Blame - Lib/http/server.py - platform/external/python/cpython3

2008-05-26 16:32:26 +0000

[diff] [blame]

1

"""HTTP server classes.

2

3

Note: BaseHTTPRequestHandler doesn't implement any HTTP request; see

4

SimpleHTTPRequestHandler for simple implementations of GET, HEAD and POST,

5

and CGIHTTPRequestHandler for CGI scripts.

6

7

It does, however, optionally implement HTTP/1.1 persistent connections,

8

as of version 0.3.

9

10

Notes on CGIHTTPRequestHandler

11

------------------------------

12

13

This class implements GET and POST requests to cgi-bin scripts.

14

15

If the os.fork() function is not present (e.g. on Windows),

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

16

subprocess.Popen() is used as a fallback, with slightly altered semantics.

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

17

18

In all cases, the implementation is intentionally naive -- all

19

requests are executed synchronously.

20

21

SECURITY WARNING: DON'T USE THIS CODE UNLESS YOU ARE INSIDE A FIREWALL

22

-- it may execute arbitrary Python code or external programs.

23

24

Note that status code 200 is sent prior to execution of a CGI script, so

25

scripts cannot send other status codes such as 302 (redirect).

XXX To do:

- log requests even later (to capture byte count)

30

- log user-agent header and other interesting goodies

31

- send error log to separate file

"""

# See also:

#

# HTTP Working Group T. Berners-Lee

38

# INTERNET-DRAFT R. T. Fielding

39

# <draft-ietf-http-v10-spec-00.txt> H. Frystyk Nielsen

40

# Expires September 8, 1995 March 8, 1995

41

#

42

# URL: http://www.ics.uci.edu/pub/ietf/http/draft-ietf-http-v10-spec-00.txt

#

# and

#

# Network Working Group R. Fielding

47

# Request for Comments: 2616 et al

48

# Obsoletes: 2068 June 1999

49

# Category: Standards Track

50

#

51

# URL: http://www.faqs.org/rfcs/rfc2616.html

# Log files

# ---------

#

# Here's a quote from the NCSA httpd docs about log file format.

57

#

58

# | The logfile format is as follows. Each line consists of:

59

# |

60

# | host rfc931 authuser [DD/Mon/YYYY:hh:mm:ss] "request" ddd bbbb

61

# |

62

# | host: Either the DNS name or the IP number of the remote client

63

# | rfc931: Any information returned by identd for this person,

64

# | - otherwise.

65

# | authuser: If user sent a userid for authentication, the user name,

66

# | - otherwise.

67

# | DD: Day

68

# | Mon: Month (calendar name)

69

# | YYYY: Year

70

# | hh: hour (24-hour format, the machine's timezone)

71

# | mm: minutes

72

# | ss: seconds

73

# | request: The first line of the HTTP request as sent by the client.

74

# | ddd: the status code returned by the server, - if not available.

75

# | bbbb: the total number of bytes sent,

76

# | *not including the HTTP/1.0 header*, - if not available

77

# |

78

# | You can determine the name of the file accessed through request.

79

#

80

# (Actually, the latter is only true if you know the server configuration

81

# at the time the request was made!)

__version__ = "0.6"

Berker Peksag

2015-02-13 20:48:15 +0200

[diff] [blame]

85

__all__ = [

86

"HTTPServer", "BaseHTTPRequestHandler",

87

"SimpleHTTPRequestHandler", "CGIHTTPRequestHandler",

88

]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

89

Berker Peksag

04bc5b9

2016-03-14 06:06:03 +0200

[diff] [blame]

90

import email.utils

Georg Brandl

1f7fffb

2010-10-15 15:57:45 +0000

[diff] [blame]

91

import html

Jeremy Hylton

914ab45

2009-03-27 17:16:06 +0000

[diff] [blame]

import http.client

import io

import mimetypes

import os

import posixpath

import select

import shutil

import socket # For gethostbyaddr()

import socketserver

import sys

import time

import urllib.parse

Senthil Kumaran

2010-10-03 17:55:45 +0000

[diff] [blame]

104

import copy

Senthil Kumaran

2012-06-03 16:15:54 +0800

[diff] [blame]

105

import argparse

106

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

107

from http import HTTPStatus

108

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

109

110

# Default error message template

111

DEFAULT_ERROR_MESSAGE = """\

Senthil Kumaran

1b407fe

2011-03-20 10:44:30 +0800

[diff] [blame]

112

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"

113

"http://www.w3.org/TR/html4/strict.dtd">

Ezio Melotti

2011-11-02 19:33:29 +0200

[diff] [blame]

114

<html>

Senthil Kumaran

b253c9f

2011-03-17 16:43:22 +0800

[diff] [blame]

115

<head>

Senthil Kumaran

1b407fe

2011-03-20 10:44:30 +0800

[diff] [blame]

116

Senthil Kumaran

b253c9f

2011-03-17 16:43:22 +0800

[diff] [blame]

117

<title>Error response</title>

118

</head>

119

<body>

120

<h1>Error response</h1>

121

<p>Error code: %(code)d</p>

122

<p>Message: %(message)s.</p>

123

<p>Error code explanation: %(code)s - %(explain)s.</p>

124

</body>

125

</html>

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

126

"""

127

128

DEFAULT_ERROR_CONTENT_TYPE = "text/html;charset=utf-8"

129

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

130

class HTTPServer(socketserver.TCPServer):

131

132

allow_reuse_address = 1 # Seems to make sense in testing environment

133

134

def server_bind(self):

135

"""Override server_bind to store the server name."""

136

socketserver.TCPServer.server_bind(self)

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

137

host, port = self.server_address[:2]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

138

self.server_name = socket.getfqdn(host)

139

self.server_port = port

140

141

142

class BaseHTTPRequestHandler(socketserver.StreamRequestHandler):

143

144

"""HTTP request handler base class.

145

146

The following explanation of HTTP serves to guide you through the

147

code as well as to expose any misunderstandings I may have about

148

HTTP (so you don't need to read the code to figure out I'm wrong

149

:-).

150

151

HTTP (HyperText Transfer Protocol) is an extensible protocol on

152

top of a reliable stream transport (e.g. TCP/IP). The protocol

153

recognizes three parts to a request:

154

155

1. One line identifying the request type and path

156

2. An optional set of RFC-822-style headers

157

3. An optional data part

158

159

The headers and data are separated by a blank line.

160

161

The first line of the request has the form

where <command> is a (case-sensitive) keyword such as GET or POST,

166

<path> is a string containing path information for the request,

167

and <version> should be the string "HTTP/1.0" or "HTTP/1.1".

168

<path> is encoded using the URL encoding scheme (using %xx to signify

169

the ASCII character with hex code xx).

170

171

The specification specifies that lines are separated by CRLF but

172

for compatibility with the widest range of clients recommends

173

servers also handle LF. Similarly, whitespace in the request line

174

is treated sensibly (allowing multiple spaces between components

175

and allowing trailing whitespace).

176

177

Similarly, for output, lines ought to be separated by CRLF pairs

178

but most clients grok LF characters just fine.

179

180

If the first line of the request has the form

(i.e. <version> is left out) then this is assumed to be an HTTP

185

0.9 request; this form has no optional headers and data part and

186

the reply consists of just the data.

187

188

The reply form of the HTTP 1.x protocol again has three parts:

189

190

1. One line giving the response code

191

2. An optional set of RFC-822-style headers

192

3. The data

193

194

Again, the headers and data are separated by a blank line.

195

196

The response code line has the form

where <version> is the protocol version ("HTTP/1.0" or "HTTP/1.1"),

201

<responsecode> is a 3-digit response code indicating success or

202

failure of the request, and <responsestring> is an optional

203

human-readable string explaining what the response code means.

204

205

This server parses the request and the headers, and then calls a

206

function specific to the request type (<command>). Specifically,

207

a request SPAM will be handled by a method do_SPAM(). If no

208

such method exists the server sends an error response to the

209

client. If it exists, it is called with no arguments:

do_SPAM()

Note that the request name is case sensitive (i.e. SPAM and spam

214

are different requests).

215

216

The various request details are stored in instance variables:

217

218

- client_address is the client IP address in the form (host,

219

port);

220

221

- command, path and version are the broken-down request line;

222

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

223

- headers is an instance of email.message.Message (or a derived

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

224

class) containing the header information;

225

226

- rfile is a file object open for reading positioned at the

227

start of the optional input data part;

228

229

- wfile is a file object open for writing.

230

231

IT IS IMPORTANT TO ADHERE TO THE PROTOCOL FOR WRITING!

232

233

The first thing to be written must be the response line. Then

234

follow 0 or more header lines, then a blank line, and then the

235

actual data (if any). The meaning of the header lines depends on

236

the command executed by the server; in most cases, when data is

237

returned, there should be at least one header line of the form

238

239

Content-type: <type>/<subtype>

240

241

where <type> and <subtype> should be registered MIME types,

242

e.g. "text/html" or "text/plain".

"""

# The Python system version, truncated to its first component.

247

sys_version = "Python/" + sys.version.split()[0]

248

249

# The server software version. You may want to override this.

250

# The format is multiple whitespace-separated strings,

251

# where each string is of the form name[/version].

252

server_version = "BaseHTTP/" + __version__

253

254

error_message_format = DEFAULT_ERROR_MESSAGE

255

error_content_type = DEFAULT_ERROR_CONTENT_TYPE

256

257

# The default request version. This only affects responses up until

258

# the point where the request line is parsed, so it mainly decides what

259

# the client gets back when sending a malformed request line.

260

# Most web servers default to HTTP 0.9, i.e. don't send a status line.

261

default_request_version = "HTTP/0.9"

262

263

def parse_request(self):

264

"""Parse a request (internal).

265

266

The request should be stored in self.raw_requestline; the results

267

are in self.command, self.path, self.request_version and

268

self.headers.

269

Martin Panter

2016-11-19 01:06:37 +0000

[diff] [blame]

270

Return True for success, False for failure; on failure, any relevant

271

error response has already been sent back.

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

272

273

"""

274

self.command = None # set in case of error on the first line

275

self.request_version = version = self.default_request_version

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

276

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

277

requestline = str(self.raw_requestline, 'iso-8859-1')

Senthil Kumaran

3075549

2011-12-23 17:03:41 +0800

[diff] [blame]

278

requestline = requestline.rstrip('\r\n')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

279

self.requestline = requestline

280

words = requestline.split()

Martin Panter

2016-11-19 01:06:37 +0000

[diff] [blame]

if len(words) == 0:

return False

if len(words) >= 3: # Enough to determine protocol version

285

version = words[-1]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

286

try:

Martin Panter

2016-11-19 01:06:37 +0000

[diff] [blame]

287

if not version.startswith('HTTP/'):

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

288

raise ValueError

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

289

base_version_number = version.split('/', 1)[1]

290

version_number = base_version_number.split(".")

291

# RFC 2145 section 3.1 says there can be only one "." and

292

# - major and minor numbers MUST be treated as

293

# separate integers;

294

# - HTTP/2.4 is a lower version than HTTP/2.13, which in

295

# turn is lower than HTTP/12.3;

296

# - Leading zeros MUST be ignored by recipients.

297

if len(version_number) != 2:

298

raise ValueError

299

version_number = int(version_number[0]), int(version_number[1])

300

except (ValueError, IndexError):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

301

self.send_error(

302

HTTPStatus.BAD_REQUEST,

303

"Bad request version (%r)" % version)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

304

return False

305

if version_number >= (1, 1) and self.protocol_version >= "HTTP/1.1":

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

306

self.close_connection = False

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

307

if version_number >= (2, 0):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

308

self.send_error(

309

HTTPStatus.HTTP_VERSION_NOT_SUPPORTED,

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

310

"Invalid HTTP version (%s)" % base_version_number)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

311

return False

Martin Panter

2016-11-19 01:06:37 +0000

[diff] [blame]

312

self.request_version = version

313

314

if not 2 <= len(words) <= 3:

315

self.send_error(

316

HTTPStatus.BAD_REQUEST,

317

"Bad request syntax (%r)" % requestline)

318

return False

319

command, path = words[:2]

320

if len(words) == 2:

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

321

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

322

if command != 'GET':

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

323

self.send_error(

324

HTTPStatus.BAD_REQUEST,

325

"Bad HTTP/0.9 request type (%r)" % command)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

326

return False

Martin Panter

2016-11-19 01:06:37 +0000

[diff] [blame]

327

self.command, self.path = command, path

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

328

329

# Examine the headers and look for a Connection directive.

Senthil Kumaran

5466bf1

2010-12-18 16:55:23 +0000

[diff] [blame]

330

try:

331

self.headers = http.client.parse_headers(self.rfile,

332

_class=self.MessageClass)

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

333

except http.client.LineTooLong as err:

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

334

self.send_error(

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

335

HTTPStatus.REQUEST_HEADER_FIELDS_TOO_LARGE,

336

"Line too long",

337

str(err))

Senthil Kumaran

5466bf1

2010-12-18 16:55:23 +0000

[diff] [blame]

338

return False

Martin Panter

acc0319

2016-04-03 00:45:46 +0000

[diff] [blame]

339

except http.client.HTTPException as err:

340

self.send_error(

341

HTTPStatus.REQUEST_HEADER_FIELDS_TOO_LARGE,

"Too many headers",

str(err)

)

return False

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

346

347

conntype = self.headers.get('Connection', "")

348

if conntype.lower() == 'close':

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

349

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

350

elif (conntype.lower() == 'keep-alive' and

351

self.protocol_version >= "HTTP/1.1"):

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

352

self.close_connection = False

Senthil Kumaran

0f476d4

2010-09-30 06:09:18 +0000

[diff] [blame]

353

# Examine the headers and look for an Expect directive

354

expect = self.headers.get('Expect', "")

355

if (expect.lower() == "100-continue" and

356

self.protocol_version >= "HTTP/1.1" and

357

self.request_version >= "HTTP/1.1"):

358

if not self.handle_expect_100():

return False

return True

def handle_expect_100(self):

363

"""Decide what to do with an "Expect: 100-continue" header.

364

365

If the client is expecting a 100 Continue response, we must

366

respond with either a 100 Continue or a final response before

367

waiting for the request body. The default is to always respond

368

with a 100 Continue. You can behave differently (for example,

369

reject unauthorized requests) by overriding this method.

370

371

This method should either return True (possibly after sending

372

a 100 Continue response) or send an error response and return

373

False.

374

375

"""

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

376

self.send_response_only(HTTPStatus.CONTINUE)

Benjamin Peterson

0442423

2014-01-18 21:50:18 -0500

[diff] [blame]

377

self.end_headers()

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

378

return True

379

380

def handle_one_request(self):

381

"""Handle a single HTTP request.

382

383

You normally don't need to override this method; see the class

384

__doc__ string for information on how to handle specific HTTP

385

commands such as GET and POST.

386

387

"""

Kristján Valur Jónsson

2009-07-01 10:01:31 +0000

[diff] [blame]

388

try:

Antoine Pitrou

c492437

2010-12-16 16:48:36 +0000

[diff] [blame]

389

self.raw_requestline = self.rfile.readline(65537)

390

if len(self.raw_requestline) > 65536:

391

self.requestline = ''

392

self.request_version = ''

393

self.command = ''

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

394

self.send_error(HTTPStatus.REQUEST_URI_TOO_LONG)

Antoine Pitrou

c492437

2010-12-16 16:48:36 +0000

[diff] [blame]

395

return

Kristján Valur Jónsson

2009-07-01 10:01:31 +0000

[diff] [blame]

396

if not self.raw_requestline:

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

397

self.close_connection = True

Kristján Valur Jónsson

2009-07-01 10:01:31 +0000

[diff] [blame]

398

return

399

if not self.parse_request():

400

# An error code has been sent, just exit

401

return

402

mname = 'do_' + self.command

403

if not hasattr(self, mname):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

404

self.send_error(

405

HTTPStatus.NOT_IMPLEMENTED,

406

"Unsupported method (%r)" % self.command)

Kristján Valur Jónsson

2009-07-01 10:01:31 +0000

[diff] [blame]

407

return

408

method = getattr(self, mname)

409

method()

410

self.wfile.flush() #actually send the response if not already done.

411

except socket.timeout as e:

412

#a read or a write timed out. Discard this connection

413

self.log_error("Request timed out: %r", e)

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

414

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

415

return

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

416

417

def handle(self):

418

"""Handle multiple requests if necessary."""

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

419

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

420

421

self.handle_one_request()

422

while not self.close_connection:

423

self.handle_one_request()

424

Senthil Kumaran

2688644

2013-03-15 07:53:21 -0700

[diff] [blame]

425

def send_error(self, code, message=None, explain=None):

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

426

"""Send and log an error reply.

427

Senthil Kumaran

2688644

2013-03-15 07:53:21 -0700

[diff] [blame]

428

Arguments are

429

* code: an HTTP error code

430

3 digits

431

* message: a simple optional 1 line reason phrase.

432

*( HTAB / SP / VCHAR / %x80-FF )

433

defaults to short entry matching the response code

434

* explain: a detailed message defaults to the long entry

435

matching the response code.

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

436

437

This sends an error response (so it must be called before any

438

output has been generated), logs the error, and finally sends

439

a piece of HTML explaining the error to the user.

"""

try:

shortmsg, longmsg = self.responses[code]

445

except KeyError:

446

shortmsg, longmsg = '???', '???'

447

if message is None:

448

message = shortmsg

Senthil Kumaran

2688644

2013-03-15 07:53:21 -0700

[diff] [blame]

449

if explain is None:

450

explain = longmsg

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

451

self.log_error("code %d, message %s", code, message)

Senthil Kumaran

1e7551d

2013-03-05 02:25:58 -0800

[diff] [blame]

452

self.send_response(code, message)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

453

self.send_header('Connection', 'close')

Martin Panter

e42e129

2016-06-08 08:29:13 +0000

[diff] [blame]

454

455

# Message body is omitted for cases described in:

456

# - RFC7230: 3.3. 1xx, 204(No Content), 304(Not Modified)

457

# - RFC7231: 6.3.6. 205(Reset Content)

458

body = None

459

if (code >= 200 and

460

code not in (HTTPStatus.NO_CONTENT,

461

HTTPStatus.RESET_CONTENT,

462

HTTPStatus.NOT_MODIFIED)):

463

# HTML encode to prevent Cross Site Scripting attacks

464

# (see bug #1100201)

465

content = (self.error_message_format % {

466

'code': code,

Martin Panter

40de69a

2016-06-08 09:45:58 +0000

[diff] [blame]

467

'message': html.escape(message, quote=False),

468

'explain': html.escape(explain, quote=False)

Martin Panter

e42e129

2016-06-08 08:29:13 +0000

[diff] [blame]

469

})

470

body = content.encode('UTF-8', 'replace')

471

self.send_header("Content-Type", self.error_content_type)

472

self.send_header('Content-Length', int(len(body)))

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

473

self.end_headers()

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

474

Martin Panter

e42e129

2016-06-08 08:29:13 +0000

[diff] [blame]

475

if self.command != 'HEAD' and body:

Senthil Kumaran

52d2720

2012-10-10 23:16:21 -0700

[diff] [blame]

476

self.wfile.write(body)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

477

478

def send_response(self, code, message=None):

Senthil Kumaran

2011-05-09 23:25:02 +0800

[diff] [blame]

479

"""Add the response header to the headers buffer and log the

480

response code.

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

481

482

Also send two standard headers with the server software

483

version and the current date.

484

485

"""

486

self.log_request(code)

Senthil Kumaran

0f476d4

2010-09-30 06:09:18 +0000

[diff] [blame]

487

self.send_response_only(code, message)

488

self.send_header('Server', self.version_string())

489

self.send_header('Date', self.date_time_string())

490

491

def send_response_only(self, code, message=None):

492

"""Send the response header only."""

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

493

if self.request_version != 'HTTP/0.9':

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

494

if message is None:

495

if code in self.responses:

496

message = self.responses[code][0]

497

else:

498

message = ''

Senthil Kumaran

2011-05-09 23:25:02 +0800

[diff] [blame]

499

if not hasattr(self, '_headers_buffer'):

500

self._headers_buffer = []

501

self._headers_buffer.append(("%s %d %s\r\n" %

502

(self.protocol_version, code, message)).encode(

503

'latin-1', 'strict'))

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

504

505

def send_header(self, keyword, value):

Senthil Kumaran

2011-05-09 23:25:02 +0800

[diff] [blame]

506

"""Send a MIME header to the headers buffer."""

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

507

if self.request_version != 'HTTP/0.9':

Senthil Kumaran

e4dad4f

2010-11-21 14:36:14 +0000

[diff] [blame]

508

if not hasattr(self, '_headers_buffer'):

509

self._headers_buffer = []

510

self._headers_buffer.append(

Marc-André Lemburg

8f36af7

2011-02-25 15:42:01 +0000

[diff] [blame]

511

("%s: %s\r\n" % (keyword, value)).encode('latin-1', 'strict'))

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

512

513

if keyword.lower() == 'connection':

514

if value.lower() == 'close':

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

515

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

516

elif value.lower() == 'keep-alive':

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

517

self.close_connection = False

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

518

519

def end_headers(self):

520

"""Send the blank line ending the MIME headers."""

521

if self.request_version != 'HTTP/0.9':

Senthil Kumaran

e4dad4f

2010-11-21 14:36:14 +0000

[diff] [blame]

522

self._headers_buffer.append(b"\r\n")

Senthil Kumaran

2011-05-09 23:25:02 +0800

[diff] [blame]

523

self.flush_headers()

524

525

def flush_headers(self):

526

if hasattr(self, '_headers_buffer'):

Senthil Kumaran

e4dad4f

2010-11-21 14:36:14 +0000

[diff] [blame]

527

self.wfile.write(b"".join(self._headers_buffer))

528

self._headers_buffer = []

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

529

530

def log_request(self, code='-', size='-'):

531

"""Log an accepted request.

532

533

This is called by send_response().

534

535

"""

Serhiy Storchaka

c0a23e6

2015-03-07 11:51:37 +0200

[diff] [blame]

536

if isinstance(code, HTTPStatus):

537

code = code.value

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

538

self.log_message('"%s" %s %s',

539

self.requestline, str(code), str(size))

540

541

def log_error(self, format, *args):

542

"""Log an error.

543

544

This is called when a request cannot be fulfilled. By

545

default it passes the message on to log_message().

546

547

Arguments are the same as for log_message().

548

549

XXX This should go to the separate error log.

"""

self.log_message(format, *args)

554

555

def log_message(self, format, *args):

556

"""Log an arbitrary message.

557

558

This is used by all other logging functions. Override

559

it if you have specific logging wishes.

560

561

The first argument, FORMAT, is a format string for the

562

message to be logged. If the format string contains

563

any % escapes requiring parameters, they should be

564

specified as subsequent arguments (it's just like

565

printf!).

566

Senthil Kumaran

db727b4

2012-04-29 13:41:03 +0800

[diff] [blame]

567

The client ip and current date/time are prefixed to

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

every message.

"""

sys.stderr.write("%s - - [%s] %s\n" %

573

(self.address_string(),

574

self.log_date_time_string(),

575

format%args))

576

577

def version_string(self):

578

"""Return the server software version string."""

579

return self.server_version + ' ' + self.sys_version

580

581

def date_time_string(self, timestamp=None):

582

"""Return the current date and time formatted for a message header."""

583

if timestamp is None:

584

timestamp = time.time()

Berker Peksag

04bc5b9

2016-03-14 06:06:03 +0200

[diff] [blame]

585

return email.utils.formatdate(timestamp, usegmt=True)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

586

587

def log_date_time_string(self):

588

"""Return the current time formatted for logging."""

589

now = time.time()

590

year, month, day, hh, mm, ss, x, y, z = time.localtime(now)

591

s = "%02d/%3s/%04d %02d:%02d:%02d" % (

592

day, self.monthname[month], year, hh, mm, ss)

593

return s

594

595

weekdayname = ['Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat', 'Sun']

596

597

monthname = [None,

598

'Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun',

599

'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec']

600

601

def address_string(self):

Senthil Kumaran

1aacba4

2012-04-29 12:51:54 +0800

[diff] [blame]

602

"""Return the client address."""

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

603

Senthil Kumaran

1aacba4

2012-04-29 12:51:54 +0800

[diff] [blame]

604

return self.client_address[0]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

605

606

# Essentially static class variables

607

608

# The version of the HTTP protocol we support.

609

# Set this to HTTP/1.1 to enable automatic keepalive

610

protocol_version = "HTTP/1.0"

611

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

612

# MessageClass used to parse headers

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

613

MessageClass = http.client.HTTPMessage

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

614

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

615

# hack to maintain backwards compatibility

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

616

responses = {

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

617

v: (v.phrase, v.description)

618

for v in HTTPStatus.__members__.values()

619

}

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

620

621

622

class SimpleHTTPRequestHandler(BaseHTTPRequestHandler):

623

624

"""Simple HTTP request handler with GET and HEAD commands.

625

626

This serves files from the current directory and any of its

627

subdirectories. The MIME type for files is determined by

628

calling the .guess_type() method.

629

630

The GET and HEAD requests are identical except that the HEAD

631

request omits the actual contents of the file.

"""

server_version = "SimpleHTTP/" + __version__

636

637

def do_GET(self):

638

"""Serve a GET request."""

639

f = self.send_head()

640

if f:

Serhiy Storchaka

91b0bc2

2014-01-25 19:43:02 +0200

[diff] [blame]

641

try:

642

self.copyfile(f, self.wfile)

643

finally:

644

f.close()

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

645

646

def do_HEAD(self):

647

"""Serve a HEAD request."""

f = self.send_head()

if f:

f.close()

def send_head(self):

"""Common code for GET and HEAD commands.

654

655

This sends the response code and MIME headers.

656

657

Return value is either a file object (which has to be copied

658

to the outputfile by the caller unless the command was HEAD,

659

and must be closed by the caller under all circumstances), or

660

None, in which case the caller has nothing further to do.

661

662

"""

663

path = self.translate_path(self.path)

664

f = None

665

if os.path.isdir(path):

Benjamin Peterson

94cb7a2

2014-12-26 10:53:43 -0600

[diff] [blame]

666

parts = urllib.parse.urlsplit(self.path)

667

if not parts.path.endswith('/'):

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

668

# redirect browser - doing basically what apache does

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

669

self.send_response(HTTPStatus.MOVED_PERMANENTLY)

Benjamin Peterson

94cb7a2

2014-12-26 10:53:43 -0600

[diff] [blame]

670

new_parts = (parts[0], parts[1], parts[2] + '/',

671

parts[3], parts[4])

672

new_url = urllib.parse.urlunsplit(new_parts)

673

self.send_header("Location", new_url)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

674

self.end_headers()

675

return None

676

for index in "index.html", "index.htm":

677

index = os.path.join(path, index)

678

if os.path.exists(index):

path = index

break

else:

return self.list_directory(path)

683

ctype = self.guess_type(path)

684

try:

685

f = open(path, 'rb')

Andrew Svetlov

f7a17b4

2012-12-25 16:47:37 +0200

[diff] [blame]

686

except OSError:

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

687

self.send_error(HTTPStatus.NOT_FOUND, "File not found")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

688

return None

Serhiy Storchaka

91b0bc2

2014-01-25 19:43:02 +0200

[diff] [blame]

689

try:

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

690

self.send_response(HTTPStatus.OK)

Serhiy Storchaka

91b0bc2

2014-01-25 19:43:02 +0200

[diff] [blame]

691

self.send_header("Content-type", ctype)

692

fs = os.fstat(f.fileno())

693

self.send_header("Content-Length", str(fs[6]))

694

self.send_header("Last-Modified", self.date_time_string(fs.st_mtime))

self.end_headers()

return f

except:

f.close()

raise

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

700

701

def list_directory(self, path):

702

"""Helper to produce a directory listing (absent index.html).

703

704

Return value is either a file object, or None (indicating an

705

error). In either case, the headers are sent, making the

706

interface the same as for send_head().

"""

try:

list = os.listdir(path)

Andrew Svetlov

ad28c7f

2012-12-18 22:02:39 +0200

[diff] [blame]

711

except OSError:

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

712

self.send_error(

713

HTTPStatus.NOT_FOUND,

714

"No permission to list directory")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

715

return None

716

list.sort(key=lambda a: a.lower())

717

r = []

Serhiy Storchaka

2014-08-17 08:22:11 +0300

[diff] [blame]

718

try:

719

displaypath = urllib.parse.unquote(self.path,

720

errors='surrogatepass')

721

except UnicodeDecodeError:

722

displaypath = urllib.parse.unquote(path)

Martin Panter

da3bb38

2016-04-11 00:40:08 +0000

[diff] [blame]

723

displaypath = html.escape(displaypath, quote=False)

Ezio Melotti

2011-11-02 19:33:29 +0200

[diff] [blame]

724

enc = sys.getfilesystemencoding()

725

title = 'Directory listing for %s' % displaypath

726

r.append('<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" '

727

'"http://www.w3.org/TR/html4/strict.dtd">')

728

r.append('<html>\n<head>')

729

r.append('<meta http-equiv="Content-Type" '

730

'content="text/html; charset=%s">' % enc)

731

r.append('<title>%s</title>\n</head>' % title)

732

r.append('<body>\n<h1>%s</h1>' % title)

733

r.append('<hr>\n<ul>')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

734

for name in list:

735

fullname = os.path.join(path, name)

736

displayname = linkname = name

737

# Append / for directories or @ for symbolic links

738

if os.path.isdir(fullname):

739

displayname = name + "/"

740

linkname = name + "/"

741

if os.path.islink(fullname):

742

displayname = name + "@"

743

# Note: a link to a directory displays with @ and links with /

Ezio Melotti

2011-11-02 19:33:29 +0200

[diff] [blame]

744

r.append('<li><a href="%s">%s</a></li>'

Serhiy Storchaka

2014-08-17 08:22:11 +0300

[diff] [blame]

745

% (urllib.parse.quote(linkname,

746

errors='surrogatepass'),

Martin Panter

da3bb38

2016-04-11 00:40:08 +0000

[diff] [blame]

747

html.escape(displayname, quote=False)))

Ezio Melotti

2011-11-02 19:33:29 +0200

[diff] [blame]

748

r.append('</ul>\n<hr>\n</body>\n</html>\n')

Serhiy Storchaka

2014-08-17 08:22:11 +0300

[diff] [blame]

749

encoded = '\n'.join(r).encode(enc, 'surrogateescape')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

750

f = io.BytesIO()

751

f.write(encoded)

752

f.seek(0)

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

753

self.send_response(HTTPStatus.OK)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

754

self.send_header("Content-type", "text/html; charset=%s" % enc)

755

self.send_header("Content-Length", str(len(encoded)))

self.end_headers()

return f

def translate_path(self, path):

760

"""Translate a /-separated PATH to the local filename syntax.

761

762

Components that mean special things to the local file system

763

(e.g. drive or directory names) are ignored. (XXX They should

764

probably be diagnosed.)

765

766

"""

767

# abandon query parameters

768

path = path.split('?',1)[0]

769

path = path.split('#',1)[0]

Senthil Kumaran

72c238e

2013-09-13 00:21:18 -0700

[diff] [blame]

770

# Don't forget explicit trailing slash when normalizing. Issue17324

Senthil Kumaran

600b735

2013-09-29 18:59:04 -0700

[diff] [blame]

771

trailing_slash = path.rstrip().endswith('/')

Serhiy Storchaka

2014-08-17 08:22:11 +0300

[diff] [blame]

772

try:

773

path = urllib.parse.unquote(path, errors='surrogatepass')

774

except UnicodeDecodeError:

775

path = urllib.parse.unquote(path)

776

path = posixpath.normpath(path)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

777

words = path.split('/')

778

words = filter(None, words)

779

path = os.getcwd()

780

for word in words:

Martin Panter

d274b3f

2016-04-18 03:45:18 +0000

[diff] [blame]

781

if os.path.dirname(word) or word in (os.curdir, os.pardir):

782

# Ignore components that are not a simple file/directory name

783

continue

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

784

path = os.path.join(path, word)

Senthil Kumaran

72c238e

2013-09-13 00:21:18 -0700

[diff] [blame]

785

if trailing_slash:

786

path += '/'

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

787

return path

788

789

def copyfile(self, source, outputfile):

790

"""Copy all data between two file objects.

791

792

The SOURCE argument is a file object open for reading

793

(or anything with a read() method) and the DESTINATION

794

argument is a file object open for writing (or

795

anything with a write() method).

796

797

The only reason for overriding this would be to change

798

the block size or perhaps to replace newlines by CRLF

799

-- note however that this the default server uses this

800

to copy binary data as well.

801

802

"""

803

shutil.copyfileobj(source, outputfile)

804

805

def guess_type(self, path):

806

"""Guess the type of a file.

807

808

Argument is a PATH (a filename).

809

810

Return value is a string of the form type/subtype,

811

usable for a MIME Content-type header.

812

813

The default implementation looks the file's extension

814

up in the table self.extensions_map, using application/octet-stream

815

as a default; however it would be permissible (if

816

slow) to look inside the data to make a better guess.

"""

base, ext = posixpath.splitext(path)

821

if ext in self.extensions_map:

822

return self.extensions_map[ext]

823

ext = ext.lower()

824

if ext in self.extensions_map:

825

return self.extensions_map[ext]

826

else:

827

return self.extensions_map['']

828

829

if not mimetypes.inited:

830

mimetypes.init() # try to read system mime.types

831

extensions_map = mimetypes.types_map.copy()

832

extensions_map.update({

833

'': 'application/octet-stream', # Default

'.py': 'text/plain',

'.c': 'text/plain',

'.h': 'text/plain',

})

# Utilities for CGIHTTPRequestHandler

841

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

842

def _url_collapse_path(path):

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

843

"""

844

Given a URL path, remove extra '/'s and '.' path elements and collapse

Martin Panter

9955a37

2015-10-07 10:26:23 +0000

[diff] [blame]

845

any '..' references and returns a collapsed path.

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

846

847

Implements something akin to RFC-2396 5.2 step 6 to parse relative paths.

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

848

The utility of this function is limited to is_cgi method and helps

849

preventing some security attacks.

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

850

Martin Panter

2015-10-03 05:55:46 +0000

[diff] [blame]

851

Returns: The reconstituted URL, which will always start with a '/'.

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

852

853

Raises: IndexError if too many '..' occur within the path.

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

854

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

855

"""

Martin Panter

2015-10-03 05:55:46 +0000

[diff] [blame]

856

# Query component should not be involved.

857

path, _, query = path.partition('?')

858

path = urllib.parse.unquote(path)

859

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

860

# Similar to os.path.split(os.path.normpath(path)) but specific to URL

861

# path semantics rather than local operating system semantics.

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

862

path_parts = path.split('/')

863

head_parts = []

864

for part in path_parts[:-1]:

865

if part == '..':

866

head_parts.pop() # IndexError if more '..' than prior parts

867

elif part and part != '.':

868

head_parts.append( part )

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

869

if path_parts:

Senthil Kumaran

dbb369d

2012-04-11 03:15:28 +0800

[diff] [blame]

870

tail_part = path_parts.pop()

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

871

if tail_part:

872

if tail_part == '..':

873

head_parts.pop()

874

tail_part = ''

875

elif tail_part == '.':

876

tail_part = ''

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

877

else:

878

tail_part = ''

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

879

Martin Panter

2015-10-03 05:55:46 +0000

[diff] [blame]

880

if query:

881

tail_part = '?'.join((tail_part, query))

882

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

883

splitpath = ('/' + '/'.join(head_parts), tail_part)

884

collapsed_path = "/".join(splitpath)

885

886

return collapsed_path

887

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

888

889

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

nobody = None

def nobody_uid():

"""Internal routine to get nobody's uid"""

global nobody

if nobody:

return nobody

try:

import pwd

Brett Cannon

cd171c8

2013-07-04 17:43:24 -0400

[diff] [blame]

899

except ImportError:

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

900

return -1

901

try:

902

nobody = pwd.getpwnam('nobody')[2]

903

except KeyError:

Georg Brandl

cbd2ab1

2010-12-04 10:39:14 +0000

[diff] [blame]

904

nobody = 1 + max(x[2] for x in pwd.getpwall())

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

return nobody

def executable(path):

909

"""Test for executable file."""

Victor Stinner

fb25ba9

2011-06-20 17:45:54 +0200

[diff] [blame]

910

return os.access(path, os.X_OK)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

911

912

913

class CGIHTTPRequestHandler(SimpleHTTPRequestHandler):

914

915

"""Complete HTTP server with GET, HEAD and POST commands.

916

917

GET and HEAD also support running CGI scripts.

918

919

The POST command is *only* implemented for CGI scripts.

"""

# Determine platform specifics

924

have_fork = hasattr(os, 'fork')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

925

926

# Make rfile unbuffered -- we need to read one line and then pass

927

# the rest to a subprocess, so we can't use buffered input.

rbufsize = 0

def do_POST(self):

"""Serve a POST request.

932

933

This is only implemented for CGI scripts.

"""

if self.is_cgi():

self.run_cgi()

else:

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

940

self.send_error(

941

HTTPStatus.NOT_IMPLEMENTED,

942

"Can only POST to CGI scripts")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

943

944

def send_head(self):

945

"""Version of send_head that support CGI scripts"""

946

if self.is_cgi():

947

return self.run_cgi()

948

else:

949

return SimpleHTTPRequestHandler.send_head(self)

950

951

def is_cgi(self):

952

"""Test whether self.path corresponds to a CGI script.

953

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

954

Returns True and updates the cgi_info attribute to the tuple

955

(dir, rest) if self.path requires running a CGI script.

956

Returns False otherwise.

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

957

Benjamin Peterson

a7deeee

2009-05-08 20:54:42 +0000

[diff] [blame]

958

If any exception is raised, the caller should assume that

959

self.path was rejected as invalid and act accordingly.

960

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

961

The default implementation tests whether the normalized url

962

path begins with one of the strings in self.cgi_directories

963

(and the next character is a '/' or the end of the string).

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

964

965

"""

Martin Panter

2015-10-03 05:55:46 +0000

[diff] [blame]

966

collapsed_path = _url_collapse_path(self.path)

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

967

dir_sep = collapsed_path.find('/', 1)

968

head, tail = collapsed_path[:dir_sep], collapsed_path[dir_sep+1:]

Senthil Kumaran

dbb369d

2012-04-11 03:15:28 +0800

[diff] [blame]

969

if head in self.cgi_directories:

970

self.cgi_info = head, tail

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

971

return True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

972

return False

973

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

974

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

975

cgi_directories = ['/cgi-bin', '/htbin']

976

977

def is_executable(self, path):

978

"""Test whether argument path is an executable file."""

979

return executable(path)

980

981

def is_python(self, path):

982

"""Test whether argument path is a Python script."""

983

head, tail = os.path.splitext(path)

984

return tail.lower() in (".py", ".pyw")

985

986

def run_cgi(self):

987

"""Execute a CGI script."""

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

988

dir, rest = self.cgi_info

Ned Deily

915a30f

2014-07-12 22:06:26 -0700

[diff] [blame]

989

path = dir + '/' + rest

990

i = path.find('/', len(dir)+1)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

991

while i >= 0:

Ned Deily

915a30f

2014-07-12 22:06:26 -0700

[diff] [blame]

992

nextdir = path[:i]

993

nextrest = path[i+1:]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

994

995

scriptdir = self.translate_path(nextdir)

996

if os.path.isdir(scriptdir):

997

dir, rest = nextdir, nextrest

Ned Deily

915a30f

2014-07-12 22:06:26 -0700

[diff] [blame]

998

i = path.find('/', len(dir)+1)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

else:

break

# find an explicit query string, if present.

Martin Panter

a02e18a

2015-10-03 05:38:07 +0000

[diff] [blame]

1003

rest, _, query = rest.partition('?')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1004

1005

# dissect the part after the directory name into a script name &

1006

# a possible additional path, to be stored in PATH_INFO.

1007

i = rest.find('/')

1008

if i >= 0:

1009

script, rest = rest[:i], rest[i:]

1010

else:

1011

script, rest = rest, ''

1012

1013

scriptname = dir + '/' + script

1014

scriptfile = self.translate_path(scriptname)

1015

if not os.path.exists(scriptfile):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

1016

self.send_error(

1017

HTTPStatus.NOT_FOUND,

1018

"No such CGI script (%r)" % scriptname)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1019

return

1020

if not os.path.isfile(scriptfile):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

1021

self.send_error(

1022

HTTPStatus.FORBIDDEN,

1023

"CGI script is not a plain file (%r)" % scriptname)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1024

return

1025

ispy = self.is_python(scriptname)

Victor Stinner

fb25ba9

2011-06-20 17:45:54 +0200

[diff] [blame]

1026

if self.have_fork or not ispy:

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1027

if not self.is_executable(scriptfile):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

1028

self.send_error(

1029

HTTPStatus.FORBIDDEN,

1030

"CGI script is not executable (%r)" % scriptname)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1031

return

1032

1033

# Reference: http://hoohoo.ncsa.uiuc.edu/cgi/env.html

1034

# XXX Much of the following could be prepared ahead of time!

Senthil Kumaran

2010-10-03 17:55:45 +0000

[diff] [blame]

1035

env = copy.deepcopy(os.environ)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1036

env['SERVER_SOFTWARE'] = self.version_string()

1037

env['SERVER_NAME'] = self.server.server_name

1038

env['GATEWAY_INTERFACE'] = 'CGI/1.1'

1039

env['SERVER_PROTOCOL'] = self.protocol_version

1040

env['SERVER_PORT'] = str(self.server.server_port)

1041

env['REQUEST_METHOD'] = self.command

Jeremy Hylton

1afc169

2008-06-18 20:49:58 +0000

[diff] [blame]

1042

uqrest = urllib.parse.unquote(rest)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1043

env['PATH_INFO'] = uqrest

1044

env['PATH_TRANSLATED'] = self.translate_path(uqrest)

1045

env['SCRIPT_NAME'] = scriptname

1046

if query:

1047

env['QUERY_STRING'] = query

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1048

env['REMOTE_ADDR'] = self.client_address[0]

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1049

authorization = self.headers.get("authorization")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1050

if authorization:

1051

authorization = authorization.split()

1052

if len(authorization) == 2:

1053

import base64, binascii

1054

env['AUTH_TYPE'] = authorization[0]

1055

if authorization[0].lower() == "basic":

1056

try:

1057

authorization = authorization[1].encode('ascii')

Georg Brandl

706824f

2009-06-04 09:42:55 +0000

[diff] [blame]

1058

authorization = base64.decodebytes(authorization).\

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1059

decode('ascii')

1060

except (binascii.Error, UnicodeError):

1061

pass

1062

else:

1063

authorization = authorization.split(':')

1064

if len(authorization) == 2:

1065

env['REMOTE_USER'] = authorization[0]

1066

# XXX REMOTE_IDENT

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1067

if self.headers.get('content-type') is None:

1068

env['CONTENT_TYPE'] = self.headers.get_content_type()

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1069

else:

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1070

env['CONTENT_TYPE'] = self.headers['content-type']

1071

length = self.headers.get('content-length')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1072

if length:

1073

env['CONTENT_LENGTH'] = length

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1074

referer = self.headers.get('referer')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1075

if referer:

1076

env['HTTP_REFERER'] = referer

1077

accept = []

1078

for line in self.headers.getallmatchingheaders('accept'):

1079

if line[:1] in "\t\n\r ":

1080

accept.append(line.strip())

1081

else:

1082

accept = accept + line[7:].split(',')

1083

env['HTTP_ACCEPT'] = ','.join(accept)

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1084

ua = self.headers.get('user-agent')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1085

if ua:

1086

env['HTTP_USER_AGENT'] = ua

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1087

co = filter(None, self.headers.get_all('cookie', []))

Georg Brandl

62e2ca2

2010-07-31 21:54:24 +0000

[diff] [blame]

1088

cookie_str = ', '.join(co)

1089

if cookie_str:

1090

env['HTTP_COOKIE'] = cookie_str

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1091

# XXX Other HTTP_* headers

1092

# Since we're setting the env in the parent, provide empty

1093

# values to override previously set values

1094

for k in ('QUERY_STRING', 'REMOTE_HOST', 'CONTENT_LENGTH',

1095

'HTTP_USER_AGENT', 'HTTP_COOKIE', 'HTTP_REFERER'):

1096

env.setdefault(k, "")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1097

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

1098

self.send_response(HTTPStatus.OK, "Script output follows")

Senthil Kumaran

2011-05-09 23:25:02 +0800

[diff] [blame]

1099

self.flush_headers()

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1100

1101

decoded_query = query.replace('+', ' ')

1102

1103

if self.have_fork:

1104

# Unix -- fork as we should

1105

args = [script]

1106

if '=' not in decoded_query:

1107

args.append(decoded_query)

1108

nobody = nobody_uid()

1109

self.wfile.flush() # Always flush before forking

pid = os.fork()

if pid != 0:

# Parent

pid, sts = os.waitpid(pid, 0)

1114

# throw away additional data [see bug #427345]

1115

while select.select([self.rfile], [], [], 0)[0]:

1116

if not self.rfile.read(1):

1117

break

1118

if sts:

1119

self.log_error("CGI script exit status %#x", sts)

return

# Child

try:

try:

os.setuid(nobody)

Andrew Svetlov

ad28c7f

2012-12-18 22:02:39 +0200

[diff] [blame]

1125

except OSError:

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1126

pass

1127

os.dup2(self.rfile.fileno(), 0)

1128

os.dup2(self.wfile.fileno(), 1)

Senthil Kumaran

2010-10-03 17:55:45 +0000

[diff] [blame]

1129

os.execve(scriptfile, args, env)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1130

except:

1131

self.server.handle_error(self.request, self.client_address)

1132

os._exit(127)

1133

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1134

else:

1135

# Non-Unix -- use subprocess

1136

import subprocess

Senthil Kumaran

e29cd16

2009-11-11 04:17:53 +0000

[diff] [blame]

1137

cmdline = [scriptfile]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1138

if self.is_python(scriptfile):

1139

interp = sys.executable

1140

if interp.lower().endswith("w.exe"):

1141

# On Windows, use python.exe, not pythonw.exe

1142

interp = interp[:-5] + interp[-4:]

Senthil Kumaran

e29cd16

2009-11-11 04:17:53 +0000

[diff] [blame]

1143

cmdline = [interp, '-u'] + cmdline

1144

if '=' not in query:

1145

cmdline.append(query)

1146

self.log_message("command: %s", subprocess.list2cmdline(cmdline))

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1147

try:

1148

nbytes = int(length)

1149

except (TypeError, ValueError):

1150

nbytes = 0

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1151

p = subprocess.Popen(cmdline,

1152

stdin=subprocess.PIPE,

1153

stdout=subprocess.PIPE,

Senthil Kumaran

2010-10-03 17:55:45 +0000

[diff] [blame]

1154

stderr=subprocess.PIPE,

1155

env = env

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1156

)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1157

if self.command.lower() == "post" and nbytes > 0:

1158

data = self.rfile.read(nbytes)

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1159

else:

1160

data = None

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1161

# throw away additional data [see bug #427345]

1162

while select.select([self.rfile._sock], [], [], 0)[0]:

1163

if not self.rfile._sock.recv(1):

1164

break

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1165

stdout, stderr = p.communicate(data)

1166

self.wfile.write(stdout)

1167

if stderr:

1168

self.log_error('%s', stderr)

Brian Curtin

cbad4df

2010-11-05 15:04:48 +0000

[diff] [blame]

1169

p.stderr.close()

1170

p.stdout.close()

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1171

status = p.returncode

1172

if status:

1173

self.log_error("CGI script exit status %#x", status)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1174

else:

1175

self.log_message("CGI script exited OK")

1176

1177

Senthil Kumaran

2013-09-15 09:37:27 -0700

[diff] [blame]

1178

def test(HandlerClass=BaseHTTPRequestHandler,

1179

ServerClass=HTTPServer, protocol="HTTP/1.0", port=8000, bind=""):

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1180

"""Test the HTTP request handler class.

1181

Robert Collins

9644f24

2015-08-17 12:18:35 +1200

[diff] [blame]

1182

This runs an HTTP server on port 8000 (or the port argument).

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1183

1184

"""

Senthil Kumaran

2013-09-15 09:37:27 -0700

[diff] [blame]

1185

server_address = (bind, port)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1186

1187

HandlerClass.protocol_version = protocol

Martin Panter

0cab9c1

2016-04-13 00:36:52 +0000

[diff] [blame]

1188

with ServerClass(server_address, HandlerClass) as httpd:

1189

sa = httpd.socket.getsockname()

Berker Peksag

3a31cca

2016-04-29 16:48:11 +0300

[diff] [blame]

1190

serve_message = "Serving HTTP on {host} port {port} (http://{host}:{port}/) ..."

1191

print(serve_message.format(host=sa[0], port=sa[1]))

Martin Panter

0cab9c1

2016-04-13 00:36:52 +0000

[diff] [blame]

1192

try:

1193

httpd.serve_forever()

1194

except KeyboardInterrupt:

1195

print("\nKeyboard interrupt received, exiting.")

1196

sys.exit(0)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1197

1198

if __name__ == '__main__':

Senthil Kumaran

2012-06-03 16:15:54 +0800

[diff] [blame]

1199

parser = argparse.ArgumentParser()

1200

parser.add_argument('--cgi', action='store_true',

1201

help='Run as CGI Server')

Senthil Kumaran

2013-09-15 09:37:27 -0700

[diff] [blame]

1202

parser.add_argument('--bind', '-b', default='', metavar='ADDRESS',

1203

help='Specify alternate bind address '

1204

'[default: all interfaces]')

Senthil Kumaran

2012-06-03 16:15:54 +0800

[diff] [blame]

1205

parser.add_argument('port', action='store',

1206

default=8000, type=int,

1207

nargs='?',

1208

help='Specify alternate port [default: 8000]')

1209

args = parser.parse_args()

1210

if args.cgi:

Senthil Kumaran

2013-09-15 09:37:27 -0700

[diff] [blame]

1211

handler_class = CGIHTTPRequestHandler

Senthil Kumaran

2012-06-03 16:15:54 +0800

[diff] [blame]

1212

else:

Senthil Kumaran