=23;blah=H%C3%A4nsel;foo=1" + + gen = urls.url_encode_stream(d, sort=True) + assert next(gen) == "bar=23" + assert next(gen) == "blah=H%C3%A4nsel" + assert next(gen) == "foo=1" + pytest.raises(StopIteration, lambda: next(gen)) + + +def test_url_fixing(): + x = urls.url_fix("http://de.wikipedia.org/wiki/Elf (Begriffskl\xe4rung)") + assert x == "http://de.wikipedia.org/wiki/Elf%20(Begriffskl%C3%A4rung)" + + x = urls.url_fix("http://just.a.test/$-_.+!*'(),") + assert x == "http://just.a.test/$-_.+!*'()," + + x = urls.url_fix("http://höhöhö.at/höhöhö/hähähä") + assert x == r"http://xn--hhh-snabb.at/h%C3%B6h%C3%B6h%C3%B6/h%C3%A4h%C3%A4h%C3%A4" + + +def test_url_fixing_filepaths(): + x = urls.url_fix(r"file://C:\Users\Administrator\My Documents\ÑÈáÇíí") + assert x == ( + r"file:///C%3A/Users/Administrator/My%20Documents/" + r"%C3%91%C3%88%C3%A1%C3%87%C3%AD%C3%AD" + ) + + a = urls.url_fix(r"file:/C:/") + b = urls.url_fix(r"file://C:/") + c = urls.url_fix(r"file:///C:/") + assert a == b == c == r"file:///C%3A/" + + x = urls.url_fix(r"file://host/sub/path") + assert x == r"file://host/sub/path" + + x = urls.url_fix(r"file:///") + assert x == r"file:///" + + +def test_url_fixing_qs(): + x = urls.url_fix(b"http://example.com/?foo=%2f%2f") + assert x == "http://example.com/?foo=%2f%2f" + + x = urls.url_fix( + "http://acronyms.thefreedictionary.com/" + "Algebraic+Methods+of+Solving+the+Schr%C3%B6dinger+Equation" + ) + assert x == ( + "http://acronyms.thefreedictionary.com/" + "Algebraic+Methods+of+Solving+the+Schr%C3%B6dinger+Equation" + ) + + +def test_iri_support(): + assert urls.uri_to_iri("http://xn--n3h.net/") == "http://\u2603.net/" + assert ( + urls.uri_to_iri(b"http://%C3%BCser:p%C3%A4ssword@xn--n3h.net/p%C3%A5th") + == "http://\xfcser:p\xe4ssword@\u2603.net/p\xe5th" + ) + assert urls.iri_to_uri("http://☃.net/") == "http://xn--n3h.net/" + assert ( + urls.iri_to_uri("http://üser:pässword@☃.net/påth") + == "http://%C3%BCser:p%C3%A4ssword@xn--n3h.net/p%C3%A5th" + ) + + assert ( + urls.uri_to_iri("http://test.com/%3Fmeh?foo=%26%2F") + == "http://test.com/%3Fmeh?foo=%26%2F" + ) + + # this should work as well, might break on 2.4 because of a broken + # idna codec + assert urls.uri_to_iri(b"/foo") == "/foo" + assert urls.iri_to_uri("/foo") == "/foo" + + assert ( + urls.iri_to_uri("http://föö.com:8080/bam/baz") + == "http://xn--f-1gaa.com:8080/bam/baz" + ) + + +def test_iri_safe_conversion(): + assert urls.iri_to_uri("magnet:?foo=bar") == "magnet:?foo=bar" + assert urls.iri_to_uri("itms-service://?foo=bar") == "itms-service:?foo=bar" + assert ( + urls.iri_to_uri("itms-service://?foo=bar", safe_conversion=True) + == "itms-service://?foo=bar" + ) + + +def test_iri_safe_quoting(): + uri = "http://xn--f-1gaa.com/%2F%25?q=%C3%B6&x=%3D%25#%25" + iri = "http://föö.com/%2F%25?q=ö&x=%3D%25#%25" + assert urls.uri_to_iri(uri) == iri + assert urls.iri_to_uri(urls.uri_to_iri(uri)) == uri + + +def test_ordered_multidict_encoding(): + d = OrderedMultiDict() + d.add("foo", 1) + d.add("foo", 2) + d.add("foo", 3) + d.add("bar", 0) + d.add("foo", 4) + assert urls.url_encode(d) == "foo=1&foo=2&foo=3&bar=0&foo=4" + + +def test_multidict_encoding(): + d = OrderedMultiDict() + d.add("2013-10-10T23:26:05.657975+0000", "2013-10-10T23:26:05.657975+0000") + assert ( + urls.url_encode(d) + == "2013-10-10T23%3A26%3A05.657975%2B0000=2013-10-10T23%3A26%3A05.657975%2B0000" + ) + + +def test_url_unquote_plus_unicode(): + # was broken in 0.6 + assert urls.url_unquote_plus("\x6d") == "\x6d" + + +def test_quoting_of_local_urls(): + rv = urls.iri_to_uri("/foo\x8f") + assert rv == "/foo%C2%8F" + + +def test_url_attributes(): + rv = urls.url_parse("http://foo%3a:bar%3a@[::1]:80/123?x=y#frag") + assert rv.scheme == "http" + assert rv.auth == "foo%3a:bar%3a" + assert rv.username == "foo:" + assert rv.password == "bar:" + assert rv.raw_username == "foo%3a" + assert rv.raw_password == "bar%3a" + assert rv.host == "::1" + assert rv.port == 80 + assert rv.path == "/123" + assert rv.query == "x=y" + assert rv.fragment == "frag" + + rv = urls.url_parse("http://\N{SNOWMAN}.com/") + assert rv.host == "\N{SNOWMAN}.com" + assert rv.ascii_host == "xn--n3h.com" + + +def test_url_attributes_bytes(): + rv = urls.url_parse(b"http://foo%3a:bar%3a@[::1]:80/123?x=y#frag") + assert rv.scheme == b"http" + assert rv.auth == b"foo%3a:bar%3a" + assert rv.username == "foo:" + assert rv.password == "bar:" + assert rv.raw_username == b"foo%3a" + assert rv.raw_password == b"bar%3a" + assert rv.host == b"::1" + assert rv.port == 80 + assert rv.path == b"/123" + assert rv.query == b"x=y" + assert rv.fragment == b"frag" + + +def test_url_joining(): + assert urls.url_join("/foo", "/bar") == "/bar" + assert urls.url_join("http://example.com/foo", "/bar") == "http://example.com/bar" + assert urls.url_join("file:///tmp/", "test.html") == "file:///tmp/test.html" + assert urls.url_join("file:///tmp/x", "test.html") == "file:///tmp/test.html" + assert urls.url_join("file:///tmp/x", "../../../x.html") == "file:///x.html" + + +def test_partial_unencoded_decode(): + ref = "foo=정상처리".encode("euc-kr") + x = urls.url_decode(ref, charset="euc-kr") + assert x["foo"] == "정상처리" + + +def test_iri_to_uri_idempotence_ascii_only(): + uri = "http://www.idempoten.ce" + uri = urls.iri_to_uri(uri) + assert urls.iri_to_uri(uri) == uri + + +def test_iri_to_uri_idempotence_non_ascii(): + uri = "http://\N{SNOWMAN}/\N{SNOWMAN}" + uri = urls.iri_to_uri(uri) + assert urls.iri_to_uri(uri) == uri + + +def test_uri_to_iri_idempotence_ascii_only(): + uri = "http://www.idempoten.ce" + uri = urls.uri_to_iri(uri) + assert urls.uri_to_iri(uri) == uri + + +def test_uri_to_iri_idempotence_non_ascii(): + uri = "http://xn--n3h/%E2%98%83" + uri = urls.uri_to_iri(uri) + assert urls.uri_to_iri(uri) == uri + + +def test_iri_to_uri_to_iri(): + iri = "http://föö.com/" + uri = urls.iri_to_uri(iri) + assert urls.uri_to_iri(uri) == iri + + +def test_uri_to_iri_to_uri(): + uri = "http://xn--f-rgao.com/%C3%9E" + iri = urls.uri_to_iri(uri) + assert urls.iri_to_uri(iri) == uri + + +def test_uri_iri_normalization(): + uri = "http://xn--f-rgao.com/%E2%98%90/fred?utf8=%E2%9C%93" + iri = "http://föñ.com/\N{BALLOT BOX}/fred?utf8=\u2713" + + tests = [ + "http://föñ.com/\N{BALLOT BOX}/fred?utf8=\u2713", + "http://xn--f-rgao.com/\u2610/fred?utf8=\N{CHECK MARK}", + b"http://xn--f-rgao.com/%E2%98%90/fred?utf8=%E2%9C%93", + "http://xn--f-rgao.com/%E2%98%90/fred?utf8=%E2%9C%93", + "http://föñ.com/\u2610/fred?utf8=%E2%9C%93", + b"http://xn--f-rgao.com/\xe2\x98\x90/fred?utf8=\xe2\x9c\x93", + ] + + for test in tests: + assert urls.uri_to_iri(test) == iri + assert urls.iri_to_uri(test) == uri + assert urls.uri_to_iri(urls.iri_to_uri(test)) == iri + assert urls.iri_to_uri(urls.uri_to_iri(test)) == uri + assert urls.uri_to_iri(urls.uri_to_iri(test)) == iri + assert urls.iri_to_uri(urls.iri_to_uri(test)) == uri + + +def test_uri_to_iri_dont_unquote_space(): + assert urls.uri_to_iri("abc%20def") == "abc%20def" + + +def test_iri_to_uri_dont_quote_reserved(): + assert urls.iri_to_uri("/path[bracket]?(paren)") == "/path[bracket]?(paren)" diff --git a/tests/test_utils.py b/tests/test_utils.py new file mode 100644 index 0000000..ed8d8d0 --- /dev/null +++ b/tests/test_utils.py @@ -0,0 +1,316 @@ +import inspect +from datetime import datetime + +import pytest + +from werkzeug import Request +from werkzeug import utils +from werkzeug.datastructures import Headers +from werkzeug.http import http_date +from werkzeug.http import parse_date +from werkzeug.test import Client +from werkzeug.wrappers import Response + + +def test_redirect(): + resp = utils.redirect("/füübär") + assert resp.headers["Location"] == "/f%C3%BC%C3%BCb%C3%A4r" + assert resp.status_code == 302 + assert resp.get_data() == ( + b"\n" + b"\n" + b"Redirecting...\n" + b"
Redirecting...
\n" + b"
You should be redirected automatically to the target URL: " + b'/f\xc3\xbc\xc3\xbcb\xc3\xa4r. ' + b"If not, click the link.\n" + ) + + resp = utils.redirect("http://☃.net/", 307) + assert resp.headers["Location"] == "http://xn--n3h.net/" + assert resp.status_code == 307 + assert resp.get_data() == ( + b"\n" + b"\n" + b"Redirecting...\n" + b"
Redirecting...
\n" + b"
You should be redirected automatically to the target URL: " + b'http://\xe2\x98\x83.net/. ' + b"If not, click the link.\n" + ) + + resp = utils.redirect("http://example.com/", 305) + assert resp.headers["Location"] == "http://example.com/" + assert resp.status_code == 305 + assert resp.get_data() == ( + b"\n" + b"\n" + b"Redirecting...\n" + b"
Redirecting...
\n" + b"
You should be redirected automatically to the target URL: " + b'http://example.com/. ' + b"If not, click the link.\n" + ) + + +def test_redirect_xss(): + location = 'http://example.com/?xss=">' + resp = utils.redirect(location) + assert b"" not in resp.get_data() + + location = 'http://example.com/?xss="onmouseover="alert(1)' + resp = utils.redirect(location) + assert ( + b'href="http://example.com/?xss="onmouseover="alert(1)"' not in resp.get_data() + ) + + +def test_redirect_with_custom_response_class(): + class MyResponse(Response): + pass + + location = "http://example.com/redirect" + resp = utils.redirect(location, Response=MyResponse) + + assert isinstance(resp, MyResponse) + assert resp.headers["Location"] == location + + +def test_cached_property(): + foo = [] + + class A: + def prop(self): + foo.append(42) + return 42 + + prop = utils.cached_property(prop) + + a = A() + p = a.prop + q = a.prop + assert p == q == 42 + assert foo == [42] + + foo = [] + + class A: + def _prop(self): + foo.append(42) + return 42 + + prop = utils.cached_property(_prop, name="prop") + del _prop + + a = A() + p = a.prop + q = a.prop + assert p == q == 42 + assert foo == [42] + + +def test_can_set_cached_property(): + class A: + @utils.cached_property + def _prop(self): + return "cached_property return value" + + a = A() + a._prop = "value" + assert a._prop == "value" + + +def test_invalidate_cached_property(): + accessed = 0 + + class A: + @utils.cached_property + def prop(self): + nonlocal accessed + accessed += 1 + return 42 + + a = A() + p = a.prop + q = a.prop + assert p == q == 42 + assert accessed == 1 + + a.prop = 16 + assert a.prop == 16 + assert accessed == 1 + + del a.prop + r = a.prop + assert r == 42 + assert accessed == 2 + + +def test_inspect_treats_cached_property_as_property(): + class A: + @utils.cached_property + def _prop(self): + return "cached_property return value" + + attrs = inspect.classify_class_attrs(A) + for attr in attrs: + if attr.name == "_prop": + break + assert attr.kind == "property" + + +def test_environ_property(): + class A: + environ = {"string": "abc", "number": "42"} + + string = utils.environ_property("string") + missing = utils.environ_property("missing", "spam") + read_only = utils.environ_property("number") + number = utils.environ_property("number", load_func=int) + broken_number = utils.environ_property("broken_number", load_func=int) + date = utils.environ_property( + "date", None, parse_date, http_date, read_only=False + ) + foo = utils.environ_property("foo") + + a = A() + assert a.string == "abc" + assert a.missing == "spam" + + def test_assign(): + a.read_only = "something" + + pytest.raises(AttributeError, test_assign) + assert a.number == 42 + assert a.broken_number is None + assert a.date is None + a.date = datetime(2008, 1, 22, 10, 0, 0, 0) + assert a.environ["date"] == "Tue, 22 Jan 2008 10:00:00 GMT" + + +def test_import_string(): + from datetime import date + from werkzeug.debug import DebuggedApplication + + assert utils.import_string("datetime.date") is date + assert utils.import_string("datetime.date") is date + assert utils.import_string("datetime:date") is date + assert utils.import_string("XXXXXXXXXXXX", True) is None + assert utils.import_string("datetime.XXXXXXXXXXXX", True) is None + assert ( + utils.import_string("werkzeug.debug.DebuggedApplication") is DebuggedApplication + ) + pytest.raises(ImportError, utils.import_string, "XXXXXXXXXXXXXXXX") + pytest.raises(ImportError, utils.import_string, "datetime.XXXXXXXXXX") + + +def test_import_string_provides_traceback(tmpdir, monkeypatch): + monkeypatch.syspath_prepend(str(tmpdir)) + # Couple of packages + dir_a = tmpdir.mkdir("a") + dir_b = tmpdir.mkdir("b") + # Totally packages, I promise + dir_a.join("__init__.py").write("") + dir_b.join("__init__.py").write("") + # 'aa.a' that depends on 'bb.b', which in turn has a broken import + dir_a.join("aa.py").write("from b import bb") + dir_b.join("bb.py").write("from os import a_typo") + + # Do we get all the useful information in the traceback? + with pytest.raises(ImportError) as baz_exc: + utils.import_string("a.aa") + traceback = "".join(str(line) for line in baz_exc.traceback) + assert "bb.py':1" in traceback # a bit different than typical python tb + assert "from os import a_typo" in traceback + + +def test_import_string_attribute_error(tmpdir, monkeypatch): + monkeypatch.syspath_prepend(str(tmpdir)) + tmpdir.join("foo_test.py").write("from bar_test import value") + tmpdir.join("bar_test.py").write("raise AttributeError('bad')") + + with pytest.raises(AttributeError) as info: + utils.import_string("foo_test") + + assert "bad" in str(info.value) + + with pytest.raises(AttributeError) as info: + utils.import_string("bar_test") + + assert "bad" in str(info.value) + + +def test_find_modules(): + assert list(utils.find_modules("werkzeug.debug")) == [ + "werkzeug.debug.console", + "werkzeug.debug.repr", + "werkzeug.debug.tbtools", + ] + + +def test_header_set_duplication_bug(): + headers = Headers([("Content-Type", "text/html"), ("Foo", "bar"), ("Blub", "blah")]) + headers["blub"] = "hehe" + headers["blafasel"] = "humm" + assert headers == Headers( + [ + ("Content-Type", "text/html"), + ("Foo", "bar"), + ("blub", "hehe"), + ("blafasel", "humm"), + ] + ) + + +@pytest.mark.parametrize( + ("path", "base_url", "absolute_location"), + [ + ("foo", "http://example.org/app", "http://example.org/app/foo/"), + ("/foo", "http://example.org/app", "http://example.org/app/foo/"), + ("/foo/bar", "http://example.org/", "http://example.org/foo/bar/"), + ("/foo/bar", "http://example.org/app", "http://example.org/app/foo/bar/"), + ("/foo?baz", "http://example.org/", "http://example.org/foo/?baz"), + ("/foo/", "http://example.org/", "http://example.org/foo/"), + ("/foo/", "http://example.org/app", "http://example.org/app/foo/"), + ("/", "http://example.org/", "http://example.org/"), + ("/", "http://example.org/app", "http://example.org/app/"), + ], +) +@pytest.mark.parametrize("autocorrect", [False, True]) +def test_append_slash_redirect(autocorrect, path, base_url, absolute_location): + @Request.application + def app(request): + rv = utils.append_slash_redirect(request.environ) + rv.autocorrect_location_header = autocorrect + return rv + + client = Client(app) + response = client.get(path, base_url=base_url) + assert response.status_code == 308 + + if not autocorrect: + assert response.headers["Location"].count("/") == 1 + else: + assert response.headers["Location"] == absolute_location + + +def test_cached_property_doc(): + @utils.cached_property + def foo(): + """testing""" + return 42 + + assert foo.__doc__ == "testing" + assert foo.__name__ == "foo" + assert foo.__module__ == __name__ + + +def test_secure_filename(): + assert utils.secure_filename("My cool movie.mov") == "My_cool_movie.mov" + assert utils.secure_filename("../../../etc/passwd") == "etc_passwd" + assert ( + utils.secure_filename("i contain cool \xfcml\xe4uts.txt") + == "i_contain_cool_umlauts.txt" + ) + assert utils.secure_filename("__filename__") == "filename" + assert utils.secure_filename("foo$&^*)bar") == "foobar" diff --git a/tests/test_wrappers.py b/tests/test_wrappers.py new file mode 100644 index 0000000..b769a38 --- /dev/null +++ b/tests/test_wrappers.py @@ -0,0 +1,1389 @@ +import contextlib +import json +import os +from datetime import datetime +from datetime import timedelta +from datetime import timezone +from io import BytesIO + +import pytest + +from werkzeug import Response +from werkzeug import wrappers +from werkzeug.datastructures import Accept +from werkzeug.datastructures import CharsetAccept +from werkzeug.datastructures import CombinedMultiDict +from werkzeug.datastructures import Headers +from werkzeug.datastructures import ImmutableList +from werkzeug.datastructures import ImmutableMultiDict +from werkzeug.datastructures import ImmutableOrderedMultiDict +from werkzeug.datastructures import LanguageAccept +from werkzeug.datastructures import MIMEAccept +from werkzeug.datastructures import MultiDict +from werkzeug.exceptions import BadRequest +from werkzeug.exceptions import RequestedRangeNotSatisfiable +from werkzeug.exceptions import SecurityError +from werkzeug.http import COEP +from werkzeug.http import COOP +from werkzeug.http import generate_etag +from werkzeug.test import Client +from werkzeug.test import create_environ +from werkzeug.test import run_wsgi_app +from werkzeug.wsgi import LimitedStream +from werkzeug.wsgi import wrap_file + + +@wrappers.Request.application +def request_demo_app(request): + assert "werkzeug.request" in request.environ + return Response() + + +def assert_environ(environ, method): + assert environ["REQUEST_METHOD"] == method + assert environ["PATH_INFO"] == "/" + assert environ["SCRIPT_NAME"] == "" + assert environ["SERVER_NAME"] == "localhost" + assert environ["wsgi.version"] == (1, 0) + assert environ["wsgi.url_scheme"] == "http" + + +def test_base_request(): + client = Client(request_demo_app) + + # get requests + response = client.get("/?foo=bar&foo=hehe") + request = response.request + assert request.args == MultiDict([("foo", "bar"), ("foo", "hehe")]) + assert request.form == MultiDict() + assert request.data == b"" + assert_environ(request.environ, "GET") + + # post requests with form data + response = client.post( + "/?blub=blah", + data="foo=blub+hehe&blah=42", + content_type="application/x-www-form-urlencoded", + ) + request = response.request + assert request.args == MultiDict([("blub", "blah")]) + assert request.form == MultiDict([("foo", "blub hehe"), ("blah", "42")]) + assert request.data == b"" + # currently we do not guarantee that the values are ordered correctly + # for post data. + # assert response['form_as_list'] == [('foo', ['blub hehe']), ('blah', ['42'])] + assert_environ(request.environ, "POST") + + # patch requests with form data + response = client.patch( + "/?blub=blah", + data="foo=blub+hehe&blah=42", + content_type="application/x-www-form-urlencoded", + ) + request = response.request + assert request.args == MultiDict([("blub", "blah")]) + assert request.form == MultiDict([("foo", "blub hehe"), ("blah", "42")]) + assert request.data == b"" + assert_environ(request.environ, "PATCH") + + # post requests with json data + json = b'{"foo": "bar", "blub": "blah"}' + response = client.post("/?a=b", data=json, content_type="application/json") + request = response.request + assert request.data == json + assert request.args == MultiDict([("a", "b")]) + assert request.form == MultiDict() + + +def test_query_string_is_bytes(): + req = wrappers.Request.from_values("/?foo=%2f") + assert req.query_string == b"foo=%2f" + + +def test_request_repr(): + req = wrappers.Request.from_values("/foobar") + assert "" == repr(req) + req = wrappers.Request.from_values("/привет") + assert "" == repr(req) + + +def test_access_route(): + req = wrappers.Request.from_values( + headers={"X-Forwarded-For": "192.168.1.2, 192.168.1.1"}, + environ_base={"REMOTE_ADDR": "192.168.1.3"}, + ) + assert req.access_route == ["192.168.1.2", "192.168.1.1"] + assert req.remote_addr == "192.168.1.3" + + req = wrappers.Request.from_values(environ_base={"REMOTE_ADDR": "192.168.1.3"}) + assert list(req.access_route) == ["192.168.1.3"] + + +def test_url_request_descriptors(): + req = wrappers.Request.from_values("/bar?foo=baz", "http://example.com/test") + assert req.path == "/bar" + assert req.full_path == "/bar?foo=baz" + assert req.script_root == "/test" + assert req.url == "http://example.com/test/bar?foo=baz" + assert req.base_url == "http://example.com/test/bar" + assert req.url_root == "http://example.com/test/" + assert req.host_url == "http://example.com/" + assert req.host == "example.com" + assert req.scheme == "http" + + req = wrappers.Request.from_values("/bar?foo=baz", "https://example.com/test") + assert req.scheme == "https" + + +def test_url_request_descriptors_query_quoting(): + next = "http%3A%2F%2Fwww.example.com%2F%3Fnext%3D%2Fbaz%23my%3Dhash" + req = wrappers.Request.from_values(f"/bar?next={next}", "http://example.com/") + assert req.path == "/bar" + assert req.full_path == f"/bar?next={next}" + assert req.url == f"http://example.com/bar?next={next}" + + +def test_url_request_descriptors_hosts(): + req = wrappers.Request.from_values("/bar?foo=baz", "http://example.com/test") + req.trusted_hosts = ["example.com"] + assert req.path == "/bar" + assert req.full_path == "/bar?foo=baz" + assert req.script_root == "/test" + assert req.url == "http://example.com/test/bar?foo=baz" + assert req.base_url == "http://example.com/test/bar" + assert req.url_root == "http://example.com/test/" + assert req.host_url == "http://example.com/" + assert req.host == "example.com" + assert req.scheme == "http" + + req = wrappers.Request.from_values("/bar?foo=baz", "https://example.com/test") + assert req.scheme == "https" + + req = wrappers.Request.from_values("/bar?foo=baz", "http://example.com/test") + req.trusted_hosts = ["example.org"] + pytest.raises(SecurityError, lambda: req.url) + pytest.raises(SecurityError, lambda: req.base_url) + pytest.raises(SecurityError, lambda: req.url_root) + pytest.raises(SecurityError, lambda: req.host_url) + pytest.raises(SecurityError, lambda: req.host) + + +def test_authorization(): + request = wrappers.Request.from_values( + headers={"Authorization": "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ=="} + ) + a = request.authorization + assert a.type == "basic" + assert a.username == "Aladdin" + assert a.password == "open sesame" + + +def test_authorization_with_unicode(): + request = wrappers.Request.from_values( + headers={"Authorization": "Basic 0YDRg9GB0YHQutC40IE60JHRg9C60LLRiw=="} + ) + a = request.authorization + assert a.type == "basic" + assert a.username == "русскиЁ" + assert a.password == "Буквы" + + +def test_request_application(): + @wrappers.Request.application + def application(request): + return wrappers.Response("Hello World!") + + @wrappers.Request.application + def failing_application(request): + raise BadRequest() + + resp = wrappers.Response.from_app(application, create_environ()) + assert resp.data == b"Hello World!" + assert resp.status_code == 200 + + resp = wrappers.Response.from_app(failing_application, create_environ()) + assert b"Bad Request" in resp.data + assert resp.status_code == 400 + + +def test_request_access_control(): + request = wrappers.Request.from_values( + headers={ + "Origin": "https://palletsprojects.com", + "Access-Control-Request-Headers": "X-A, X-B", + "Access-Control-Request-Method": "PUT", + } + ) + assert request.origin == "https://palletsprojects.com" + assert request.access_control_request_headers == {"X-A", "X-B"} + assert request.access_control_request_method == "PUT" + + +def test_response_access_control(): + response = wrappers.Response("Hello World") + assert response.access_control_allow_credentials is False + response.access_control_allow_credentials = True + response.access_control_allow_headers = ["X-A", "X-B"] + assert response.headers["Access-Control-Allow-Credentials"] == "true" + assert set(response.headers["Access-Control-Allow-Headers"].split(", ")) == { + "X-A", + "X-B", + } + + +def test_base_response(): + response = wrappers.Response("öäü") + assert response.get_data() == "öäü".encode() + + # writing + response = wrappers.Response("foo") + response.stream.write("bar") + assert response.get_data() == b"foobar" + + # set cookie + response = wrappers.Response() + response.set_cookie( + "foo", + value="bar", + max_age=60, + expires=0, + path="/blub", + domain="example.org", + samesite="Strict", + ) + assert response.headers.to_wsgi_list() == [ + ("Content-Type", "text/plain; charset=utf-8"), + ( + "Set-Cookie", + "foo=bar; Domain=example.org;" + " Expires=Thu, 01 Jan 1970 00:00:00 GMT; Max-Age=60;" + " Path=/blub; SameSite=Strict", + ), + ] + + # delete cookie + response = wrappers.Response() + response.delete_cookie("foo") + assert response.headers.to_wsgi_list() == [ + ("Content-Type", "text/plain; charset=utf-8"), + ( + "Set-Cookie", + "foo=; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Max-Age=0; Path=/", + ), + ] + + # close call forwarding + closed = [] + + class Iterable: + def __next__(self): + raise StopIteration() + + def __iter__(self): + return self + + def close(self): + closed.append(True) + + response = wrappers.Response(Iterable()) + response.call_on_close(lambda: closed.append(True)) + app_iter, status, headers = run_wsgi_app(response, create_environ(), buffered=True) + assert status == "200 OK" + assert "".join(app_iter) == "" + assert len(closed) == 2 + + # with statement + del closed[:] + response = wrappers.Response(Iterable()) + with response: + pass + assert len(closed) == 1 + + +@pytest.mark.parametrize( + ("status_code", "expected_status"), + [ + (200, "200 OK"), + (404, "404 NOT FOUND"), + (588, "588 UNKNOWN"), + (999, "999 UNKNOWN"), + ], +) +def test_response_set_status_code(status_code, expected_status): + response = wrappers.Response() + response.status_code = status_code + assert response.status_code == status_code + assert response.status == expected_status + + +@pytest.mark.parametrize( + ("status", "expected_status_code", "expected_status"), + [ + ("404", 404, "404 NOT FOUND"), + ("588", 588, "588 UNKNOWN"), + ("999", 999, "999 UNKNOWN"), + ("200 OK", 200, "200 OK"), + ("999 WTF", 999, "999 WTF"), + ("wtf", 0, "0 wtf"), + ("200 TEA POT", 200, "200 TEA POT"), + (200, 200, "200 OK"), + (400, 400, "400 BAD REQUEST"), + ], +) +def test_response_set_status(status, expected_status_code, expected_status): + response = wrappers.Response() + response.status = status + assert response.status_code == expected_status_code + assert response.status == expected_status + + response = wrappers.Response(status=status) + assert response.status_code == expected_status_code + assert response.status == expected_status + + +def test_response_init_status_empty_string(): + # invalid status codes + with pytest.raises(ValueError) as info: + wrappers.Response(None, "") + + assert "Empty status argument" in str(info.value) + + +def test_response_init_status_tuple(): + with pytest.raises(TypeError) as info: + wrappers.Response(None, tuple()) + + assert "Invalid status argument" in str(info.value) + + +def test_type_forcing(): + def wsgi_application(environ, start_response): + start_response("200 OK", [("Content-Type", "text/html")]) + return ["Hello World!"] + + base_response = wrappers.Response("Hello World!", content_type="text/html") + + class SpecialResponse(wrappers.Response): + def foo(self): + return 42 + + # good enough for this simple application, but don't ever use that in + # real world examples! + fake_env = {} + + for orig_resp in wsgi_application, base_response: + response = SpecialResponse.force_type(orig_resp, fake_env) + assert response.__class__ is SpecialResponse + assert response.foo() == 42 + assert response.get_data() == b"Hello World!" + assert response.content_type == "text/html" + + # without env, no arbitrary conversion + pytest.raises(TypeError, SpecialResponse.force_type, wsgi_application) + + +def test_accept(): + request = wrappers.Request( + { + "HTTP_ACCEPT": "text/xml,application/xml,application/xhtml+xml," + "text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5", + "HTTP_ACCEPT_CHARSET": "ISO-8859-1,utf-8;q=0.7,*;q=0.7", + "HTTP_ACCEPT_ENCODING": "gzip,deflate", + "HTTP_ACCEPT_LANGUAGE": "en-us,en;q=0.5", + "SERVER_NAME": "eggs", + "SERVER_PORT": "80", + } + ) + assert request.accept_mimetypes == MIMEAccept( + [ + ("text/xml", 1), + ("application/xml", 1), + ("application/xhtml+xml", 1), + ("image/png", 1), + ("text/html", 0.9), + ("text/plain", 0.8), + ("*/*", 0.5), + ] + ) + assert request.accept_charsets == CharsetAccept( + [("ISO-8859-1", 1), ("utf-8", 0.7), ("*", 0.7)] + ) + assert request.accept_encodings == Accept([("gzip", 1), ("deflate", 1)]) + assert request.accept_languages == LanguageAccept([("en-us", 1), ("en", 0.5)]) + + request = wrappers.Request( + {"HTTP_ACCEPT": "", "SERVER_NAME": "example.org", "SERVER_PORT": "80"} + ) + assert request.accept_mimetypes == MIMEAccept() + + +def test_etag_request(): + request = wrappers.Request( + { + "HTTP_CACHE_CONTROL": "no-store, no-cache", + "HTTP_IF_MATCH": 'W/"foo", bar, "baz"', + "HTTP_IF_NONE_MATCH": 'W/"foo", bar, "baz"', + "HTTP_IF_MODIFIED_SINCE": "Tue, 22 Jan 2008 11:18:44 GMT", + "HTTP_IF_UNMODIFIED_SINCE": "Tue, 22 Jan 2008 11:18:44 GMT", + "SERVER_NAME": "eggs", + "SERVER_PORT": "80", + } + ) + assert request.cache_control.no_store + assert request.cache_control.no_cache + + for etags in request.if_match, request.if_none_match: + assert etags("bar") + assert etags.contains_raw('W/"foo"') + assert etags.contains_weak("foo") + assert not etags.contains("foo") + + dt = datetime(2008, 1, 22, 11, 18, 44, tzinfo=timezone.utc) + assert request.if_modified_since == dt + assert request.if_unmodified_since == dt + + +def test_user_agent(): + user_agent = "Mozilla/5.0 (X11; Linux x86_64; rv:94.0) Gecko/20100101 Firefox/94.0" + request = wrappers.Request({"HTTP_USER_AGENT": user_agent}) + assert request.user_agent.to_header() == user_agent + assert str(request.user_agent) == user_agent + assert request.user_agent.string == user_agent + + +def test_stream_wrapping(): + class LowercasingStream: + def __init__(self, stream): + self._stream = stream + + def read(self, size=-1): + return self._stream.read(size).lower() + + def readline(self, size=-1): + return self._stream.readline(size).lower() + + data = b"foo=Hello+World" + req = wrappers.Request.from_values( + "/", method="POST", data=data, content_type="application/x-www-form-urlencoded" + ) + req.stream = LowercasingStream(req.stream) + assert req.form["foo"] == "hello world" + + +def test_data_descriptor_triggers_parsing(): + data = b"foo=Hello+World" + req = wrappers.Request.from_values( + "/", method="POST", data=data, content_type="application/x-www-form-urlencoded" + ) + + assert req.data == b"" + assert req.form["foo"] == "Hello World" + + +def test_get_data_method_parsing_caching_behavior(): + data = b"foo=Hello+World" + req = wrappers.Request.from_values( + "/", method="POST", data=data, content_type="application/x-www-form-urlencoded" + ) + + # get_data() caches, so form stays available + assert req.get_data() == data + assert req.form["foo"] == "Hello World" + assert req.get_data() == data + + # here we access the form data first, caching is bypassed + req = wrappers.Request.from_values( + "/", method="POST", data=data, content_type="application/x-www-form-urlencoded" + ) + assert req.form["foo"] == "Hello World" + assert req.get_data() == b"" + + # Another case is uncached get data which trashes everything + req = wrappers.Request.from_values( + "/", method="POST", data=data, content_type="application/x-www-form-urlencoded" + ) + assert req.get_data(cache=False) == data + assert req.get_data(cache=False) == b"" + assert req.form == {} + + # Or we can implicitly start the form parser which is similar to + # the old .data behavior + req = wrappers.Request.from_values( + "/", method="POST", data=data, content_type="application/x-www-form-urlencoded" + ) + assert req.get_data(parse_form_data=True) == b"" + assert req.form["foo"] == "Hello World" + + +def test_etag_response(): + response = wrappers.Response("Hello World") + assert response.get_etag() == (None, None) + response.add_etag() + assert response.get_etag() == ("0a4d55a8d778e5022fab701977c5d840bbc486d0", False) + assert not response.cache_control + response.cache_control.must_revalidate = True + response.cache_control.max_age = 60 + response.headers["Content-Length"] = len(response.get_data()) + assert response.headers["Cache-Control"] in ( + "must-revalidate, max-age=60", + "max-age=60, must-revalidate", + ) + + assert "date" not in response.headers + env = create_environ() + env.update({"REQUEST_METHOD": "GET", "HTTP_IF_NONE_MATCH": response.get_etag()[0]}) + response.make_conditional(env) + assert "date" in response.headers + + # after the thing is invoked by the server as wsgi application + # (we're emulating this here), there must not be any entity + # headers left and the status code would have to be 304 + resp = wrappers.Response.from_app(response, env) + assert resp.status_code == 304 + assert "content-length" not in resp.headers + + # make sure date is not overriden + response = wrappers.Response("Hello World") + response.date = 1337 + d = response.date + response.make_conditional(env) + assert response.date == d + + # make sure content length is only set if missing + response = wrappers.Response("Hello World") + response.content_length = 999 + response.make_conditional(env) + assert response.content_length == 999 + + +def test_etag_response_412(): + response = wrappers.Response("Hello World") + assert response.get_etag() == (None, None) + response.add_etag() + assert response.get_etag() == ("0a4d55a8d778e5022fab701977c5d840bbc486d0", False) + assert not response.cache_control + response.cache_control.must_revalidate = True + response.cache_control.max_age = 60 + response.headers["Content-Length"] = len(response.get_data()) + assert response.headers["Cache-Control"] in ( + "must-revalidate, max-age=60", + "max-age=60, must-revalidate", + ) + + assert "date" not in response.headers + env = create_environ() + env.update( + {"REQUEST_METHOD": "GET", "HTTP_IF_MATCH": f"{response.get_etag()[0]}xyz"} + ) + response.make_conditional(env) + assert "date" in response.headers + + # after the thing is invoked by the server as wsgi application + # (we're emulating this here), there must not be any entity + # headers left and the status code would have to be 412 + resp = wrappers.Response.from_app(response, env) + assert resp.status_code == 412 + # Make sure there is a body still + assert resp.data != b"" + + # make sure date is not overriden + response = wrappers.Response("Hello World") + response.date = 1337 + d = response.date + response.make_conditional(env) + assert response.date == d + + # make sure content length is only set if missing + response = wrappers.Response("Hello World") + response.content_length = 999 + response.make_conditional(env) + assert response.content_length == 999 + + +def test_range_request_basic(): + env = create_environ() + response = wrappers.Response("Hello World") + env["HTTP_RANGE"] = "bytes=0-4" + response.make_conditional(env, accept_ranges=True, complete_length=11) + assert response.status_code == 206 + assert response.headers["Accept-Ranges"] == "bytes" + assert response.headers["Content-Range"] == "bytes 0-4/11" + assert response.headers["Content-Length"] == "5" + assert response.data == b"Hello" + + +def test_range_request_out_of_bound(): + env = create_environ() + response = wrappers.Response("Hello World") + env["HTTP_RANGE"] = "bytes=6-666" + response.make_conditional(env, accept_ranges=True, complete_length=11) + assert response.status_code == 206 + assert response.headers["Accept-Ranges"] == "bytes" + assert response.headers["Content-Range"] == "bytes 6-10/11" + assert response.headers["Content-Length"] == "5" + assert response.data == b"World" + + +def test_range_request_with_file(): + env = create_environ() + resources = os.path.join(os.path.dirname(__file__), "res") + fname = os.path.join(resources, "test.txt") + with open(fname, "rb") as f: + fcontent = f.read() + with open(fname, "rb") as f: + response = wrappers.Response(wrap_file(env, f)) + env["HTTP_RANGE"] = "bytes=0-0" + response.make_conditional( + env, accept_ranges=True, complete_length=len(fcontent) + ) + assert response.status_code == 206 + assert response.headers["Accept-Ranges"] == "bytes" + assert response.headers["Content-Range"] == f"bytes 0-0/{len(fcontent)}" + assert response.headers["Content-Length"] == "1" + assert response.data == fcontent[:1] + + +def test_range_request_with_complete_file(): + env = create_environ() + resources = os.path.join(os.path.dirname(__file__), "res") + fname = os.path.join(resources, "test.txt") + with open(fname, "rb") as f: + fcontent = f.read() + with open(fname, "rb") as f: + fsize = os.path.getsize(fname) + response = wrappers.Response(wrap_file(env, f)) + env["HTTP_RANGE"] = f"bytes=0-{fsize - 1}" + response.make_conditional(env, accept_ranges=True, complete_length=fsize) + assert response.status_code == 206 + assert response.headers["Accept-Ranges"] == "bytes" + assert response.headers["Content-Range"] == f"bytes 0-{fsize - 1}/{fsize}" + assert response.headers["Content-Length"] == str(fsize) + assert response.data == fcontent + + +@pytest.mark.parametrize("value", [None, 0]) +def test_range_request_without_complete_length(value): + env = create_environ(headers={"Range": "bytes=0-10"}) + response = wrappers.Response("Hello World") + response.make_conditional(env, accept_ranges=True, complete_length=value) + assert response.status_code == 200 + assert response.data == b"Hello World" + + +def test_invalid_range_request(): + env = create_environ() + response = wrappers.Response("Hello World") + env["HTTP_RANGE"] = "bytes=-" + with pytest.raises(RequestedRangeNotSatisfiable): + response.make_conditional(env, accept_ranges=True, complete_length=11) + + +def test_etag_response_freezing(): + response = Response("Hello World") + response.freeze() + assert response.get_etag() == (str(generate_etag(b"Hello World")), False) + + +def test_authenticate(): + resp = wrappers.Response() + resp.www_authenticate.type = "basic" + resp.www_authenticate.realm = "Testing" + assert resp.headers["WWW-Authenticate"] == 'Basic realm="Testing"' + resp.www_authenticate.realm = None + resp.www_authenticate.type = None + assert "WWW-Authenticate" not in resp.headers + + +def test_authenticate_quoted_qop(): + # Example taken from https://github.com/pallets/werkzeug/issues/633 + resp = wrappers.Response() + resp.www_authenticate.set_digest("REALM", "NONCE", qop=("auth", "auth-int")) + + actual = set(f"{resp.headers['WWW-Authenticate']},".split()) + expected = set('Digest nonce="NONCE", realm="REALM", qop="auth, auth-int",'.split()) + assert actual == expected + + resp.www_authenticate.set_digest("REALM", "NONCE", qop=("auth",)) + + actual = set(f"{resp.headers['WWW-Authenticate']},".split()) + expected = set('Digest nonce="NONCE", realm="REALM", qop="auth",'.split()) + assert actual == expected + + +def test_response_stream(): + response = wrappers.Response() + response.stream.write("Hello ") + response.stream.write("World!") + assert response.response == ["Hello ", "World!"] + assert response.get_data() == b"Hello World!" + + +def test_common_response_descriptors(): + response = wrappers.Response() + response.mimetype = "text/html" + assert response.mimetype == "text/html" + assert response.content_type == "text/html; charset=utf-8" + assert response.mimetype_params == {"charset": "utf-8"} + response.mimetype_params["x-foo"] = "yep" + del response.mimetype_params["charset"] + assert response.content_type == "text/html; x-foo=yep" + + now = datetime.now(timezone.utc).replace(microsecond=0) + + assert response.content_length is None + response.content_length = "42" + assert response.content_length == 42 + + for attr in "date", "expires": + assert getattr(response, attr) is None + setattr(response, attr, now) + assert getattr(response, attr) == now + + assert response.age is None + age_td = timedelta(days=1, minutes=3, seconds=5) + response.age = age_td + assert response.age == age_td + response.age = 42 + assert response.age == timedelta(seconds=42) + + assert response.retry_after is None + response.retry_after = now + assert response.retry_after == now + + assert not response.vary + response.vary.add("Cookie") + response.vary.add("Content-Language") + assert "cookie" in response.vary + assert response.vary.to_header() == "Cookie, Content-Language" + response.headers["Vary"] = "Content-Encoding" + assert response.vary.as_set() == {"content-encoding"} + + response.allow.update(["GET", "POST"]) + assert response.headers["Allow"] == "GET, POST" + + response.content_language.add("en-US") + response.content_language.add("fr") + assert response.headers["Content-Language"] == "en-US, fr" + + +def test_common_request_descriptors(): + request = wrappers.Request.from_values( + content_type="text/html; charset=utf-8", + content_length="23", + headers={ + "Referer": "http://www.example.com/", + "Date": "Sat, 28 Feb 2009 19:04:35 GMT", + "Max-Forwards": "10", + "Pragma": "no-cache", + "Content-Encoding": "gzip", + "Content-MD5": "9a3bc6dbc47a70db25b84c6e5867a072", + }, + ) + + assert request.content_type == "text/html; charset=utf-8" + assert request.mimetype == "text/html" + assert request.mimetype_params == {"charset": "utf-8"} + assert request.content_length == 23 + assert request.referrer == "http://www.example.com/" + assert request.date == datetime(2009, 2, 28, 19, 4, 35, tzinfo=timezone.utc) + assert request.max_forwards == 10 + assert "no-cache" in request.pragma + assert request.content_encoding == "gzip" + assert request.content_md5 == "9a3bc6dbc47a70db25b84c6e5867a072" + + +def test_request_mimetype_always_lowercase(): + request = wrappers.Request.from_values(content_type="APPLICATION/JSON") + assert request.mimetype == "application/json" + + +def test_shallow_mode(): + request = wrappers.Request( + {"QUERY_STRING": "foo=bar", "SERVER_NAME": "eggs", "SERVER_PORT": "80"}, + shallow=True, + ) + assert request.args["foo"] == "bar" + pytest.raises(RuntimeError, lambda: request.stream) + pytest.raises(RuntimeError, lambda: request.data) + pytest.raises(RuntimeError, lambda: request.form) + + +def test_form_parsing_failed(): + data = b"--blah\r\n" + request = wrappers.Request.from_values( + input_stream=BytesIO(data), + content_length=len(data), + content_type="multipart/form-data; boundary=foo", + method="POST", + ) + assert not request.files + assert not request.form + + # Bad Content-Type + data = b"test" + request = wrappers.Request.from_values( + input_stream=BytesIO(data), + content_length=len(data), + content_type=", ", + method="POST", + ) + assert not request.form + + +def test_file_closing(): + data = ( + b"--foo\r\n" + b'Content-Disposition: form-data; name="foo"; filename="foo.txt"\r\n' + b"Content-Type: text/plain; charset=utf-8\r\n\r\n" + b"file contents, just the contents\r\n" + b"--foo--" + ) + req = wrappers.Request.from_values( + input_stream=BytesIO(data), + content_length=len(data), + content_type="multipart/form-data; boundary=foo", + method="POST", + ) + foo = req.files["foo"] + assert foo.mimetype == "text/plain" + assert foo.filename == "foo.txt" + + assert foo.closed is False + req.close() + assert foo.closed is True + + +def test_file_closing_with(): + data = ( + b"--foo\r\n" + b'Content-Disposition: form-data; name="foo"; filename="foo.txt"\r\n' + b"Content-Type: text/plain; charset=utf-8\r\n\r\n" + b"file contents, just the contents\r\n" + b"--foo--" + ) + req = wrappers.Request.from_values( + input_stream=BytesIO(data), + content_length=len(data), + content_type="multipart/form-data; boundary=foo", + method="POST", + ) + with req: + foo = req.files["foo"] + assert foo.mimetype == "text/plain" + assert foo.filename == "foo.txt" + + assert foo.closed is True + + +def test_url_charset_reflection(): + req = wrappers.Request.from_values() + req.charset = "utf-7" + assert req.url_charset == "utf-7" + + +def test_response_streamed(): + r = wrappers.Response() + assert not r.is_streamed + r = wrappers.Response("Hello World") + assert not r.is_streamed + r = wrappers.Response(["foo", "bar"]) + assert not r.is_streamed + + def gen(): + if 0: + yield None + + r = wrappers.Response(gen()) + assert r.is_streamed + + +def test_response_iter_wrapping(): + def uppercasing(iterator): + for item in iterator: + yield item.upper() + + def generator(): + yield "foo" + yield "bar" + + req = wrappers.Request.from_values() + resp = wrappers.Response(generator()) + del resp.headers["Content-Length"] + resp.response = uppercasing(resp.iter_encoded()) + actual_resp = wrappers.Response.from_app(resp, req.environ, buffered=True) + assert actual_resp.get_data() == b"FOOBAR" + + +def test_response_freeze(): + def generate(): + yield "foo" + yield "bar" + + resp = wrappers.Response(generate()) + resp.freeze() + assert resp.response == [b"foo", b"bar"] + assert resp.headers["content-length"] == "6" + + +def test_response_content_length_uses_encode(): + r = wrappers.Response("你好") + assert r.calculate_content_length() == 6 + + +def test_other_method_payload(): + data = b"Hello World" + req = wrappers.Request.from_values( + input_stream=BytesIO(data), + content_length=len(data), + content_type="text/plain", + method="WHAT_THE_FUCK", + ) + assert req.get_data() == data + assert isinstance(req.stream, LimitedStream) + + +def test_urlfication(): + resp = wrappers.Response() + resp.headers["Location"] = "http://üser:pässword@☃.net/påth" + resp.headers["Content-Location"] = "http://☃.net/" + headers = resp.get_wsgi_headers(create_environ()) + assert headers["location"] == "http://%C3%BCser:p%C3%A4ssword@xn--n3h.net/p%C3%A5th" + assert headers["content-location"] == "http://xn--n3h.net/" + + +def test_new_response_iterator_behavior(): + req = wrappers.Request.from_values() + resp = wrappers.Response("Hello Wörld!") + + def get_content_length(resp): + headers = resp.get_wsgi_headers(req.environ) + return headers.get("content-length", type=int) + + def generate_items(): + yield "Hello " + yield "Wörld!" + + # werkzeug encodes when set to `data` now, which happens + # if a string is passed to the response object. + assert resp.response == ["Hello Wörld!".encode()] + assert resp.get_data() == "Hello Wörld!".encode() + assert get_content_length(resp) == 13 + assert not resp.is_streamed + assert resp.is_sequence + + # try the same for manual assignment + resp.set_data("Wörd") + assert resp.response == ["Wörd".encode()] + assert resp.get_data() == "Wörd".encode() + assert get_content_length(resp) == 5 + assert not resp.is_streamed + assert resp.is_sequence + + # automatic generator sequence conversion + resp.response = generate_items() + assert resp.is_streamed + assert not resp.is_sequence + assert resp.get_data() == "Hello Wörld!".encode() + assert resp.response == [b"Hello ", "Wörld!".encode()] + assert not resp.is_streamed + assert resp.is_sequence + + # automatic generator sequence conversion + resp.response = generate_items() + resp.implicit_sequence_conversion = False + assert resp.is_streamed + assert not resp.is_sequence + pytest.raises(RuntimeError, lambda: resp.get_data()) + resp.make_sequence() + assert resp.get_data() == "Hello Wörld!".encode() + assert resp.response == [b"Hello ", "Wörld!".encode()] + assert not resp.is_streamed + assert resp.is_sequence + + # stream makes it a list no matter how the conversion is set + for val in True, False: + resp.implicit_sequence_conversion = val + resp.response = ("foo", "bar") + assert resp.is_sequence + resp.stream.write("baz") + assert resp.response == ["foo", "bar", "baz"] + + +def test_form_data_ordering(): + class MyRequest(wrappers.Request): + parameter_storage_class = ImmutableOrderedMultiDict + + req = MyRequest.from_values("/?foo=1&bar=0&foo=3") + assert list(req.args) == ["foo", "bar"] + assert list(req.args.items(multi=True)) == [ + ("foo", "1"), + ("bar", "0"), + ("foo", "3"), + ] + assert isinstance(req.args, ImmutableOrderedMultiDict) + assert isinstance(req.values, CombinedMultiDict) + assert req.values["foo"] == "1" + assert req.values.getlist("foo") == ["1", "3"] + + +def test_values(): + r = wrappers.Request.from_values( + method="POST", query_string={"a": "1"}, data={"a": "2", "b": "2"} + ) + assert r.values["a"] == "1" + assert r.values["b"] == "2" + + # form should not be combined for GET method + r = wrappers.Request.from_values( + method="GET", query_string={"a": "1"}, data={"a": "2", "b": "2"} + ) + assert r.values["a"] == "1" + assert "b" not in r.values + + +def test_storage_classes(): + class MyRequest(wrappers.Request): + dict_storage_class = dict + list_storage_class = list + parameter_storage_class = dict + + req = MyRequest.from_values("/?foo=baz", headers={"Cookie": "foo=bar"}) + assert type(req.cookies) is dict + assert req.cookies == {"foo": "bar"} + assert type(req.access_route) is list + + assert type(req.args) is dict + assert type(req.values) is CombinedMultiDict + assert req.values["foo"] == "baz" + + req = wrappers.Request.from_values(headers={"Cookie": "foo=bar;foo=baz"}) + assert type(req.cookies) is ImmutableMultiDict + assert req.cookies.to_dict() == {"foo": "bar"} + + # it is possible to have multiple cookies with the same name + assert req.cookies.getlist("foo") == ["bar", "baz"] + assert type(req.access_route) is ImmutableList + + MyRequest.list_storage_class = tuple + req = MyRequest.from_values() + assert type(req.access_route) is tuple + + +def test_response_headers_passthrough(): + headers = Headers() + resp = wrappers.Response(headers=headers) + assert resp.headers is headers + + +def test_response_304_no_content_length(): + resp = wrappers.Response("Test", status=304) + env = create_environ() + assert "content-length" not in resp.get_wsgi_headers(env) + + +def test_ranges(): + # basic range stuff + req = wrappers.Request.from_values() + assert req.range is None + req = wrappers.Request.from_values(headers={"Range": "bytes=0-499"}) + assert req.range.ranges == [(0, 500)] + + resp = wrappers.Response() + resp.content_range = req.range.make_content_range(1000) + assert resp.content_range.units == "bytes" + assert resp.content_range.start == 0 + assert resp.content_range.stop == 500 + assert resp.content_range.length == 1000 + assert resp.headers["Content-Range"] == "bytes 0-499/1000" + + resp.content_range.unset() + assert "Content-Range" not in resp.headers + + resp.headers["Content-Range"] = "bytes 0-499/1000" + assert resp.content_range.units == "bytes" + assert resp.content_range.start == 0 + assert resp.content_range.stop == 500 + assert resp.content_range.length == 1000 + + +def test_csp(): + resp = wrappers.Response() + resp.content_security_policy.default_src = "'self'" + assert resp.headers["Content-Security-Policy"] == "default-src 'self'" + resp.content_security_policy.script_src = "'self' palletsprojects.com" + assert ( + resp.headers["Content-Security-Policy"] + == "default-src 'self'; script-src 'self' palletsprojects.com" + ) + + resp.content_security_policy = None + assert "Content-Security-Policy" not in resp.headers + + +def test_auto_content_length(): + resp = wrappers.Response("Hello World!") + assert resp.content_length == 12 + + resp = wrappers.Response(["Hello World!"]) + assert resp.content_length is None + assert resp.get_wsgi_headers({})["Content-Length"] == "12" + + +def test_stream_content_length(): + resp = wrappers.Response() + resp.stream.writelines(["foo", "bar", "baz"]) + assert resp.get_wsgi_headers({})["Content-Length"] == "9" + + resp = wrappers.Response() + resp.make_conditional({"REQUEST_METHOD": "GET"}) + resp.stream.writelines(["foo", "bar", "baz"]) + assert resp.get_wsgi_headers({})["Content-Length"] == "9" + + resp = wrappers.Response("foo") + resp.stream.writelines(["bar", "baz"]) + assert resp.get_wsgi_headers({})["Content-Length"] == "9" + + +def test_disabled_auto_content_length(): + class MyResponse(wrappers.Response): + automatically_set_content_length = False + + resp = MyResponse("Hello World!") + assert resp.content_length is None + + resp = MyResponse(["Hello World!"]) + assert resp.content_length is None + assert "Content-Length" not in resp.get_wsgi_headers({}) + + resp = MyResponse() + resp.make_conditional({"REQUEST_METHOD": "GET"}) + assert resp.content_length is None + assert "Content-Length" not in resp.get_wsgi_headers({}) + + +@pytest.mark.parametrize( + ("auto", "location", "expect"), + ( + (False, "/test", "/test"), + (True, "/test", "http://localhost/test"), + (True, "test", "http://localhost/a/b/test"), + (True, "./test", "http://localhost/a/b/test"), + (True, "../test", "http://localhost/a/test"), + ), +) +def test_location_header_autocorrect(monkeypatch, auto, location, expect): + monkeypatch.setattr(wrappers.Response, "autocorrect_location_header", auto) + env = create_environ("/a/b/c") + resp = wrappers.Response("Hello World!") + resp.headers["Location"] = location + assert resp.get_wsgi_headers(env)["Location"] == expect + + +def test_204_and_1XX_response_has_no_content_length(): + response = wrappers.Response(status=204) + assert response.content_length is None + + headers = response.get_wsgi_headers(create_environ()) + assert "Content-Length" not in headers + + response = wrappers.Response(status=100) + assert response.content_length is None + + headers = response.get_wsgi_headers(create_environ()) + assert "Content-Length" not in headers + + +def test_malformed_204_response_has_no_content_length(): + # flask-restful can generate a malformed response when doing `return '', 204` + response = wrappers.Response(status=204) + response.set_data(b"test") + assert response.content_length == 4 + + env = create_environ() + app_iter, status, headers = response.get_wsgi_response(env) + assert status == "204 NO CONTENT" + assert "Content-Length" not in headers + assert b"".join(app_iter) == b"" # ensure data will not be sent + + +def test_modified_url_encoding(): + class ModifiedRequest(wrappers.Request): + url_charset = "euc-kr" + + req = ModifiedRequest.from_values(query_string={"foo": "정상처리"}, charset="euc-kr") + assert req.args["foo"] == "정상처리" + + +def test_request_method_case_sensitivity(): + req = wrappers.Request( + {"REQUEST_METHOD": "get", "SERVER_NAME": "eggs", "SERVER_PORT": "80"} + ) + assert req.method == "GET" + + +def test_write_length(): + response = wrappers.Response() + length = response.stream.write(b"bar") + assert length == 3 + + +def test_stream_zip(): + import zipfile + + response = wrappers.Response() + with contextlib.closing(zipfile.ZipFile(response.stream, mode="w")) as z: + z.writestr("foo", b"bar") + + buffer = BytesIO(response.get_data()) + with contextlib.closing(zipfile.ZipFile(buffer, mode="r")) as z: + assert z.namelist() == ["foo"] + assert z.read("foo") == b"bar" + + +class TestSetCookie: + def test_secure(self): + response = wrappers.Response() + response.set_cookie( + "foo", + value="bar", + max_age=60, + expires=0, + path="/blub", + domain="example.org", + secure=True, + samesite=None, + ) + assert response.headers.to_wsgi_list() == [ + ("Content-Type", "text/plain; charset=utf-8"), + ( + "Set-Cookie", + "foo=bar; Domain=example.org;" + " Expires=Thu, 01 Jan 1970 00:00:00 GMT; Max-Age=60;" + " Secure; Path=/blub", + ), + ] + + def test_httponly(self): + response = wrappers.Response() + response.set_cookie( + "foo", + value="bar", + max_age=60, + expires=0, + path="/blub", + domain="example.org", + secure=False, + httponly=True, + samesite=None, + ) + assert response.headers.to_wsgi_list() == [ + ("Content-Type", "text/plain; charset=utf-8"), + ( + "Set-Cookie", + "foo=bar; Domain=example.org;" + " Expires=Thu, 01 Jan 1970 00:00:00 GMT; Max-Age=60;" + " HttpOnly; Path=/blub", + ), + ] + + def test_secure_and_httponly(self): + response = wrappers.Response() + response.set_cookie( + "foo", + value="bar", + max_age=60, + expires=0, + path="/blub", + domain="example.org", + secure=True, + httponly=True, + samesite=None, + ) + assert response.headers.to_wsgi_list() == [ + ("Content-Type", "text/plain; charset=utf-8"), + ( + "Set-Cookie", + "foo=bar; Domain=example.org;" + " Expires=Thu, 01 Jan 1970 00:00:00 GMT; Max-Age=60;" + " Secure; HttpOnly; Path=/blub", + ), + ] + + def test_samesite(self): + response = wrappers.Response() + response.set_cookie( + "foo", + value="bar", + max_age=60, + expires=0, + path="/blub", + domain="example.org", + secure=False, + samesite="strict", + ) + assert response.headers.to_wsgi_list() == [ + ("Content-Type", "text/plain; charset=utf-8"), + ( + "Set-Cookie", + "foo=bar; Domain=example.org;" + " Expires=Thu, 01 Jan 1970 00:00:00 GMT; Max-Age=60;" + " Path=/blub; SameSite=Strict", + ), + ] + + +class TestJSON: + def test_request(self): + value = {"ä": "b"} + request = wrappers.Request.from_values(json=value) + assert request.json == value + assert request.get_data() + + def test_response(self): + value = {"ä": "b"} + response = wrappers.Response( + response=json.dumps(value), content_type="application/json" + ) + assert response.json == value + + def test_bad_content_type(self): + value = [1, 2, 3] + request = wrappers.Request.from_values(json=value, content_type="text/plain") + + with pytest.raises(BadRequest): + request.get_json() + + assert request.get_json(silent=True) is None + assert request.get_json(force=True) == value + + def test_bad_data(self): + request = wrappers.Request.from_values( + data=b'{"a":}', content_type="application/json" + ) + assert request.get_json(silent=True) is None + + with pytest.raises(BadRequest): + request.get_json() + + def test_cache_disabled(self): + value = [1, 2, 3] + request = wrappers.Request.from_values(json=value) + assert request.get_json(cache=False) == [1, 2, 3] + assert not request.get_data() + + with pytest.raises(BadRequest): + request.get_json() + + +def test_response_coop(): + response = wrappers.Response("Hello World") + assert response.cross_origin_opener_policy is COOP.UNSAFE_NONE + response.cross_origin_opener_policy = COOP.SAME_ORIGIN + assert response.headers["Cross-Origin-Opener-Policy"] == "same-origin" + + +def test_response_coep(): + response = wrappers.Response("Hello World") + assert response.cross_origin_embedder_policy is COEP.UNSAFE_NONE + response.cross_origin_embedder_policy = COEP.REQUIRE_CORP + assert response.headers["Cross-Origin-Embedder-Policy"] == "require-corp" diff --git a/tests/test_wsgi.py b/tests/test_wsgi.py new file mode 100644 index 0000000..b0f71bc --- /dev/null +++ b/tests/test_wsgi.py @@ -0,0 +1,419 @@ +import io +import json +import os + +import pytest + +from werkzeug import wsgi +from werkzeug.exceptions import BadRequest +from werkzeug.exceptions import ClientDisconnected +from werkzeug.test import Client +from werkzeug.test import create_environ +from werkzeug.test import run_wsgi_app +from werkzeug.wrappers import Response +from werkzeug.wsgi import _RangeWrapper +from werkzeug.wsgi import ClosingIterator +from werkzeug.wsgi import wrap_file + + +@pytest.mark.parametrize( + ("environ", "expect"), + ( + pytest.param({"HTTP_HOST": "spam"}, "spam", id="host"), + pytest.param({"HTTP_HOST": "spam:80"}, "spam", id="host, strip http port"), + pytest.param( + {"wsgi.url_scheme": "https", "HTTP_HOST": "spam:443"}, + "spam", + id="host, strip https port", + ), + pytest.param({"HTTP_HOST": "spam:8080"}, "spam:8080", id="host, custom port"), + pytest.param( + {"HTTP_HOST": "spam", "SERVER_NAME": "eggs", "SERVER_PORT": "80"}, + "spam", + id="prefer host", + ), + pytest.param( + {"SERVER_NAME": "eggs", "SERVER_PORT": "80"}, + "eggs", + id="name, ignore http port", + ), + pytest.param( + {"wsgi.url_scheme": "https", "SERVER_NAME": "eggs", "SERVER_PORT": "443"}, + "eggs", + id="name, ignore https port", + ), + pytest.param( + {"SERVER_NAME": "eggs", "SERVER_PORT": "8080"}, + "eggs:8080", + id="name, custom port", + ), + pytest.param( + {"HTTP_HOST": "ham", "HTTP_X_FORWARDED_HOST": "eggs"}, + "ham", + id="ignore x-forwarded-host", + ), + ), +) +def test_get_host(environ, expect): + environ.setdefault("wsgi.url_scheme", "http") + assert wsgi.get_host(environ) == expect + + +def test_get_host_validate_trusted_hosts(): + env = {"SERVER_NAME": "example.org", "SERVER_PORT": "80", "wsgi.url_scheme": "http"} + assert wsgi.get_host(env, trusted_hosts=[".example.org"]) == "example.org" + pytest.raises(BadRequest, wsgi.get_host, env, trusted_hosts=["example.com"]) + env["SERVER_PORT"] = "8080" + assert wsgi.get_host(env, trusted_hosts=[".example.org:8080"]) == "example.org:8080" + pytest.raises(BadRequest, wsgi.get_host, env, trusted_hosts=[".example.com"]) + env = {"HTTP_HOST": "example.org", "wsgi.url_scheme": "http"} + assert wsgi.get_host(env, trusted_hosts=[".example.org"]) == "example.org" + pytest.raises(BadRequest, wsgi.get_host, env, trusted_hosts=["example.com"]) + + +def test_responder(): + def foo(environ, start_response): + return Response(b"Test") + + client = Client(wsgi.responder(foo)) + response = client.get("/") + assert response.status_code == 200 + assert response.data == b"Test" + + +def test_path_info_and_script_name_fetching(): + env = create_environ("/\N{SNOWMAN}", "http://example.com/\N{COMET}/") + assert wsgi.get_path_info(env) == "/\N{SNOWMAN}" + assert wsgi.get_path_info(env, charset=None) == "/\N{SNOWMAN}".encode() + + +def test_limited_stream(): + class RaisingLimitedStream(wsgi.LimitedStream): + def on_exhausted(self): + raise BadRequest("input stream exhausted") + + io_ = io.BytesIO(b"123456") + stream = RaisingLimitedStream(io_, 3) + assert stream.read() == b"123" + pytest.raises(BadRequest, stream.read) + + io_ = io.BytesIO(b"123456") + stream = RaisingLimitedStream(io_, 3) + assert stream.tell() == 0 + assert stream.read(1) == b"1" + assert stream.tell() == 1 + assert stream.read(1) == b"2" + assert stream.tell() == 2 + assert stream.read(1) == b"3" + assert stream.tell() == 3 + pytest.raises(BadRequest, stream.read) + + io_ = io.BytesIO(b"123456\nabcdefg") + stream = wsgi.LimitedStream(io_, 9) + assert stream.readline() == b"123456\n" + assert stream.readline() == b"ab" + + io_ = io.BytesIO(b"123456\nabcdefg") + stream = wsgi.LimitedStream(io_, 9) + assert stream.readlines() == [b"123456\n", b"ab"] + + io_ = io.BytesIO(b"123456\nabcdefg") + stream = wsgi.LimitedStream(io_, 9) + assert stream.readlines(2) == [b"12"] + assert stream.readlines(2) == [b"34"] + assert stream.readlines() == [b"56\n", b"ab"] + + io_ = io.BytesIO(b"123456\nabcdefg") + stream = wsgi.LimitedStream(io_, 9) + assert stream.readline(100) == b"123456\n" + + io_ = io.BytesIO(b"123456\nabcdefg") + stream = wsgi.LimitedStream(io_, 9) + assert stream.readlines(100) == [b"123456\n", b"ab"] + + io_ = io.BytesIO(b"123456") + stream = wsgi.LimitedStream(io_, 3) + assert stream.read(1) == b"1" + assert stream.read(1) == b"2" + assert stream.read() == b"3" + assert stream.read() == b"" + + io_ = io.BytesIO(b"123456") + stream = wsgi.LimitedStream(io_, 3) + assert stream.read(-1) == b"123" + + io_ = io.BytesIO(b"123456") + stream = wsgi.LimitedStream(io_, 0) + assert stream.read(-1) == b"" + + io_ = io.StringIO("123456") + stream = wsgi.LimitedStream(io_, 0) + assert stream.read(-1) == "" + + io_ = io.StringIO("123\n456\n") + stream = wsgi.LimitedStream(io_, 8) + assert list(stream) == ["123\n", "456\n"] + + +def test_limited_stream_json_load(): + stream = wsgi.LimitedStream(io.BytesIO(b'{"hello": "test"}'), 17) + # flask.json adapts bytes to text with TextIOWrapper + # this expects stream.readable() to exist and return true + stream = io.TextIOWrapper(io.BufferedReader(stream), "UTF-8") + data = json.load(stream) + assert data == {"hello": "test"} + + +def test_limited_stream_disconnection(): + io_ = io.BytesIO(b"A bit of content") + + # disconnect detection on out of bytes + stream = wsgi.LimitedStream(io_, 255) + with pytest.raises(ClientDisconnected): + stream.read() + + # disconnect detection because file close + io_ = io.BytesIO(b"x" * 255) + io_.close() + stream = wsgi.LimitedStream(io_, 255) + with pytest.raises(ClientDisconnected): + stream.read() + + +def test_get_host_fallback(): + assert ( + wsgi.get_host( + { + "SERVER_NAME": "foobar.example.com", + "wsgi.url_scheme": "http", + "SERVER_PORT": "80", + } + ) + == "foobar.example.com" + ) + assert ( + wsgi.get_host( + { + "SERVER_NAME": "foobar.example.com", + "wsgi.url_scheme": "http", + "SERVER_PORT": "81", + } + ) + == "foobar.example.com:81" + ) + + +def test_get_current_url_unicode(): + env = create_environ(query_string="foo=bar&baz=blah&meh=\xcf") + rv = wsgi.get_current_url(env) + assert rv == "http://localhost/?foo=bar&baz=blah&meh=\xcf" + + +def test_get_current_url_invalid_utf8(): + env = create_environ() + # set the query string *after* wsgi dance, so \xcf is invalid + env["QUERY_STRING"] = "foo=bar&baz=blah&meh=\xcf" + rv = wsgi.get_current_url(env) + # it remains percent-encoded + assert rv == "http://localhost/?foo=bar&baz=blah&meh=%CF" + + +def test_multi_part_line_breaks(): + data = "abcdef\r\nghijkl\r\nmnopqrstuvwxyz\r\nABCDEFGHIJK" + test_stream = io.StringIO(data) + lines = list(wsgi.make_line_iter(test_stream, limit=len(data), buffer_size=16)) + assert lines == ["abcdef\r\n", "ghijkl\r\n", "mnopqrstuvwxyz\r\n", "ABCDEFGHIJK"] + + data = "abc\r\nThis line is broken by the buffer length.\r\nFoo bar baz" + test_stream = io.StringIO(data) + lines = list(wsgi.make_line_iter(test_stream, limit=len(data), buffer_size=24)) + assert lines == [ + "abc\r\n", + "This line is broken by the buffer length.\r\n", + "Foo bar baz", + ] + + +def test_multi_part_line_breaks_bytes(): + data = b"abcdef\r\nghijkl\r\nmnopqrstuvwxyz\r\nABCDEFGHIJK" + test_stream = io.BytesIO(data) + lines = list(wsgi.make_line_iter(test_stream, limit=len(data), buffer_size=16)) + assert lines == [ + b"abcdef\r\n", + b"ghijkl\r\n", + b"mnopqrstuvwxyz\r\n", + b"ABCDEFGHIJK", + ] + + data = b"abc\r\nThis line is broken by the buffer length.\r\nFoo bar baz" + test_stream = io.BytesIO(data) + lines = list(wsgi.make_line_iter(test_stream, limit=len(data), buffer_size=24)) + assert lines == [ + b"abc\r\n", + b"This line is broken by the buffer length.\r\n", + b"Foo bar baz", + ] + + +def test_multi_part_line_breaks_problematic(): + data = "abc\rdef\r\nghi" + for _ in range(1, 10): + test_stream = io.StringIO(data) + lines = list(wsgi.make_line_iter(test_stream, limit=len(data), buffer_size=4)) + assert lines == ["abc\r", "def\r\n", "ghi"] + + +def test_iter_functions_support_iterators(): + data = ["abcdef\r\nghi", "jkl\r\nmnopqrstuvwxyz\r", "\nABCDEFGHIJK"] + lines = list(wsgi.make_line_iter(data)) + assert lines == ["abcdef\r\n", "ghijkl\r\n", "mnopqrstuvwxyz\r\n", "ABCDEFGHIJK"] + + +def test_make_chunk_iter(): + data = ["abcdefXghi", "jklXmnopqrstuvwxyzX", "ABCDEFGHIJK"] + rv = list(wsgi.make_chunk_iter(data, "X")) + assert rv == ["abcdef", "ghijkl", "mnopqrstuvwxyz", "ABCDEFGHIJK"] + + data = "abcdefXghijklXmnopqrstuvwxyzXABCDEFGHIJK" + test_stream = io.StringIO(data) + rv = list(wsgi.make_chunk_iter(test_stream, "X", limit=len(data), buffer_size=4)) + assert rv == ["abcdef", "ghijkl", "mnopqrstuvwxyz", "ABCDEFGHIJK"] + + +def test_make_chunk_iter_bytes(): + data = [b"abcdefXghi", b"jklXmnopqrstuvwxyzX", b"ABCDEFGHIJK"] + rv = list(wsgi.make_chunk_iter(data, "X")) + assert rv == [b"abcdef", b"ghijkl", b"mnopqrstuvwxyz", b"ABCDEFGHIJK"] + + data = b"abcdefXghijklXmnopqrstuvwxyzXABCDEFGHIJK" + test_stream = io.BytesIO(data) + rv = list(wsgi.make_chunk_iter(test_stream, "X", limit=len(data), buffer_size=4)) + assert rv == [b"abcdef", b"ghijkl", b"mnopqrstuvwxyz", b"ABCDEFGHIJK"] + + data = b"abcdefXghijklXmnopqrstuvwxyzXABCDEFGHIJK" + test_stream = io.BytesIO(data) + rv = list( + wsgi.make_chunk_iter( + test_stream, "X", limit=len(data), buffer_size=4, cap_at_buffer=True + ) + ) + assert rv == [ + b"abcd", + b"ef", + b"ghij", + b"kl", + b"mnop", + b"qrst", + b"uvwx", + b"yz", + b"ABCD", + b"EFGH", + b"IJK", + ] + + +def test_lines_longer_buffer_size(): + data = "1234567890\n1234567890\n" + for bufsize in range(1, 15): + lines = list( + wsgi.make_line_iter(io.StringIO(data), limit=len(data), buffer_size=bufsize) + ) + assert lines == ["1234567890\n", "1234567890\n"] + + +def test_lines_longer_buffer_size_cap(): + data = "1234567890\n1234567890\n" + for bufsize in range(1, 15): + lines = list( + wsgi.make_line_iter( + io.StringIO(data), + limit=len(data), + buffer_size=bufsize, + cap_at_buffer=True, + ) + ) + assert len(lines[0]) == bufsize or lines[0].endswith("\n") + + +def test_range_wrapper(): + response = Response(b"Hello World") + range_wrapper = _RangeWrapper(response.response, 6, 4) + assert next(range_wrapper) == b"Worl" + + response = Response(b"Hello World") + range_wrapper = _RangeWrapper(response.response, 1, 0) + with pytest.raises(StopIteration): + next(range_wrapper) + + response = Response(b"Hello World") + range_wrapper = _RangeWrapper(response.response, 6, 100) + assert next(range_wrapper) == b"World" + + response = Response(x for x in (b"He", b"ll", b"o ", b"Wo", b"rl", b"d")) + range_wrapper = _RangeWrapper(response.response, 6, 4) + assert not range_wrapper.seekable + assert next(range_wrapper) == b"Wo" + assert next(range_wrapper) == b"rl" + + response = Response(x for x in (b"He", b"ll", b"o W", b"o", b"rld")) + range_wrapper = _RangeWrapper(response.response, 6, 4) + assert next(range_wrapper) == b"W" + assert next(range_wrapper) == b"o" + assert next(range_wrapper) == b"rl" + with pytest.raises(StopIteration): + next(range_wrapper) + + response = Response(x for x in (b"Hello", b" World")) + range_wrapper = _RangeWrapper(response.response, 1, 1) + assert next(range_wrapper) == b"e" + with pytest.raises(StopIteration): + next(range_wrapper) + + resources = os.path.join(os.path.dirname(__file__), "res") + env = create_environ() + with open(os.path.join(resources, "test.txt"), "rb") as f: + response = Response(wrap_file(env, f)) + range_wrapper = _RangeWrapper(response.response, 1, 2) + assert range_wrapper.seekable + assert next(range_wrapper) == b"OU" + with pytest.raises(StopIteration): + next(range_wrapper) + + with open(os.path.join(resources, "test.txt"), "rb") as f: + response = Response(wrap_file(env, f)) + range_wrapper = _RangeWrapper(response.response, 2) + assert next(range_wrapper) == b"UND\n" + with pytest.raises(StopIteration): + next(range_wrapper) + + +def test_closing_iterator(): + class Namespace: + got_close = False + got_additional = False + + class Response: + def __init__(self, environ, start_response): + self.start = start_response + + # Return a generator instead of making the object its own + # iterator. This ensures that ClosingIterator calls close on + # the iterable (the object), not the iterator. + def __iter__(self): + self.start("200 OK", [("Content-Type", "text/plain")]) + yield "some content" + + def close(self): + Namespace.got_close = True + + def additional(): + Namespace.got_additional = True + + def app(environ, start_response): + return ClosingIterator(Response(environ, start_response), additional) + + app_iter, status, headers = run_wsgi_app(app, create_environ(), buffered=True) + + assert "".join(app_iter) == "some content" + assert Namespace.got_close + assert Namespace.got_additional diff --git a/tox.ini b/tox.ini new file mode 100644 index 0000000..056ca0d --- /dev/null +++ b/tox.ini @@ -0,0 +1,24 @@ +[tox] +envlist = + py3{11,10,9,8,7},pypy3{8,7} + style + typing + docs +skip_missing_interpreters = true + +[testenv] +deps = -r requirements/tests.txt +commands = pytest -v --tb=short --basetemp={envtmpdir} {posargs} + +[testenv:style] +deps = pre-commit +skip_install = true +commands = pre-commit run --all-files --show-diff-on-failure + +[testenv:typing] +deps = -r requirements/typing.txt +commands = mypy + +[testenv:docs] +deps = -r requirements/docs.txt +commands = sphinx-build -W -b html -d {envtmpdir}/doctrees docs {envtmpdir}/html

Hello {escape(request.form['name'])}!

Hello {escape(form['name'])}!

Submit URL

Cool Magic

{{ page_title }}

Shortened URL

List of URLs

Create a Shorty-URL!

Page Not Found

Teeworlds Server Browser

Page Not Found

Nick Search

{{ server.name }}

Players

Server List

Players online

Find User

Example Application

Page Not Found

About Plnt

{{ day.date.strftime('%d %B %Y') }}

Plnt Planet

Page Not Found

Submit URL

Shortened URL

List of URLs

Create a Shorty-URL!

Page Not Found

Diff for “${page.title}”

Cannot Display Diff

${'Create' if new else 'Edit'} “${page.title or page_name}”

Revisions for “${page.title}”

Revert Old Revision of “${page.title}”

Cannot Revert

Action “${action}” Not Found

Index

Page Not Found

Recent Changes

Upload File

%(title)s

%(title)s

Console Locked

%(exception_type)s

Traceback (most recent call last)

Interactive Console

File "%(filename)s", + line %(lineno)s, + in %(function_name)s

{title}

{escape(self.name)}

WSGI Information

Python Interpreter

WSGI Environment

Installed Eggs

System Path

Redirecting...

Redirecting...

Redirecting...

Redirecting...

File "%(filename)s", + line %(lineno)s, + in `%(function_name)s`