Blame - Lib/http/server.py - platform/external/python/cpython3

2008-05-26 16:32:26 +0000

[diff] [blame]

1

"""HTTP server classes.

2

3

Note: BaseHTTPRequestHandler doesn't implement any HTTP request; see

4

SimpleHTTPRequestHandler for simple implementations of GET, HEAD and POST,

5

and CGIHTTPRequestHandler for CGI scripts.

6

7

It does, however, optionally implement HTTP/1.1 persistent connections,

8

as of version 0.3.

9

10

Notes on CGIHTTPRequestHandler

11

------------------------------

12

13

This class implements GET and POST requests to cgi-bin scripts.

14

15

If the os.fork() function is not present (e.g. on Windows),

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

16

subprocess.Popen() is used as a fallback, with slightly altered semantics.

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

17

18

In all cases, the implementation is intentionally naive -- all

19

requests are executed synchronously.

20

21

SECURITY WARNING: DON'T USE THIS CODE UNLESS YOU ARE INSIDE A FIREWALL

22

-- it may execute arbitrary Python code or external programs.

23

24

Note that status code 200 is sent prior to execution of a CGI script, so

25

scripts cannot send other status codes such as 302 (redirect).

XXX To do:

- log requests even later (to capture byte count)

30

- log user-agent header and other interesting goodies

31

- send error log to separate file

"""

# See also:

#

# HTTP Working Group T. Berners-Lee

38

# INTERNET-DRAFT R. T. Fielding

39

# <draft-ietf-http-v10-spec-00.txt> H. Frystyk Nielsen

40

# Expires September 8, 1995 March 8, 1995

41

#

42

# URL: http://www.ics.uci.edu/pub/ietf/http/draft-ietf-http-v10-spec-00.txt

#

# and

#

# Network Working Group R. Fielding

47

# Request for Comments: 2616 et al

48

# Obsoletes: 2068 June 1999

49

# Category: Standards Track

50

#

51

# URL: http://www.faqs.org/rfcs/rfc2616.html

# Log files

# ---------

#

# Here's a quote from the NCSA httpd docs about log file format.

57

#

58

# | The logfile format is as follows. Each line consists of:

59

# |

60

# | host rfc931 authuser [DD/Mon/YYYY:hh:mm:ss] "request" ddd bbbb

61

# |

62

# | host: Either the DNS name or the IP number of the remote client

63

# | rfc931: Any information returned by identd for this person,

64

# | - otherwise.

65

# | authuser: If user sent a userid for authentication, the user name,

66

# | - otherwise.

67

# | DD: Day

68

# | Mon: Month (calendar name)

69

# | YYYY: Year

70

# | hh: hour (24-hour format, the machine's timezone)

71

# | mm: minutes

72

# | ss: seconds

73

# | request: The first line of the HTTP request as sent by the client.

74

# | ddd: the status code returned by the server, - if not available.

75

# | bbbb: the total number of bytes sent,

76

# | *not including the HTTP/1.0 header*, - if not available

77

# |

78

# | You can determine the name of the file accessed through request.

79

#

80

# (Actually, the latter is only true if you know the server configuration

81

# at the time the request was made!)

__version__ = "0.6"

Berker Peksag

2015-02-13 20:48:15 +0200

[diff] [blame]

85

__all__ = [

Géry Ogam

1cee216

2018-05-29 22:10:30 +0200

[diff] [blame]

86

"HTTPServer", "ThreadingHTTPServer", "BaseHTTPRequestHandler",

Berker Peksag

366c570

2015-02-13 20:48:15 +0200

[diff] [blame]

87

"SimpleHTTPRequestHandler", "CGIHTTPRequestHandler",

88

]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

89

Pierre Quentel

2017-04-02 12:26:12 +0200

[diff] [blame]

90

import copy

91

import datetime

Berker Peksag

04bc5b9

2016-03-14 06:06:03 +0200

[diff] [blame]

92

import email.utils

Georg Brandl

1f7fffb

2010-10-15 15:57:45 +0000

[diff] [blame]

93

import html

Jeremy Hylton

914ab45

2009-03-27 17:16:06 +0000

[diff] [blame]

import http.client

import io

import mimetypes

import os

import posixpath

import select

import shutil

import socket # For gethostbyaddr()

import socketserver

import sys

import time

import urllib.parse

Jason R. Coombs

7cdc31a

2020-01-06 07:59:36 -0500

[diff] [blame]

106

import contextlib

Stéphane Wirtel

2017-05-24 09:29:06 +0200

[diff] [blame]

107

from functools import partial

Senthil Kumaran

2012-06-03 16:15:54 +0800

[diff] [blame]

108

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

109

from http import HTTPStatus

110

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

111

112

# Default error message template

113

DEFAULT_ERROR_MESSAGE = """\

Senthil Kumaran

1b407fe

2011-03-20 10:44:30 +0800

[diff] [blame]

114

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"

115

"http://www.w3.org/TR/html4/strict.dtd">

Ezio Melotti

2011-11-02 19:33:29 +0200

[diff] [blame]

116

<html>

Senthil Kumaran

b253c9f

2011-03-17 16:43:22 +0800

[diff] [blame]

117

<head>

Senthil Kumaran

1b407fe

2011-03-20 10:44:30 +0800

[diff] [blame]

118

Senthil Kumaran

b253c9f

2011-03-17 16:43:22 +0800

[diff] [blame]

119

<title>Error response</title>

120

</head>

121

<body>

122

<h1>Error response</h1>

123

<p>Error code: %(code)d</p>

124

<p>Message: %(message)s.</p>

125

<p>Error code explanation: %(code)s - %(explain)s.</p>

126

</body>

127

</html>

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

128

"""

129

130

DEFAULT_ERROR_CONTENT_TYPE = "text/html;charset=utf-8"

131

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

132

class HTTPServer(socketserver.TCPServer):

133

134

allow_reuse_address = 1 # Seems to make sense in testing environment

135

136

def server_bind(self):

137

"""Override server_bind to store the server name."""

138

socketserver.TCPServer.server_bind(self)

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

139

host, port = self.server_address[:2]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

140

self.server_name = socket.getfqdn(host)

141

self.server_port = port

142

143

Géry Ogam

1cee216

2018-05-29 22:10:30 +0200

[diff] [blame]

144

class ThreadingHTTPServer(socketserver.ThreadingMixIn, HTTPServer):

Julien Palard

8bcfa02

2018-03-23 17:40:33 +0100

[diff] [blame]

145

daemon_threads = True

146

147

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

148

class BaseHTTPRequestHandler(socketserver.StreamRequestHandler):

149

150

"""HTTP request handler base class.

151

152

The following explanation of HTTP serves to guide you through the

153

code as well as to expose any misunderstandings I may have about

154

HTTP (so you don't need to read the code to figure out I'm wrong

155

:-).

156

157

HTTP (HyperText Transfer Protocol) is an extensible protocol on

158

top of a reliable stream transport (e.g. TCP/IP). The protocol

159

recognizes three parts to a request:

160

161

1. One line identifying the request type and path

162

2. An optional set of RFC-822-style headers

163

3. An optional data part

164

165

The headers and data are separated by a blank line.

166

167

The first line of the request has the form

where <command> is a (case-sensitive) keyword such as GET or POST,

172

<path> is a string containing path information for the request,

173

and <version> should be the string "HTTP/1.0" or "HTTP/1.1".

174

<path> is encoded using the URL encoding scheme (using %xx to signify

175

the ASCII character with hex code xx).

176

177

The specification specifies that lines are separated by CRLF but

178

for compatibility with the widest range of clients recommends

179

servers also handle LF. Similarly, whitespace in the request line

180

is treated sensibly (allowing multiple spaces between components

181

and allowing trailing whitespace).

182

183

Similarly, for output, lines ought to be separated by CRLF pairs

184

but most clients grok LF characters just fine.

185

186

If the first line of the request has the form

(i.e. <version> is left out) then this is assumed to be an HTTP

191

0.9 request; this form has no optional headers and data part and

192

the reply consists of just the data.

193

194

The reply form of the HTTP 1.x protocol again has three parts:

195

196

1. One line giving the response code

197

2. An optional set of RFC-822-style headers

198

3. The data

199

200

Again, the headers and data are separated by a blank line.

201

202

The response code line has the form

where <version> is the protocol version ("HTTP/1.0" or "HTTP/1.1"),

207

<responsecode> is a 3-digit response code indicating success or

208

failure of the request, and <responsestring> is an optional

209

human-readable string explaining what the response code means.

210

211

This server parses the request and the headers, and then calls a

212

function specific to the request type (<command>). Specifically,

213

a request SPAM will be handled by a method do_SPAM(). If no

214

such method exists the server sends an error response to the

215

client. If it exists, it is called with no arguments:

do_SPAM()

Note that the request name is case sensitive (i.e. SPAM and spam

220

are different requests).

221

222

The various request details are stored in instance variables:

223

224

- client_address is the client IP address in the form (host,

225

port);

226

227

- command, path and version are the broken-down request line;

228

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

229

- headers is an instance of email.message.Message (or a derived

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

230

class) containing the header information;

231

232

- rfile is a file object open for reading positioned at the

233

start of the optional input data part;

234

235

- wfile is a file object open for writing.

236

237

IT IS IMPORTANT TO ADHERE TO THE PROTOCOL FOR WRITING!

238

239

The first thing to be written must be the response line. Then

240

follow 0 or more header lines, then a blank line, and then the

241

actual data (if any). The meaning of the header lines depends on

242

the command executed by the server; in most cases, when data is

243

returned, there should be at least one header line of the form

244

245

Content-type: <type>/<subtype>

246

247

where <type> and <subtype> should be registered MIME types,

248

e.g. "text/html" or "text/plain".

"""

# The Python system version, truncated to its first component.

253

sys_version = "Python/" + sys.version.split()[0]

254

255

# The server software version. You may want to override this.

256

# The format is multiple whitespace-separated strings,

257

# where each string is of the form name[/version].

258

server_version = "BaseHTTP/" + __version__

259

260

error_message_format = DEFAULT_ERROR_MESSAGE

261

error_content_type = DEFAULT_ERROR_CONTENT_TYPE

262

263

# The default request version. This only affects responses up until

264

# the point where the request line is parsed, so it mainly decides what

265

# the client gets back when sending a malformed request line.

266

# Most web servers default to HTTP 0.9, i.e. don't send a status line.

267

default_request_version = "HTTP/0.9"

268

269

def parse_request(self):

270

"""Parse a request (internal).

271

272

The request should be stored in self.raw_requestline; the results

273

are in self.command, self.path, self.request_version and

274

self.headers.

275

Martin Panter

2016-11-19 01:06:37 +0000

[diff] [blame]

276

Return True for success, False for failure; on failure, any relevant

277

error response has already been sent back.

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

278

279

"""

280

self.command = None # set in case of error on the first line

281

self.request_version = version = self.default_request_version

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

282

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

283

requestline = str(self.raw_requestline, 'iso-8859-1')

Senthil Kumaran

3075549

2011-12-23 17:03:41 +0800

[diff] [blame]

284

requestline = requestline.rstrip('\r\n')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

285

self.requestline = requestline

286

words = requestline.split()

Martin Panter

2016-11-19 01:06:37 +0000

[diff] [blame]

if len(words) == 0:

return False

if len(words) >= 3: # Enough to determine protocol version

291

version = words[-1]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

292

try:

Martin Panter

2016-11-19 01:06:37 +0000

[diff] [blame]

293

if not version.startswith('HTTP/'):

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

294

raise ValueError

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

295

base_version_number = version.split('/', 1)[1]

296

version_number = base_version_number.split(".")

297

# RFC 2145 section 3.1 says there can be only one "." and

298

# - major and minor numbers MUST be treated as

299

# separate integers;

300

# - HTTP/2.4 is a lower version than HTTP/2.13, which in

301

# turn is lower than HTTP/12.3;

302

# - Leading zeros MUST be ignored by recipients.

303

if len(version_number) != 2:

304

raise ValueError

305

version_number = int(version_number[0]), int(version_number[1])

306

except (ValueError, IndexError):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

307

self.send_error(

308

HTTPStatus.BAD_REQUEST,

309

"Bad request version (%r)" % version)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

310

return False

311

if version_number >= (1, 1) and self.protocol_version >= "HTTP/1.1":

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

312

self.close_connection = False

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

313

if version_number >= (2, 0):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

314

self.send_error(

315

HTTPStatus.HTTP_VERSION_NOT_SUPPORTED,

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

316

"Invalid HTTP version (%s)" % base_version_number)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

317

return False

Martin Panter

2016-11-19 01:06:37 +0000

[diff] [blame]

318

self.request_version = version

319

320

if not 2 <= len(words) <= 3:

321

self.send_error(

322

HTTPStatus.BAD_REQUEST,

323

"Bad request syntax (%r)" % requestline)

324

return False

325

command, path = words[:2]

326

if len(words) == 2:

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

327

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

328

if command != 'GET':

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

329

self.send_error(

330

HTTPStatus.BAD_REQUEST,

331

"Bad HTTP/0.9 request type (%r)" % command)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

332

return False

Martin Panter

2016-11-19 01:06:37 +0000

[diff] [blame]

333

self.command, self.path = command, path

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

334

335

# Examine the headers and look for a Connection directive.

Senthil Kumaran

5466bf1

2010-12-18 16:55:23 +0000

[diff] [blame]

336

try:

337

self.headers = http.client.parse_headers(self.rfile,

338

_class=self.MessageClass)

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

339

except http.client.LineTooLong as err:

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

340

self.send_error(

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

341

HTTPStatus.REQUEST_HEADER_FIELDS_TOO_LARGE,

342

"Line too long",

343

str(err))

Senthil Kumaran

5466bf1

2010-12-18 16:55:23 +0000

[diff] [blame]

344

return False

Martin Panter

acc0319

2016-04-03 00:45:46 +0000

[diff] [blame]

345

except http.client.HTTPException as err:

346

self.send_error(

347

HTTPStatus.REQUEST_HEADER_FIELDS_TOO_LARGE,

"Too many headers",

str(err)

)

return False

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

352

353

conntype = self.headers.get('Connection', "")

354

if conntype.lower() == 'close':

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

355

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

356

elif (conntype.lower() == 'keep-alive' and

357

self.protocol_version >= "HTTP/1.1"):

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

358

self.close_connection = False

Senthil Kumaran

0f476d4

2010-09-30 06:09:18 +0000

[diff] [blame]

359

# Examine the headers and look for an Expect directive

360

expect = self.headers.get('Expect', "")

361

if (expect.lower() == "100-continue" and

362

self.protocol_version >= "HTTP/1.1" and

363

self.request_version >= "HTTP/1.1"):

364

if not self.handle_expect_100():

return False

return True

def handle_expect_100(self):

369

"""Decide what to do with an "Expect: 100-continue" header.

370

371

If the client is expecting a 100 Continue response, we must

372

respond with either a 100 Continue or a final response before

373

waiting for the request body. The default is to always respond

374

with a 100 Continue. You can behave differently (for example,

375

reject unauthorized requests) by overriding this method.

376

377

This method should either return True (possibly after sending

378

a 100 Continue response) or send an error response and return

379

False.

380

381

"""

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

382

self.send_response_only(HTTPStatus.CONTINUE)

Benjamin Peterson

0442423

2014-01-18 21:50:18 -0500

[diff] [blame]

383

self.end_headers()

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

384

return True

385

386

def handle_one_request(self):

387

"""Handle a single HTTP request.

388

389

You normally don't need to override this method; see the class

390

__doc__ string for information on how to handle specific HTTP

391

commands such as GET and POST.

392

393

"""

Kristján Valur Jónsson

2009-07-01 10:01:31 +0000

[diff] [blame]

394

try:

Antoine Pitrou

c492437

2010-12-16 16:48:36 +0000

[diff] [blame]

395

self.raw_requestline = self.rfile.readline(65537)

396

if len(self.raw_requestline) > 65536:

397

self.requestline = ''

398

self.request_version = ''

399

self.command = ''

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

400

self.send_error(HTTPStatus.REQUEST_URI_TOO_LONG)

Antoine Pitrou

c492437

2010-12-16 16:48:36 +0000

[diff] [blame]

401

return

Kristján Valur Jónsson

2009-07-01 10:01:31 +0000

[diff] [blame]

402

if not self.raw_requestline:

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

403

self.close_connection = True

Kristján Valur Jónsson

2009-07-01 10:01:31 +0000

[diff] [blame]

404

return

405

if not self.parse_request():

406

# An error code has been sent, just exit

407

return

408

mname = 'do_' + self.command

409

if not hasattr(self, mname):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

410

self.send_error(

411

HTTPStatus.NOT_IMPLEMENTED,

412

"Unsupported method (%r)" % self.command)

Kristján Valur Jónsson

2009-07-01 10:01:31 +0000

[diff] [blame]

413

return

414

method = getattr(self, mname)

415

method()

416

self.wfile.flush() #actually send the response if not already done.

Christian Heimes

03c8ddd

2020-11-20 09:26:07 +0100

[diff] [blame]

417

except TimeoutError as e:

Kristján Valur Jónsson

2009-07-01 10:01:31 +0000

[diff] [blame]

418

#a read or a write timed out. Discard this connection

419

self.log_error("Request timed out: %r", e)

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

420

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

421

return

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

422

423

def handle(self):

424

"""Handle multiple requests if necessary."""

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

425

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

426

427

self.handle_one_request()

428

while not self.close_connection:

429

self.handle_one_request()

430

Senthil Kumaran

2688644

2013-03-15 07:53:21 -0700

[diff] [blame]

431

def send_error(self, code, message=None, explain=None):

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

432

"""Send and log an error reply.

433

Senthil Kumaran

2688644

2013-03-15 07:53:21 -0700

[diff] [blame]

434

Arguments are

435

* code: an HTTP error code

436

3 digits

437

* message: a simple optional 1 line reason phrase.

438

*( HTAB / SP / VCHAR / %x80-FF )

439

defaults to short entry matching the response code

440

* explain: a detailed message defaults to the long entry

441

matching the response code.

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

442

443

This sends an error response (so it must be called before any

444

output has been generated), logs the error, and finally sends

445

a piece of HTML explaining the error to the user.

"""

try:

shortmsg, longmsg = self.responses[code]

451

except KeyError:

452

shortmsg, longmsg = '???', '???'

453

if message is None:

454

message = shortmsg

Senthil Kumaran

2688644

2013-03-15 07:53:21 -0700

[diff] [blame]

455

if explain is None:

456

explain = longmsg

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

457

self.log_error("code %d, message %s", code, message)

Senthil Kumaran

1e7551d

2013-03-05 02:25:58 -0800

[diff] [blame]

458

self.send_response(code, message)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

459

self.send_header('Connection', 'close')

Martin Panter

e42e129

2016-06-08 08:29:13 +0000

[diff] [blame]

460

461

# Message body is omitted for cases described in:

462

# - RFC7230: 3.3. 1xx, 204(No Content), 304(Not Modified)

463

# - RFC7231: 6.3.6. 205(Reset Content)

464

body = None

465

if (code >= 200 and

466

code not in (HTTPStatus.NO_CONTENT,

467

HTTPStatus.RESET_CONTENT,

468

HTTPStatus.NOT_MODIFIED)):

469

# HTML encode to prevent Cross Site Scripting attacks

470

# (see bug #1100201)

471

content = (self.error_message_format % {

472

'code': code,

Martin Panter

40de69a

2016-06-08 09:45:58 +0000

[diff] [blame]

473

'message': html.escape(message, quote=False),

474

'explain': html.escape(explain, quote=False)

Martin Panter

e42e129

2016-06-08 08:29:13 +0000

[diff] [blame]

475

})

476

body = content.encode('UTF-8', 'replace')

477

self.send_header("Content-Type", self.error_content_type)

ValeriyaSinevich

b36b0a3

2018-06-18 14:17:53 -0700

[diff] [blame]

478

self.send_header('Content-Length', str(len(body)))

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

479

self.end_headers()

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

480

Martin Panter

e42e129

2016-06-08 08:29:13 +0000

[diff] [blame]

481

if self.command != 'HEAD' and body:

Senthil Kumaran

52d2720

2012-10-10 23:16:21 -0700

[diff] [blame]

482

self.wfile.write(body)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

483

484

def send_response(self, code, message=None):

Senthil Kumaran

2011-05-09 23:25:02 +0800

[diff] [blame]

485

"""Add the response header to the headers buffer and log the

486

response code.

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

487

488

Also send two standard headers with the server software

489

version and the current date.

490

491

"""

492

self.log_request(code)

Senthil Kumaran

0f476d4

2010-09-30 06:09:18 +0000

[diff] [blame]

493

self.send_response_only(code, message)

494

self.send_header('Server', self.version_string())

495

self.send_header('Date', self.date_time_string())

496

497

def send_response_only(self, code, message=None):

498

"""Send the response header only."""

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

499

if self.request_version != 'HTTP/0.9':

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

500

if message is None:

501

if code in self.responses:

502

message = self.responses[code][0]

503

else:

504

message = ''

Senthil Kumaran

2011-05-09 23:25:02 +0800

[diff] [blame]

505

if not hasattr(self, '_headers_buffer'):

506

self._headers_buffer = []

507

self._headers_buffer.append(("%s %d %s\r\n" %

508

(self.protocol_version, code, message)).encode(

509

'latin-1', 'strict'))

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

510

511

def send_header(self, keyword, value):

Senthil Kumaran

2011-05-09 23:25:02 +0800

[diff] [blame]

512

"""Send a MIME header to the headers buffer."""

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

513

if self.request_version != 'HTTP/0.9':

Senthil Kumaran

e4dad4f

2010-11-21 14:36:14 +0000

[diff] [blame]

514

if not hasattr(self, '_headers_buffer'):

515

self._headers_buffer = []

516

self._headers_buffer.append(

Marc-André Lemburg

8f36af7

2011-02-25 15:42:01 +0000

[diff] [blame]

517

("%s: %s\r\n" % (keyword, value)).encode('latin-1', 'strict'))

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

518

519

if keyword.lower() == 'connection':

520

if value.lower() == 'close':

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

521

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

522

elif value.lower() == 'keep-alive':

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

523

self.close_connection = False

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

524

525

def end_headers(self):

526

"""Send the blank line ending the MIME headers."""

527

if self.request_version != 'HTTP/0.9':

Senthil Kumaran

e4dad4f

2010-11-21 14:36:14 +0000

[diff] [blame]

528

self._headers_buffer.append(b"\r\n")

Senthil Kumaran

2011-05-09 23:25:02 +0800

[diff] [blame]

529

self.flush_headers()

530

531

def flush_headers(self):

532

if hasattr(self, '_headers_buffer'):

Senthil Kumaran

e4dad4f

2010-11-21 14:36:14 +0000

[diff] [blame]

533

self.wfile.write(b"".join(self._headers_buffer))

534

self._headers_buffer = []

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

535

536

def log_request(self, code='-', size='-'):

537

"""Log an accepted request.

538

539

This is called by send_response().

540

541

"""

Serhiy Storchaka

c0a23e6

2015-03-07 11:51:37 +0200

[diff] [blame]

542

if isinstance(code, HTTPStatus):

543

code = code.value

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

544

self.log_message('"%s" %s %s',

545

self.requestline, str(code), str(size))

546

547

def log_error(self, format, *args):

548

"""Log an error.

549

550

This is called when a request cannot be fulfilled. By

551

default it passes the message on to log_message().

552

553

Arguments are the same as for log_message().

554

555

XXX This should go to the separate error log.

"""

self.log_message(format, *args)

560

561

def log_message(self, format, *args):

562

"""Log an arbitrary message.

563

564

This is used by all other logging functions. Override

565

it if you have specific logging wishes.

566

567

The first argument, FORMAT, is a format string for the

568

message to be logged. If the format string contains

569

any % escapes requiring parameters, they should be

570

specified as subsequent arguments (it's just like

571

printf!).

572

Senthil Kumaran

db727b4

2012-04-29 13:41:03 +0800

[diff] [blame]

573

The client ip and current date/time are prefixed to

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

every message.

"""

sys.stderr.write("%s - - [%s] %s\n" %

579

(self.address_string(),

580

self.log_date_time_string(),

581

format%args))

582

583

def version_string(self):

584

"""Return the server software version string."""

585

return self.server_version + ' ' + self.sys_version

586

587

def date_time_string(self, timestamp=None):

588

"""Return the current date and time formatted for a message header."""

589

if timestamp is None:

590

timestamp = time.time()

Berker Peksag

04bc5b9

2016-03-14 06:06:03 +0200

[diff] [blame]

591

return email.utils.formatdate(timestamp, usegmt=True)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

592

593

def log_date_time_string(self):

594

"""Return the current time formatted for logging."""

595

now = time.time()

596

year, month, day, hh, mm, ss, x, y, z = time.localtime(now)

597

s = "%02d/%3s/%04d %02d:%02d:%02d" % (

598

day, self.monthname[month], year, hh, mm, ss)

599

return s

600

601

weekdayname = ['Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat', 'Sun']

602

603

monthname = [None,

604

'Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun',

605

'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec']

606

607

def address_string(self):

Senthil Kumaran

1aacba4

2012-04-29 12:51:54 +0800

[diff] [blame]

608

"""Return the client address."""

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

609

Senthil Kumaran

1aacba4

2012-04-29 12:51:54 +0800

[diff] [blame]

610

return self.client_address[0]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

611

612

# Essentially static class variables

613

614

# The version of the HTTP protocol we support.

615

# Set this to HTTP/1.1 to enable automatic keepalive

616

protocol_version = "HTTP/1.0"

617

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

618

# MessageClass used to parse headers

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

619

MessageClass = http.client.HTTPMessage

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

620

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

621

# hack to maintain backwards compatibility

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

622

responses = {

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

623

v: (v.phrase, v.description)

624

for v in HTTPStatus.__members__.values()

625

}

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

626

627

628

class SimpleHTTPRequestHandler(BaseHTTPRequestHandler):

629

630

"""Simple HTTP request handler with GET and HEAD commands.

631

632

This serves files from the current directory and any of its

633

subdirectories. The MIME type for files is determined by

634

calling the .guess_type() method.

635

636

The GET and HEAD requests are identical except that the HEAD

637

request omits the actual contents of the file.

"""

server_version = "SimpleHTTP/" + __version__

An Long

5907e61

2020-01-09 02:28:14 +0800

[diff] [blame]

642

extensions_map = _encodings_map_default = {

643

'.gz': 'application/gzip',

644

'.Z': 'application/octet-stream',

645

'.bz2': 'application/x-bzip2',

646

'.xz': 'application/x-xz',

647

}

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

648

Stéphane Wirtel

2017-05-24 09:29:06 +0200

[diff] [blame]

649

def __init__(self, *args, directory=None, **kwargs):

650

if directory is None:

651

directory = os.getcwd()

Géry Ogam

781266e

2019-09-11 15:03:46 +0200

[diff] [blame]

652

self.directory = os.fspath(directory)

Stéphane Wirtel

2017-05-24 09:29:06 +0200

[diff] [blame]

653

super().__init__(*args, **kwargs)

654

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

655

def do_GET(self):

656

"""Serve a GET request."""

657

f = self.send_head()

658

if f:

Serhiy Storchaka

2014-01-25 19:43:02 +0200

[diff] [blame]

659

try:

660

self.copyfile(f, self.wfile)

661

finally:

662

f.close()

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

663

664

def do_HEAD(self):

665

"""Serve a HEAD request."""

f = self.send_head()

if f:

f.close()

def send_head(self):

"""Common code for GET and HEAD commands.

672

673

This sends the response code and MIME headers.

674

675

Return value is either a file object (which has to be copied

676

to the outputfile by the caller unless the command was HEAD,

677

and must be closed by the caller under all circumstances), or

678

None, in which case the caller has nothing further to do.

679

680

"""

681

path = self.translate_path(self.path)

682

f = None

683

if os.path.isdir(path):

Benjamin Peterson

94cb7a2

2014-12-26 10:53:43 -0600

[diff] [blame]

684

parts = urllib.parse.urlsplit(self.path)

685

if not parts.path.endswith('/'):

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

686

# redirect browser - doing basically what apache does

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

687

self.send_response(HTTPStatus.MOVED_PERMANENTLY)

Benjamin Peterson

94cb7a2

2014-12-26 10:53:43 -0600

[diff] [blame]

688

new_parts = (parts[0], parts[1], parts[2] + '/',

689

parts[3], parts[4])

690

new_url = urllib.parse.urlunsplit(new_parts)

691

self.send_header("Location", new_url)

Miss Islington (bot)

058f9b2

2021-05-06 12:48:36 -0700

[diff] [blame]

692

self.send_header("Content-Length", "0")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

693

self.end_headers()

694

return None

695

for index in "index.html", "index.htm":

696

index = os.path.join(path, index)

697

if os.path.exists(index):

path = index

break

else:

return self.list_directory(path)

702

ctype = self.guess_type(path)

Michael Felt

2062a20

2018-12-26 06:43:42 +0100

[diff] [blame]

703

# check for trailing "/" which should return 404. See Issue17324

704

# The test for this was added in test_httpserver.py

705

# However, some OS platforms accept a trailingSlash as a filename

706

# See discussion on python-dev and Issue34711 regarding

707

# parseing and rejection of filenames with a trailing slash

708

if path.endswith("/"):

709

self.send_error(HTTPStatus.NOT_FOUND, "File not found")

710

return None

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

711

try:

712

f = open(path, 'rb')

Andrew Svetlov

f7a17b4

2012-12-25 16:47:37 +0200

[diff] [blame]

713

except OSError:

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

714

self.send_error(HTTPStatus.NOT_FOUND, "File not found")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

715

return None

Pierre Quentel

2017-04-02 12:26:12 +0200

[diff] [blame]

716

Serhiy Storchaka

2014-01-25 19:43:02 +0200

[diff] [blame]

717

try:

Pierre Quentel

2017-04-02 12:26:12 +0200

[diff] [blame]

718

fs = os.fstat(f.fileno())

719

# Use browser cache if possible

720

if ("If-Modified-Since" in self.headers

721

and "If-None-Match" not in self.headers):

722

# compare If-Modified-Since and time of last file modification

723

try:

724

ims = email.utils.parsedate_to_datetime(

725

self.headers["If-Modified-Since"])

726

except (TypeError, IndexError, OverflowError, ValueError):

727

# ignore ill-formed values

728

pass

729

else:

730

if ims.tzinfo is None:

731

# obsolete format with no timezone, cf.

732

# https://tools.ietf.org/html/rfc7231#section-7.1.1.1

733

ims = ims.replace(tzinfo=datetime.timezone.utc)

734

if ims.tzinfo is datetime.timezone.utc:

735

# compare to UTC datetime of last modification

736

last_modif = datetime.datetime.fromtimestamp(

737

fs.st_mtime, datetime.timezone.utc)

738

# remove microseconds, like in If-Modified-Since

739

last_modif = last_modif.replace(microsecond=0)

Serhiy Storchaka

13ad3b7

2017-09-14 09:38:36 +0300

[diff] [blame]

740

Pierre Quentel

2017-04-02 12:26:12 +0200

[diff] [blame]

741

if last_modif <= ims:

742

self.send_response(HTTPStatus.NOT_MODIFIED)

self.end_headers()

f.close()

return None

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

747

self.send_response(HTTPStatus.OK)

Serhiy Storchaka

2014-01-25 19:43:02 +0200

[diff] [blame]

748

self.send_header("Content-type", ctype)

Serhiy Storchaka

2014-01-25 19:43:02 +0200

[diff] [blame]

749

self.send_header("Content-Length", str(fs[6]))

Serhiy Storchaka

13ad3b7

2017-09-14 09:38:36 +0300

[diff] [blame]

750

self.send_header("Last-Modified",

Pierre Quentel

2017-04-02 12:26:12 +0200

[diff] [blame]

751

self.date_time_string(fs.st_mtime))

Serhiy Storchaka

2014-01-25 19:43:02 +0200

[diff] [blame]

self.end_headers()

return f

except:

f.close()

raise

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

757

758

def list_directory(self, path):

759

"""Helper to produce a directory listing (absent index.html).

760

761

Return value is either a file object, or None (indicating an

762

error). In either case, the headers are sent, making the

763

interface the same as for send_head().

"""

try:

list = os.listdir(path)

Andrew Svetlov

ad28c7f

2012-12-18 22:02:39 +0200

[diff] [blame]

768

except OSError:

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

769

self.send_error(

770

HTTPStatus.NOT_FOUND,

771

"No permission to list directory")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

772

return None

773

list.sort(key=lambda a: a.lower())

774

r = []

Serhiy Storchaka

2014-08-17 08:22:11 +0300

[diff] [blame]

775

try:

776

displaypath = urllib.parse.unquote(self.path,

777

errors='surrogatepass')

778

except UnicodeDecodeError:

779

displaypath = urllib.parse.unquote(path)

Martin Panter

da3bb38

2016-04-11 00:40:08 +0000

[diff] [blame]

780

displaypath = html.escape(displaypath, quote=False)

Ezio Melotti

2011-11-02 19:33:29 +0200

[diff] [blame]

781

enc = sys.getfilesystemencoding()

782

title = 'Directory listing for %s' % displaypath

783

r.append('<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" '

784

'"http://www.w3.org/TR/html4/strict.dtd">')

785

r.append('<html>\n<head>')

786

r.append('<meta http-equiv="Content-Type" '

787

'content="text/html; charset=%s">' % enc)

788

r.append('<title>%s</title>\n</head>' % title)

789

r.append('<body>\n<h1>%s</h1>' % title)

790

r.append('<hr>\n<ul>')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

791

for name in list:

792

fullname = os.path.join(path, name)

793

displayname = linkname = name

794

# Append / for directories or @ for symbolic links

795

if os.path.isdir(fullname):

796

displayname = name + "/"

797

linkname = name + "/"

798

if os.path.islink(fullname):

799

displayname = name + "@"

800

# Note: a link to a directory displays with @ and links with /

Ezio Melotti

2011-11-02 19:33:29 +0200

[diff] [blame]

801

r.append('<li><a href="%s">%s</a></li>'

Serhiy Storchaka

2014-08-17 08:22:11 +0300

[diff] [blame]

802

% (urllib.parse.quote(linkname,

803

errors='surrogatepass'),

Martin Panter

da3bb38

2016-04-11 00:40:08 +0000

[diff] [blame]

804

html.escape(displayname, quote=False)))

Ezio Melotti

2011-11-02 19:33:29 +0200

[diff] [blame]

805

r.append('</ul>\n<hr>\n</body>\n</html>\n')

Serhiy Storchaka

2014-08-17 08:22:11 +0300

[diff] [blame]

806

encoded = '\n'.join(r).encode(enc, 'surrogateescape')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

807

f = io.BytesIO()

808

f.write(encoded)

809

f.seek(0)

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

810

self.send_response(HTTPStatus.OK)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

811

self.send_header("Content-type", "text/html; charset=%s" % enc)

812

self.send_header("Content-Length", str(len(encoded)))

self.end_headers()

return f

def translate_path(self, path):

817

"""Translate a /-separated PATH to the local filename syntax.

818

819

Components that mean special things to the local file system

820

(e.g. drive or directory names) are ignored. (XXX They should

821

probably be diagnosed.)

822

823

"""

824

# abandon query parameters

825

path = path.split('?',1)[0]

826

path = path.split('#',1)[0]

Senthil Kumaran

72c238e

2013-09-13 00:21:18 -0700

[diff] [blame]

827

# Don't forget explicit trailing slash when normalizing. Issue17324

Senthil Kumaran

600b735

2013-09-29 18:59:04 -0700

[diff] [blame]

828

trailing_slash = path.rstrip().endswith('/')

Serhiy Storchaka

2014-08-17 08:22:11 +0300

[diff] [blame]

829

try:

830

path = urllib.parse.unquote(path, errors='surrogatepass')

831

except UnicodeDecodeError:

832

path = urllib.parse.unquote(path)

833

path = posixpath.normpath(path)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

834

words = path.split('/')

835

words = filter(None, words)

Stéphane Wirtel

2017-05-24 09:29:06 +0200

[diff] [blame]

836

path = self.directory

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

837

for word in words:

Martin Panter

d274b3f

2016-04-18 03:45:18 +0000

[diff] [blame]

838

if os.path.dirname(word) or word in (os.curdir, os.pardir):

839

# Ignore components that are not a simple file/directory name

840

continue

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

841

path = os.path.join(path, word)

Senthil Kumaran

72c238e

2013-09-13 00:21:18 -0700

[diff] [blame]

842

if trailing_slash:

843

path += '/'

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

844

return path

845

846

def copyfile(self, source, outputfile):

847

"""Copy all data between two file objects.

848

849

The SOURCE argument is a file object open for reading

850

(or anything with a read() method) and the DESTINATION

851

argument is a file object open for writing (or

852

anything with a write() method).

853

854

The only reason for overriding this would be to change

855

the block size or perhaps to replace newlines by CRLF

856

-- note however that this the default server uses this

857

to copy binary data as well.

858

859

"""

860

shutil.copyfileobj(source, outputfile)

861

862

def guess_type(self, path):

863

"""Guess the type of a file.

864

865

Argument is a PATH (a filename).

866

867

Return value is a string of the form type/subtype,

868

usable for a MIME Content-type header.

869

870

The default implementation looks the file's extension

871

up in the table self.extensions_map, using application/octet-stream

872

as a default; however it would be permissible (if

873

slow) to look inside the data to make a better guess.

874

875

"""

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

876

base, ext = posixpath.splitext(path)

877

if ext in self.extensions_map:

878

return self.extensions_map[ext]

879

ext = ext.lower()

880

if ext in self.extensions_map:

881

return self.extensions_map[ext]

An Long

5907e61

2020-01-09 02:28:14 +0800

[diff] [blame]

882

guess, _ = mimetypes.guess_type(path)

883

if guess:

884

return guess

885

return 'application/octet-stream'

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

886

887

888

# Utilities for CGIHTTPRequestHandler

889

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

890

def _url_collapse_path(path):

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

891

"""

892

Given a URL path, remove extra '/'s and '.' path elements and collapse

Martin Panter

9955a37

2015-10-07 10:26:23 +0000

[diff] [blame]

893

any '..' references and returns a collapsed path.

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

894

895

Implements something akin to RFC-2396 5.2 step 6 to parse relative paths.

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

896

The utility of this function is limited to is_cgi method and helps

897

preventing some security attacks.

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

898

Martin Panter

2015-10-03 05:55:46 +0000

[diff] [blame]

899

Returns: The reconstituted URL, which will always start with a '/'.

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

900

901

Raises: IndexError if too many '..' occur within the path.

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

902

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

903

"""

Martin Panter

2015-10-03 05:55:46 +0000

[diff] [blame]

904

# Query component should not be involved.

905

path, _, query = path.partition('?')

906

path = urllib.parse.unquote(path)

907

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

908

# Similar to os.path.split(os.path.normpath(path)) but specific to URL

909

# path semantics rather than local operating system semantics.

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

910

path_parts = path.split('/')

911

head_parts = []

912

for part in path_parts[:-1]:

913

if part == '..':

914

head_parts.pop() # IndexError if more '..' than prior parts

915

elif part and part != '.':

916

head_parts.append( part )

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

917

if path_parts:

Senthil Kumaran

dbb369d

2012-04-11 03:15:28 +0800

[diff] [blame]

918

tail_part = path_parts.pop()

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

919

if tail_part:

920

if tail_part == '..':

921

head_parts.pop()

922

tail_part = ''

923

elif tail_part == '.':

924

tail_part = ''

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

925

else:

926

tail_part = ''

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

927

Martin Panter

2015-10-03 05:55:46 +0000

[diff] [blame]

928

if query:

929

tail_part = '?'.join((tail_part, query))

930

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

931

splitpath = ('/' + '/'.join(head_parts), tail_part)

932

collapsed_path = "/".join(splitpath)

933

934

return collapsed_path

935

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

936

937

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

nobody = None

def nobody_uid():

"""Internal routine to get nobody's uid"""

global nobody

if nobody:

return nobody

try:

import pwd

Brett Cannon

cd171c8

2013-07-04 17:43:24 -0400

[diff] [blame]

947

except ImportError:

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

948

return -1

949

try:

950

nobody = pwd.getpwnam('nobody')[2]

951

except KeyError:

Georg Brandl

cbd2ab1

2010-12-04 10:39:14 +0000

[diff] [blame]

952

nobody = 1 + max(x[2] for x in pwd.getpwall())

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

return nobody

def executable(path):

957

"""Test for executable file."""

Victor Stinner

fb25ba9

2011-06-20 17:45:54 +0200

[diff] [blame]

958

return os.access(path, os.X_OK)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

959

960

961

class CGIHTTPRequestHandler(SimpleHTTPRequestHandler):

962

963

"""Complete HTTP server with GET, HEAD and POST commands.

964

965

GET and HEAD also support running CGI scripts.

966

967

The POST command is *only* implemented for CGI scripts.

"""

# Determine platform specifics

972

have_fork = hasattr(os, 'fork')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

973

974

# Make rfile unbuffered -- we need to read one line and then pass

975

# the rest to a subprocess, so we can't use buffered input.

rbufsize = 0

def do_POST(self):

"""Serve a POST request.

980

981

This is only implemented for CGI scripts.

"""

if self.is_cgi():

self.run_cgi()

else:

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

988

self.send_error(

989

HTTPStatus.NOT_IMPLEMENTED,

990

"Can only POST to CGI scripts")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

991

992

def send_head(self):

993

"""Version of send_head that support CGI scripts"""

994

if self.is_cgi():

995

return self.run_cgi()

996

else:

997

return SimpleHTTPRequestHandler.send_head(self)

998

999

def is_cgi(self):

1000

"""Test whether self.path corresponds to a CGI script.

1001

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

1002

Returns True and updates the cgi_info attribute to the tuple

1003

(dir, rest) if self.path requires running a CGI script.

1004

Returns False otherwise.

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1005

Benjamin Peterson

a7deeee

2009-05-08 20:54:42 +0000

[diff] [blame]

1006

If any exception is raised, the caller should assume that

1007

self.path was rejected as invalid and act accordingly.

1008

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

1009

The default implementation tests whether the normalized url

1010

path begins with one of the strings in self.cgi_directories

1011

(and the next character is a '/' or the end of the string).

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1012

1013

"""

Martin Panter

2015-10-03 05:55:46 +0000

[diff] [blame]

1014

collapsed_path = _url_collapse_path(self.path)

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

1015

dir_sep = collapsed_path.find('/', 1)

Siwon Kang

91daa9d

2019-11-22 18:13:05 +0900

[diff] [blame]

1016

while dir_sep > 0 and not collapsed_path[:dir_sep] in self.cgi_directories:

1017

dir_sep = collapsed_path.find('/', dir_sep+1)

1018

if dir_sep > 0:

1019

head, tail = collapsed_path[:dir_sep], collapsed_path[dir_sep+1:]

Senthil Kumaran

dbb369d

2012-04-11 03:15:28 +0800

[diff] [blame]

1020

self.cgi_info = head, tail

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

1021

return True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1022

return False

1023

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

1024

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1025

cgi_directories = ['/cgi-bin', '/htbin']

1026

1027

def is_executable(self, path):

1028

"""Test whether argument path is an executable file."""

1029

return executable(path)

1030

1031

def is_python(self, path):

1032

"""Test whether argument path is a Python script."""

1033

head, tail = os.path.splitext(path)

1034

return tail.lower() in (".py", ".pyw")

1035

1036

def run_cgi(self):

1037

"""Execute a CGI script."""

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1038

dir, rest = self.cgi_info

Ned Deily

915a30f

2014-07-12 22:06:26 -0700

[diff] [blame]

1039

path = dir + '/' + rest

1040

i = path.find('/', len(dir)+1)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1041

while i >= 0:

Ned Deily

915a30f

2014-07-12 22:06:26 -0700

[diff] [blame]

1042

nextdir = path[:i]

1043

nextrest = path[i+1:]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1044

1045

scriptdir = self.translate_path(nextdir)

1046

if os.path.isdir(scriptdir):

1047

dir, rest = nextdir, nextrest

Ned Deily

915a30f

2014-07-12 22:06:26 -0700

[diff] [blame]

1048

i = path.find('/', len(dir)+1)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

else:

break

# find an explicit query string, if present.

Martin Panter

a02e18a

2015-10-03 05:38:07 +0000

[diff] [blame]

1053

rest, _, query = rest.partition('?')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1054

1055

# dissect the part after the directory name into a script name &

1056

# a possible additional path, to be stored in PATH_INFO.

1057

i = rest.find('/')

1058

if i >= 0:

1059

script, rest = rest[:i], rest[i:]

1060

else:

1061

script, rest = rest, ''

1062

1063

scriptname = dir + '/' + script

1064

scriptfile = self.translate_path(scriptname)

1065

if not os.path.exists(scriptfile):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

1066

self.send_error(

1067

HTTPStatus.NOT_FOUND,

1068

"No such CGI script (%r)" % scriptname)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1069

return

1070

if not os.path.isfile(scriptfile):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

1071

self.send_error(

1072

HTTPStatus.FORBIDDEN,

1073

"CGI script is not a plain file (%r)" % scriptname)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1074

return

1075

ispy = self.is_python(scriptname)

Victor Stinner

fb25ba9

2011-06-20 17:45:54 +0200

[diff] [blame]

1076

if self.have_fork or not ispy:

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1077

if not self.is_executable(scriptfile):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

1078

self.send_error(

1079

HTTPStatus.FORBIDDEN,

1080

"CGI script is not executable (%r)" % scriptname)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1081

return

1082

1083

# Reference: http://hoohoo.ncsa.uiuc.edu/cgi/env.html

1084

# XXX Much of the following could be prepared ahead of time!

Senthil Kumaran

4271372

2010-10-03 17:55:45 +0000

[diff] [blame]

1085

env = copy.deepcopy(os.environ)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1086

env['SERVER_SOFTWARE'] = self.version_string()

1087

env['SERVER_NAME'] = self.server.server_name

1088

env['GATEWAY_INTERFACE'] = 'CGI/1.1'

1089

env['SERVER_PROTOCOL'] = self.protocol_version

1090

env['SERVER_PORT'] = str(self.server.server_port)

1091

env['REQUEST_METHOD'] = self.command

Jeremy Hylton

1afc169

2008-06-18 20:49:58 +0000

[diff] [blame]

1092

uqrest = urllib.parse.unquote(rest)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1093

env['PATH_INFO'] = uqrest

1094

env['PATH_TRANSLATED'] = self.translate_path(uqrest)

1095

env['SCRIPT_NAME'] = scriptname

Senthil Kumaran

3ec9d01

2020-12-02 19:48:14 -0800

[diff] [blame]

1096

env['QUERY_STRING'] = query

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1097

env['REMOTE_ADDR'] = self.client_address[0]

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1098

authorization = self.headers.get("authorization")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1099

if authorization:

1100

authorization = authorization.split()

1101

if len(authorization) == 2:

1102

import base64, binascii

1103

env['AUTH_TYPE'] = authorization[0]

1104

if authorization[0].lower() == "basic":

1105

try:

1106

authorization = authorization[1].encode('ascii')

Georg Brandl

706824f

2009-06-04 09:42:55 +0000

[diff] [blame]

1107

authorization = base64.decodebytes(authorization).\

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1108

decode('ascii')

1109

except (binascii.Error, UnicodeError):

1110

pass

1111

else:

1112

authorization = authorization.split(':')

1113

if len(authorization) == 2:

1114

env['REMOTE_USER'] = authorization[0]

1115

# XXX REMOTE_IDENT

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1116

if self.headers.get('content-type') is None:

1117

env['CONTENT_TYPE'] = self.headers.get_content_type()

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1118

else:

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1119

env['CONTENT_TYPE'] = self.headers['content-type']

1120

length = self.headers.get('content-length')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1121

if length:

1122

env['CONTENT_LENGTH'] = length

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1123

referer = self.headers.get('referer')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1124

if referer:

1125

env['HTTP_REFERER'] = referer

Senthil Kumaran

da3d2ab

2020-12-05 05:26:24 -0800

[diff] [blame]

1126

accept = self.headers.get_all('accept', ())

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1127

env['HTTP_ACCEPT'] = ','.join(accept)

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1128

ua = self.headers.get('user-agent')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1129

if ua:

1130

env['HTTP_USER_AGENT'] = ua

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1131

co = filter(None, self.headers.get_all('cookie', []))

Georg Brandl

62e2ca2

2010-07-31 21:54:24 +0000

[diff] [blame]

1132

cookie_str = ', '.join(co)

1133

if cookie_str:

1134

env['HTTP_COOKIE'] = cookie_str

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1135

# XXX Other HTTP_* headers

1136

# Since we're setting the env in the parent, provide empty

1137

# values to override previously set values

1138

for k in ('QUERY_STRING', 'REMOTE_HOST', 'CONTENT_LENGTH',

1139

'HTTP_USER_AGENT', 'HTTP_COOKIE', 'HTTP_REFERER'):

1140

env.setdefault(k, "")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1141

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

1142

self.send_response(HTTPStatus.OK, "Script output follows")

Senthil Kumaran

2011-05-09 23:25:02 +0800

[diff] [blame]

1143

self.flush_headers()

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1144

1145

decoded_query = query.replace('+', ' ')

1146

1147

if self.have_fork:

1148

# Unix -- fork as we should

1149

args = [script]

1150

if '=' not in decoded_query:

1151

args.append(decoded_query)

1152

nobody = nobody_uid()

1153

self.wfile.flush() # Always flush before forking

pid = os.fork()

if pid != 0:

# Parent

pid, sts = os.waitpid(pid, 0)

1158

# throw away additional data [see bug #427345]

1159

while select.select([self.rfile], [], [], 0)[0]:

1160

if not self.rfile.read(1):

1161

break

Victor Stinner

9a679a0

2020-04-02 03:42:05 +0200

[diff] [blame]

1162

exitcode = os.waitstatus_to_exitcode(sts)

1163

if exitcode:

1164

self.log_error(f"CGI script exit code {exitcode}")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

return

# Child

try:

try:

os.setuid(nobody)

Andrew Svetlov

ad28c7f

2012-12-18 22:02:39 +0200

[diff] [blame]

1170

except OSError:

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1171

pass

1172

os.dup2(self.rfile.fileno(), 0)

1173

os.dup2(self.wfile.fileno(), 1)

Senthil Kumaran

4271372

2010-10-03 17:55:45 +0000

[diff] [blame]

1174

os.execve(scriptfile, args, env)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1175

except:

1176

self.server.handle_error(self.request, self.client_address)

1177

os._exit(127)

1178

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1179

else:

1180

# Non-Unix -- use subprocess

1181

import subprocess

Senthil Kumaran

e29cd16

2009-11-11 04:17:53 +0000

[diff] [blame]

1182

cmdline = [scriptfile]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1183

if self.is_python(scriptfile):

1184

interp = sys.executable

1185

if interp.lower().endswith("w.exe"):

1186

# On Windows, use python.exe, not pythonw.exe

1187

interp = interp[:-5] + interp[-4:]

Senthil Kumaran

e29cd16

2009-11-11 04:17:53 +0000

[diff] [blame]

1188

cmdline = [interp, '-u'] + cmdline

1189

if '=' not in query:

1190

cmdline.append(query)

1191

self.log_message("command: %s", subprocess.list2cmdline(cmdline))

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1192

try:

1193

nbytes = int(length)

1194

except (TypeError, ValueError):

1195

nbytes = 0

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1196

p = subprocess.Popen(cmdline,

1197

stdin=subprocess.PIPE,

1198

stdout=subprocess.PIPE,

Senthil Kumaran

4271372

2010-10-03 17:55:45 +0000

[diff] [blame]

1199

stderr=subprocess.PIPE,

1200

env = env

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1201

)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1202

if self.command.lower() == "post" and nbytes > 0:

1203

data = self.rfile.read(nbytes)

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1204

else:

1205

data = None

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1206

# throw away additional data [see bug #427345]

1207

while select.select([self.rfile._sock], [], [], 0)[0]:

1208

if not self.rfile._sock.recv(1):

1209

break

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1210

stdout, stderr = p.communicate(data)

1211

self.wfile.write(stdout)

1212

if stderr:

1213

self.log_error('%s', stderr)

Brian Curtin

cbad4df

2010-11-05 15:04:48 +0000

[diff] [blame]

1214

p.stderr.close()

1215

p.stdout.close()

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1216

status = p.returncode

1217

if status:

1218

self.log_error("CGI script exit status %#x", status)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1219

else:

1220

self.log_message("CGI script exited OK")

1221

1222

Jason R. Coombs

2019-02-07 08:22:45 -0500

[diff] [blame]

1223

def _get_best_family(*address):

1224

infos = socket.getaddrinfo(

1225

*address,

1226

type=socket.SOCK_STREAM,

1227

flags=socket.AI_PASSIVE,

1228

)

1229

family, type, proto, canonname, sockaddr = next(iter(infos))

1230

return family, sockaddr

1231

1232

Senthil Kumaran

defe7f4

2013-09-15 09:37:27 -0700

[diff] [blame]

1233

def test(HandlerClass=BaseHTTPRequestHandler,

Géry Ogam

1cee216

2018-05-29 22:10:30 +0200

[diff] [blame]

1234

ServerClass=ThreadingHTTPServer,

Jason R. Coombs

2019-02-07 08:22:45 -0500

[diff] [blame]

1235

protocol="HTTP/1.0", port=8000, bind=None):

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1236

"""Test the HTTP request handler class.

1237

Robert Collins

9644f24

2015-08-17 12:18:35 +1200

[diff] [blame]

1238

This runs an HTTP server on port 8000 (or the port argument).

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1239

1240

"""

Jason R. Coombs

2019-02-07 08:22:45 -0500

[diff] [blame]

1241

ServerClass.address_family, addr = _get_best_family(bind, port)

Lisa Roach

433433f

2018-11-26 10:43:38 -0800

[diff] [blame]

1242

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1243

HandlerClass.protocol_version = protocol

Jason R. Coombs

2019-02-07 08:22:45 -0500

[diff] [blame]

1244

with ServerClass(addr, HandlerClass) as httpd:

1245

host, port = httpd.socket.getsockname()[:2]

1246

url_host = f'[{host}]' if ':' in host else host

1247

print(

1248

f"Serving HTTP on {host} port {port} "

1249

f"(http://{url_host}:{port}/) ..."

1250

)

Martin Panter

0cab9c1

2016-04-13 00:36:52 +0000

[diff] [blame]

1251

try:

1252

httpd.serve_forever()

1253

except KeyboardInterrupt:

1254

print("\nKeyboard interrupt received, exiting.")

1255

sys.exit(0)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1256

1257

if __name__ == '__main__':

Serhiy Storchaka

7e4db2f

2017-05-04 08:17:47 +0300

[diff] [blame]

1258

import argparse

1259

Senthil Kumaran

2012-06-03 16:15:54 +0800

[diff] [blame]

1260

parser = argparse.ArgumentParser()

1261

parser.add_argument('--cgi', action='store_true',

1262

help='Run as CGI Server')

Jason R. Coombs

2019-02-07 08:22:45 -0500

[diff] [blame]

1263

parser.add_argument('--bind', '-b', metavar='ADDRESS',

Senthil Kumaran

defe7f4

2013-09-15 09:37:27 -0700

[diff] [blame]

1264

help='Specify alternate bind address '

1265

'[default: all interfaces]')

Stéphane Wirtel

2017-05-24 09:29:06 +0200

[diff] [blame]

1266

parser.add_argument('--directory', '-d', default=os.getcwd(),

1267

help='Specify alternative directory '

1268

'[default:current directory]')

Senthil Kumaran

2012-06-03 16:15:54 +0800

[diff] [blame]

1269

parser.add_argument('port', action='store',

1270

default=8000, type=int,

1271

nargs='?',

1272

help='Specify alternate port [default: 8000]')

1273

args = parser.parse_args()

1274

if args.cgi:

Senthil Kumaran

defe7f4

2013-09-15 09:37:27 -0700

[diff] [blame]

1275

handler_class = CGIHTTPRequestHandler

Senthil Kumaran

2012-06-03 16:15:54 +0800

[diff] [blame]

1276

else:

Stéphane Wirtel