Blame - Lib/http/server.py - platform/external/python/cpython3

2008-05-26 16:32:26 +0000

[diff] [blame]

1

"""HTTP server classes.

2

3

Note: BaseHTTPRequestHandler doesn't implement any HTTP request; see

4

SimpleHTTPRequestHandler for simple implementations of GET, HEAD and POST,

5

and CGIHTTPRequestHandler for CGI scripts.

6

7

It does, however, optionally implement HTTP/1.1 persistent connections,

8

as of version 0.3.

9

10

Notes on CGIHTTPRequestHandler

11

------------------------------

12

13

This class implements GET and POST requests to cgi-bin scripts.

14

15

If the os.fork() function is not present (e.g. on Windows),

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

16

subprocess.Popen() is used as a fallback, with slightly altered semantics.

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

17

18

In all cases, the implementation is intentionally naive -- all

19

requests are executed synchronously.

20

21

SECURITY WARNING: DON'T USE THIS CODE UNLESS YOU ARE INSIDE A FIREWALL

22

-- it may execute arbitrary Python code or external programs.

23

24

Note that status code 200 is sent prior to execution of a CGI script, so

25

scripts cannot send other status codes such as 302 (redirect).

XXX To do:

- log requests even later (to capture byte count)

30

- log user-agent header and other interesting goodies

31

- send error log to separate file

"""

# See also:

#

# HTTP Working Group T. Berners-Lee

38

# INTERNET-DRAFT R. T. Fielding

39

# <draft-ietf-http-v10-spec-00.txt> H. Frystyk Nielsen

40

# Expires September 8, 1995 March 8, 1995

41

#

42

# URL: http://www.ics.uci.edu/pub/ietf/http/draft-ietf-http-v10-spec-00.txt

#

# and

#

# Network Working Group R. Fielding

47

# Request for Comments: 2616 et al

48

# Obsoletes: 2068 June 1999

49

# Category: Standards Track

50

#

51

# URL: http://www.faqs.org/rfcs/rfc2616.html

# Log files

# ---------

#

# Here's a quote from the NCSA httpd docs about log file format.

57

#

58

# | The logfile format is as follows. Each line consists of:

59

# |

60

# | host rfc931 authuser [DD/Mon/YYYY:hh:mm:ss] "request" ddd bbbb

61

# |

62

# | host: Either the DNS name or the IP number of the remote client

63

# | rfc931: Any information returned by identd for this person,

64

# | - otherwise.

65

# | authuser: If user sent a userid for authentication, the user name,

66

# | - otherwise.

67

# | DD: Day

68

# | Mon: Month (calendar name)

69

# | YYYY: Year

70

# | hh: hour (24-hour format, the machine's timezone)

71

# | mm: minutes

72

# | ss: seconds

73

# | request: The first line of the HTTP request as sent by the client.

74

# | ddd: the status code returned by the server, - if not available.

75

# | bbbb: the total number of bytes sent,

76

# | *not including the HTTP/1.0 header*, - if not available

77

# |

78

# | You can determine the name of the file accessed through request.

79

#

80

# (Actually, the latter is only true if you know the server configuration

81

# at the time the request was made!)

__version__ = "0.6"

Berker Peksag

2015-02-13 20:48:15 +0200

[diff] [blame]

85

__all__ = [

86

"HTTPServer", "BaseHTTPRequestHandler",

87

"SimpleHTTPRequestHandler", "CGIHTTPRequestHandler",

88

]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

89

Pierre Quentel

2017-04-02 12:26:12 +0200

[diff] [blame]

90

import copy

91

import datetime

Berker Peksag

04bc5b9

2016-03-14 06:06:03 +0200

[diff] [blame]

92

import email.utils

Georg Brandl

1f7fffb

2010-10-15 15:57:45 +0000

[diff] [blame]

93

import html

Jeremy Hylton

914ab45

2009-03-27 17:16:06 +0000

[diff] [blame]

import http.client

import io

import mimetypes

import os

import posixpath

import select

import shutil

import socket # For gethostbyaddr()

import socketserver

import sys

import time

import urllib.parse

Senthil Kumaran

2012-06-03 16:15:54 +0800

[diff] [blame]

106

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

107

from http import HTTPStatus

108

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

109

110

# Default error message template

111

DEFAULT_ERROR_MESSAGE = """\

Senthil Kumaran

1b407fe

2011-03-20 10:44:30 +0800

[diff] [blame]

112

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"

113

"http://www.w3.org/TR/html4/strict.dtd">

Ezio Melotti

2011-11-02 19:33:29 +0200

[diff] [blame]

114

<html>

Senthil Kumaran

b253c9f

2011-03-17 16:43:22 +0800

[diff] [blame]

115

<head>

Senthil Kumaran

1b407fe

2011-03-20 10:44:30 +0800

[diff] [blame]

116

Senthil Kumaran

b253c9f

2011-03-17 16:43:22 +0800

[diff] [blame]

117

<title>Error response</title>

118

</head>

119

<body>

120

<h1>Error response</h1>

121

<p>Error code: %(code)d</p>

122

<p>Message: %(message)s.</p>

123

<p>Error code explanation: %(code)s - %(explain)s.</p>

124

</body>

125

</html>

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

126

"""

127

128

DEFAULT_ERROR_CONTENT_TYPE = "text/html;charset=utf-8"

129

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

130

class HTTPServer(socketserver.TCPServer):

131

132

allow_reuse_address = 1 # Seems to make sense in testing environment

133

134

def server_bind(self):

135

"""Override server_bind to store the server name."""

136

socketserver.TCPServer.server_bind(self)

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

137

host, port = self.server_address[:2]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

138

self.server_name = socket.getfqdn(host)

139

self.server_port = port

140

141

142

class BaseHTTPRequestHandler(socketserver.StreamRequestHandler):

143

144

"""HTTP request handler base class.

145

146

The following explanation of HTTP serves to guide you through the

147

code as well as to expose any misunderstandings I may have about

148

HTTP (so you don't need to read the code to figure out I'm wrong

149

:-).

150

151

HTTP (HyperText Transfer Protocol) is an extensible protocol on

152

top of a reliable stream transport (e.g. TCP/IP). The protocol

153

recognizes three parts to a request:

154

155

1. One line identifying the request type and path

156

2. An optional set of RFC-822-style headers

157

3. An optional data part

158

159

The headers and data are separated by a blank line.

160

161

The first line of the request has the form

where <command> is a (case-sensitive) keyword such as GET or POST,

166

<path> is a string containing path information for the request,

167

and <version> should be the string "HTTP/1.0" or "HTTP/1.1".

168

<path> is encoded using the URL encoding scheme (using %xx to signify

169

the ASCII character with hex code xx).

170

171

The specification specifies that lines are separated by CRLF but

172

for compatibility with the widest range of clients recommends

173

servers also handle LF. Similarly, whitespace in the request line

174

is treated sensibly (allowing multiple spaces between components

175

and allowing trailing whitespace).

176

177

Similarly, for output, lines ought to be separated by CRLF pairs

178

but most clients grok LF characters just fine.

179

180

If the first line of the request has the form

(i.e. <version> is left out) then this is assumed to be an HTTP

185

0.9 request; this form has no optional headers and data part and

186

the reply consists of just the data.

187

188

The reply form of the HTTP 1.x protocol again has three parts:

189

190

1. One line giving the response code

191

2. An optional set of RFC-822-style headers

192

3. The data

193

194

Again, the headers and data are separated by a blank line.

195

196

The response code line has the form

where <version> is the protocol version ("HTTP/1.0" or "HTTP/1.1"),

201

<responsecode> is a 3-digit response code indicating success or

202

failure of the request, and <responsestring> is an optional

203

human-readable string explaining what the response code means.

204

205

This server parses the request and the headers, and then calls a

206

function specific to the request type (<command>). Specifically,

207

a request SPAM will be handled by a method do_SPAM(). If no

208

such method exists the server sends an error response to the

209

client. If it exists, it is called with no arguments:

do_SPAM()

Note that the request name is case sensitive (i.e. SPAM and spam

214

are different requests).

215

216

The various request details are stored in instance variables:

217

218

- client_address is the client IP address in the form (host,

219

port);

220

221

- command, path and version are the broken-down request line;

222

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

223

- headers is an instance of email.message.Message (or a derived

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

224

class) containing the header information;

225

226

- rfile is a file object open for reading positioned at the

227

start of the optional input data part;

228

229

- wfile is a file object open for writing.

230

231

IT IS IMPORTANT TO ADHERE TO THE PROTOCOL FOR WRITING!

232

233

The first thing to be written must be the response line. Then

234

follow 0 or more header lines, then a blank line, and then the

235

actual data (if any). The meaning of the header lines depends on

236

the command executed by the server; in most cases, when data is

237

returned, there should be at least one header line of the form

238

239

Content-type: <type>/<subtype>

240

241

where <type> and <subtype> should be registered MIME types,

242

e.g. "text/html" or "text/plain".

"""

# The Python system version, truncated to its first component.

247

sys_version = "Python/" + sys.version.split()[0]

248

249

# The server software version. You may want to override this.

250

# The format is multiple whitespace-separated strings,

251

# where each string is of the form name[/version].

252

server_version = "BaseHTTP/" + __version__

253

254

error_message_format = DEFAULT_ERROR_MESSAGE

255

error_content_type = DEFAULT_ERROR_CONTENT_TYPE

256

257

# The default request version. This only affects responses up until

258

# the point where the request line is parsed, so it mainly decides what

259

# the client gets back when sending a malformed request line.

260

# Most web servers default to HTTP 0.9, i.e. don't send a status line.

261

default_request_version = "HTTP/0.9"

262

263

def parse_request(self):

264

"""Parse a request (internal).

265

266

The request should be stored in self.raw_requestline; the results

267

are in self.command, self.path, self.request_version and

268

self.headers.

269

Martin Panter

2016-11-19 01:06:37 +0000

[diff] [blame]

270

Return True for success, False for failure; on failure, any relevant

271

error response has already been sent back.

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

272

273

"""

274

self.command = None # set in case of error on the first line

275

self.request_version = version = self.default_request_version

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

276

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

277

requestline = str(self.raw_requestline, 'iso-8859-1')

Senthil Kumaran

3075549

2011-12-23 17:03:41 +0800

[diff] [blame]

278

requestline = requestline.rstrip('\r\n')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

279

self.requestline = requestline

280

words = requestline.split()

Martin Panter

2016-11-19 01:06:37 +0000

[diff] [blame]

if len(words) == 0:

return False

if len(words) >= 3: # Enough to determine protocol version

285

version = words[-1]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

286

try:

Martin Panter

2016-11-19 01:06:37 +0000

[diff] [blame]

287

if not version.startswith('HTTP/'):

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

288

raise ValueError

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

289

base_version_number = version.split('/', 1)[1]

290

version_number = base_version_number.split(".")

291

# RFC 2145 section 3.1 says there can be only one "." and

292

# - major and minor numbers MUST be treated as

293

# separate integers;

294

# - HTTP/2.4 is a lower version than HTTP/2.13, which in

295

# turn is lower than HTTP/12.3;

296

# - Leading zeros MUST be ignored by recipients.

297

if len(version_number) != 2:

298

raise ValueError

299

version_number = int(version_number[0]), int(version_number[1])

300

except (ValueError, IndexError):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

301

self.send_error(

302

HTTPStatus.BAD_REQUEST,

303

"Bad request version (%r)" % version)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

304

return False

305

if version_number >= (1, 1) and self.protocol_version >= "HTTP/1.1":

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

306

self.close_connection = False

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

307

if version_number >= (2, 0):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

308

self.send_error(

309

HTTPStatus.HTTP_VERSION_NOT_SUPPORTED,

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

310

"Invalid HTTP version (%s)" % base_version_number)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

311

return False

Martin Panter

2016-11-19 01:06:37 +0000

[diff] [blame]

312

self.request_version = version

313

314

if not 2 <= len(words) <= 3:

315

self.send_error(

316

HTTPStatus.BAD_REQUEST,

317

"Bad request syntax (%r)" % requestline)

318

return False

319

command, path = words[:2]

320

if len(words) == 2:

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

321

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

322

if command != 'GET':

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

323

self.send_error(

324

HTTPStatus.BAD_REQUEST,

325

"Bad HTTP/0.9 request type (%r)" % command)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

326

return False

Martin Panter

2016-11-19 01:06:37 +0000

[diff] [blame]

327

self.command, self.path = command, path

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

328

329

# Examine the headers and look for a Connection directive.

Senthil Kumaran

5466bf1

2010-12-18 16:55:23 +0000

[diff] [blame]

330

try:

331

self.headers = http.client.parse_headers(self.rfile,

332

_class=self.MessageClass)

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

333

except http.client.LineTooLong as err:

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

334

self.send_error(

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

335

HTTPStatus.REQUEST_HEADER_FIELDS_TOO_LARGE,

336

"Line too long",

337

str(err))

Senthil Kumaran

5466bf1

2010-12-18 16:55:23 +0000

[diff] [blame]

338

return False

Martin Panter

acc0319

2016-04-03 00:45:46 +0000

[diff] [blame]

339

except http.client.HTTPException as err:

340

self.send_error(

341

HTTPStatus.REQUEST_HEADER_FIELDS_TOO_LARGE,

"Too many headers",

str(err)

)

return False

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

346

347

conntype = self.headers.get('Connection', "")

348

if conntype.lower() == 'close':

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

349

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

350

elif (conntype.lower() == 'keep-alive' and

351

self.protocol_version >= "HTTP/1.1"):

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

352

self.close_connection = False

Senthil Kumaran

0f476d4

2010-09-30 06:09:18 +0000

[diff] [blame]

353

# Examine the headers and look for an Expect directive

354

expect = self.headers.get('Expect', "")

355

if (expect.lower() == "100-continue" and

356

self.protocol_version >= "HTTP/1.1" and

357

self.request_version >= "HTTP/1.1"):

358

if not self.handle_expect_100():

return False

return True

def handle_expect_100(self):

363

"""Decide what to do with an "Expect: 100-continue" header.

364

365

If the client is expecting a 100 Continue response, we must

366

respond with either a 100 Continue or a final response before

367

waiting for the request body. The default is to always respond

368

with a 100 Continue. You can behave differently (for example,

369

reject unauthorized requests) by overriding this method.

370

371

This method should either return True (possibly after sending

372

a 100 Continue response) or send an error response and return

373

False.

374

375

"""

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

376

self.send_response_only(HTTPStatus.CONTINUE)

Benjamin Peterson

0442423

2014-01-18 21:50:18 -0500

[diff] [blame]

377

self.end_headers()

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

378

return True

379

380

def handle_one_request(self):

381

"""Handle a single HTTP request.

382

383

You normally don't need to override this method; see the class

384

__doc__ string for information on how to handle specific HTTP

385

commands such as GET and POST.

386

387

"""

Kristján Valur Jónsson

2009-07-01 10:01:31 +0000

[diff] [blame]

388

try:

Antoine Pitrou

c492437

2010-12-16 16:48:36 +0000

[diff] [blame]

389

self.raw_requestline = self.rfile.readline(65537)

390

if len(self.raw_requestline) > 65536:

391

self.requestline = ''

392

self.request_version = ''

393

self.command = ''

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

394

self.send_error(HTTPStatus.REQUEST_URI_TOO_LONG)

Antoine Pitrou

c492437

2010-12-16 16:48:36 +0000

[diff] [blame]

395

return

Kristján Valur Jónsson

2009-07-01 10:01:31 +0000

[diff] [blame]

396

if not self.raw_requestline:

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

397

self.close_connection = True

Kristján Valur Jónsson

2009-07-01 10:01:31 +0000

[diff] [blame]

398

return

399

if not self.parse_request():

400

# An error code has been sent, just exit

401

return

402

mname = 'do_' + self.command

403

if not hasattr(self, mname):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

404

self.send_error(

405

HTTPStatus.NOT_IMPLEMENTED,

406

"Unsupported method (%r)" % self.command)

Kristján Valur Jónsson

2009-07-01 10:01:31 +0000

[diff] [blame]

407

return

408

method = getattr(self, mname)

409

method()

410

self.wfile.flush() #actually send the response if not already done.

411

except socket.timeout as e:

412

#a read or a write timed out. Discard this connection

413

self.log_error("Request timed out: %r", e)

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

414

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

415

return

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

416

417

def handle(self):

418

"""Handle multiple requests if necessary."""

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

419

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

420

421

self.handle_one_request()

422

while not self.close_connection:

423

self.handle_one_request()

424

Senthil Kumaran

2688644

2013-03-15 07:53:21 -0700

[diff] [blame]

425

def send_error(self, code, message=None, explain=None):

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

426

"""Send and log an error reply.

427

Senthil Kumaran

2688644

2013-03-15 07:53:21 -0700

[diff] [blame]

428

Arguments are

429

* code: an HTTP error code

430

3 digits

431

* message: a simple optional 1 line reason phrase.

432

*( HTAB / SP / VCHAR / %x80-FF )

433

defaults to short entry matching the response code

434

* explain: a detailed message defaults to the long entry

435

matching the response code.

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

436

437

This sends an error response (so it must be called before any

438

output has been generated), logs the error, and finally sends

439

a piece of HTML explaining the error to the user.

"""

try:

shortmsg, longmsg = self.responses[code]

445

except KeyError:

446

shortmsg, longmsg = '???', '???'

447

if message is None:

448

message = shortmsg

Senthil Kumaran

2688644

2013-03-15 07:53:21 -0700

[diff] [blame]

449

if explain is None:

450

explain = longmsg

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

451

self.log_error("code %d, message %s", code, message)

Senthil Kumaran

1e7551d

2013-03-05 02:25:58 -0800

[diff] [blame]

452

self.send_response(code, message)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

453

self.send_header('Connection', 'close')

Martin Panter

e42e129

2016-06-08 08:29:13 +0000

[diff] [blame]

454

455

# Message body is omitted for cases described in:

456

# - RFC7230: 3.3. 1xx, 204(No Content), 304(Not Modified)

457

# - RFC7231: 6.3.6. 205(Reset Content)

458

body = None

459

if (code >= 200 and

460

code not in (HTTPStatus.NO_CONTENT,

461

HTTPStatus.RESET_CONTENT,

462

HTTPStatus.NOT_MODIFIED)):

463

# HTML encode to prevent Cross Site Scripting attacks

464

# (see bug #1100201)

465

content = (self.error_message_format % {

466

'code': code,

Martin Panter

40de69a

2016-06-08 09:45:58 +0000

[diff] [blame]

467

'message': html.escape(message, quote=False),

468

'explain': html.escape(explain, quote=False)

Martin Panter

e42e129

2016-06-08 08:29:13 +0000

[diff] [blame]

469

})

470

body = content.encode('UTF-8', 'replace')

471

self.send_header("Content-Type", self.error_content_type)

472

self.send_header('Content-Length', int(len(body)))

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

473

self.end_headers()

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

474

Martin Panter

e42e129

2016-06-08 08:29:13 +0000

[diff] [blame]

475

if self.command != 'HEAD' and body:

Senthil Kumaran

52d2720

2012-10-10 23:16:21 -0700

[diff] [blame]

476

self.wfile.write(body)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

477

478

def send_response(self, code, message=None):

Senthil Kumaran

2011-05-09 23:25:02 +0800

[diff] [blame]

479

"""Add the response header to the headers buffer and log the

480

response code.

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

481

482

Also send two standard headers with the server software

483

version and the current date.

484

485

"""

486

self.log_request(code)

Senthil Kumaran

0f476d4

2010-09-30 06:09:18 +0000

[diff] [blame]

487

self.send_response_only(code, message)

488

self.send_header('Server', self.version_string())

489

self.send_header('Date', self.date_time_string())

490

491

def send_response_only(self, code, message=None):

492

"""Send the response header only."""

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

493

if self.request_version != 'HTTP/0.9':

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

494

if message is None:

495

if code in self.responses:

496

message = self.responses[code][0]

497

else:

498

message = ''

Senthil Kumaran

2011-05-09 23:25:02 +0800

[diff] [blame]

499

if not hasattr(self, '_headers_buffer'):

500

self._headers_buffer = []

501

self._headers_buffer.append(("%s %d %s\r\n" %

502

(self.protocol_version, code, message)).encode(

503

'latin-1', 'strict'))

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

504

505

def send_header(self, keyword, value):

Senthil Kumaran

2011-05-09 23:25:02 +0800

[diff] [blame]

506

"""Send a MIME header to the headers buffer."""

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

507

if self.request_version != 'HTTP/0.9':

Senthil Kumaran

e4dad4f

2010-11-21 14:36:14 +0000

[diff] [blame]

508

if not hasattr(self, '_headers_buffer'):

509

self._headers_buffer = []

510

self._headers_buffer.append(

Marc-André Lemburg

8f36af7

2011-02-25 15:42:01 +0000

[diff] [blame]

511

("%s: %s\r\n" % (keyword, value)).encode('latin-1', 'strict'))

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

512

513

if keyword.lower() == 'connection':

514

if value.lower() == 'close':

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

515

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

516

elif value.lower() == 'keep-alive':

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

517

self.close_connection = False

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

518

519

def end_headers(self):

520

"""Send the blank line ending the MIME headers."""

521

if self.request_version != 'HTTP/0.9':

Senthil Kumaran

e4dad4f

2010-11-21 14:36:14 +0000

[diff] [blame]

522

self._headers_buffer.append(b"\r\n")

Senthil Kumaran

2011-05-09 23:25:02 +0800

[diff] [blame]

523

self.flush_headers()

524

525

def flush_headers(self):

526

if hasattr(self, '_headers_buffer'):

Senthil Kumaran

e4dad4f

2010-11-21 14:36:14 +0000

[diff] [blame]

527

self.wfile.write(b"".join(self._headers_buffer))

528

self._headers_buffer = []

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

529

530

def log_request(self, code='-', size='-'):

531

"""Log an accepted request.

532

533

This is called by send_response().

534

535

"""

Serhiy Storchaka

c0a23e6

2015-03-07 11:51:37 +0200

[diff] [blame]

536

if isinstance(code, HTTPStatus):

537

code = code.value

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

538

self.log_message('"%s" %s %s',

539

self.requestline, str(code), str(size))

540

541

def log_error(self, format, *args):

542

"""Log an error.

543

544

This is called when a request cannot be fulfilled. By

545

default it passes the message on to log_message().

546

547

Arguments are the same as for log_message().

548

549

XXX This should go to the separate error log.

"""

self.log_message(format, *args)

554

555

def log_message(self, format, *args):

556

"""Log an arbitrary message.

557

558

This is used by all other logging functions. Override

559

it if you have specific logging wishes.

560

561

The first argument, FORMAT, is a format string for the

562

message to be logged. If the format string contains

563

any % escapes requiring parameters, they should be

564

specified as subsequent arguments (it's just like

565

printf!).

566

Senthil Kumaran

db727b4

2012-04-29 13:41:03 +0800

[diff] [blame]

567

The client ip and current date/time are prefixed to

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

every message.

"""

sys.stderr.write("%s - - [%s] %s\n" %

573

(self.address_string(),

574

self.log_date_time_string(),

575

format%args))

576

577

def version_string(self):

578

"""Return the server software version string."""

579

return self.server_version + ' ' + self.sys_version

580

581

def date_time_string(self, timestamp=None):

582

"""Return the current date and time formatted for a message header."""

583

if timestamp is None:

584

timestamp = time.time()

Berker Peksag

04bc5b9

2016-03-14 06:06:03 +0200

[diff] [blame]

585

return email.utils.formatdate(timestamp, usegmt=True)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

586

587

def log_date_time_string(self):

588

"""Return the current time formatted for logging."""

589

now = time.time()

590

year, month, day, hh, mm, ss, x, y, z = time.localtime(now)

591

s = "%02d/%3s/%04d %02d:%02d:%02d" % (

592

day, self.monthname[month], year, hh, mm, ss)

593

return s

594

595

weekdayname = ['Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat', 'Sun']

596

597

monthname = [None,

598

'Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun',

599

'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec']

600

601

def address_string(self):

Senthil Kumaran

1aacba4

2012-04-29 12:51:54 +0800

[diff] [blame]

602

"""Return the client address."""

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

603

Senthil Kumaran

1aacba4

2012-04-29 12:51:54 +0800

[diff] [blame]

604

return self.client_address[0]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

605

606

# Essentially static class variables

607

608

# The version of the HTTP protocol we support.

609

# Set this to HTTP/1.1 to enable automatic keepalive

610

protocol_version = "HTTP/1.0"

611

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

612

# MessageClass used to parse headers

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

613

MessageClass = http.client.HTTPMessage

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

614

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

615

# hack to maintain backwards compatibility

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

616

responses = {

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

617

v: (v.phrase, v.description)

618

for v in HTTPStatus.__members__.values()

619

}

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

620

621

622

class SimpleHTTPRequestHandler(BaseHTTPRequestHandler):

623

624

"""Simple HTTP request handler with GET and HEAD commands.

625

626

This serves files from the current directory and any of its

627

subdirectories. The MIME type for files is determined by

628

calling the .guess_type() method.

629

630

The GET and HEAD requests are identical except that the HEAD

631

request omits the actual contents of the file.

"""

server_version = "SimpleHTTP/" + __version__

636

637

def do_GET(self):

638

"""Serve a GET request."""

639

f = self.send_head()

640

if f:

Serhiy Storchaka

2014-01-25 19:43:02 +0200

[diff] [blame]

641

try:

642

self.copyfile(f, self.wfile)

643

finally:

644

f.close()

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

645

646

def do_HEAD(self):

647

"""Serve a HEAD request."""

f = self.send_head()

if f:

f.close()

def send_head(self):

"""Common code for GET and HEAD commands.

654

655

This sends the response code and MIME headers.

656

657

Return value is either a file object (which has to be copied

658

to the outputfile by the caller unless the command was HEAD,

659

and must be closed by the caller under all circumstances), or

660

None, in which case the caller has nothing further to do.

661

662

"""

663

path = self.translate_path(self.path)

664

f = None

665

if os.path.isdir(path):

Benjamin Peterson

94cb7a2

2014-12-26 10:53:43 -0600

[diff] [blame]

666

parts = urllib.parse.urlsplit(self.path)

667

if not parts.path.endswith('/'):

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

668

# redirect browser - doing basically what apache does

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

669

self.send_response(HTTPStatus.MOVED_PERMANENTLY)

Benjamin Peterson

94cb7a2

2014-12-26 10:53:43 -0600

[diff] [blame]

670

new_parts = (parts[0], parts[1], parts[2] + '/',

671

parts[3], parts[4])

672

new_url = urllib.parse.urlunsplit(new_parts)

673

self.send_header("Location", new_url)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

674

self.end_headers()

675

return None

676

for index in "index.html", "index.htm":

677

index = os.path.join(path, index)

678

if os.path.exists(index):

path = index

break

else:

return self.list_directory(path)

683

ctype = self.guess_type(path)

684

try:

685

f = open(path, 'rb')

Andrew Svetlov

f7a17b4

2012-12-25 16:47:37 +0200

[diff] [blame]

686

except OSError:

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

687

self.send_error(HTTPStatus.NOT_FOUND, "File not found")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

688

return None

Pierre Quentel

2017-04-02 12:26:12 +0200

[diff] [blame]

689

Serhiy Storchaka

2014-01-25 19:43:02 +0200

[diff] [blame]

690

try:

Pierre Quentel

2017-04-02 12:26:12 +0200

[diff] [blame]

691

fs = os.fstat(f.fileno())

692

# Use browser cache if possible

693

if ("If-Modified-Since" in self.headers

694

and "If-None-Match" not in self.headers):

695

# compare If-Modified-Since and time of last file modification

696

try:

697

ims = email.utils.parsedate_to_datetime(

698

self.headers["If-Modified-Since"])

699

except (TypeError, IndexError, OverflowError, ValueError):

700

# ignore ill-formed values

701

pass

702

else:

703

if ims.tzinfo is None:

704

# obsolete format with no timezone, cf.

705

# https://tools.ietf.org/html/rfc7231#section-7.1.1.1

706

ims = ims.replace(tzinfo=datetime.timezone.utc)

707

if ims.tzinfo is datetime.timezone.utc:

708

# compare to UTC datetime of last modification

709

last_modif = datetime.datetime.fromtimestamp(

710

fs.st_mtime, datetime.timezone.utc)

711

# remove microseconds, like in If-Modified-Since

712

last_modif = last_modif.replace(microsecond=0)

713

714

if last_modif <= ims:

715

self.send_response(HTTPStatus.NOT_MODIFIED)

self.end_headers()

f.close()

return None

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

720

self.send_response(HTTPStatus.OK)

Serhiy Storchaka

2014-01-25 19:43:02 +0200

[diff] [blame]

721

self.send_header("Content-type", ctype)

Serhiy Storchaka

2014-01-25 19:43:02 +0200

[diff] [blame]

722

self.send_header("Content-Length", str(fs[6]))

Pierre Quentel

2017-04-02 12:26:12 +0200

[diff] [blame]

723

self.send_header("Last-Modified",

724

self.date_time_string(fs.st_mtime))

Serhiy Storchaka

2014-01-25 19:43:02 +0200

[diff] [blame]

self.end_headers()

return f

except:

f.close()

raise

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

730

731

def list_directory(self, path):

732

"""Helper to produce a directory listing (absent index.html).

733

734

Return value is either a file object, or None (indicating an

735

error). In either case, the headers are sent, making the

736

interface the same as for send_head().

"""

try:

list = os.listdir(path)

Andrew Svetlov

ad28c7f

2012-12-18 22:02:39 +0200

[diff] [blame]

741

except OSError:

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

742

self.send_error(

743

HTTPStatus.NOT_FOUND,

744

"No permission to list directory")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

745

return None

746

list.sort(key=lambda a: a.lower())

747

r = []

Serhiy Storchaka

2014-08-17 08:22:11 +0300

[diff] [blame]

748

try:

749

displaypath = urllib.parse.unquote(self.path,

750

errors='surrogatepass')

751

except UnicodeDecodeError:

752

displaypath = urllib.parse.unquote(path)

Martin Panter

da3bb38

2016-04-11 00:40:08 +0000

[diff] [blame]

753

displaypath = html.escape(displaypath, quote=False)

Ezio Melotti

2011-11-02 19:33:29 +0200

[diff] [blame]

754

enc = sys.getfilesystemencoding()

755

title = 'Directory listing for %s' % displaypath

756

r.append('<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" '

757

'"http://www.w3.org/TR/html4/strict.dtd">')

758

r.append('<html>\n<head>')

759

r.append('<meta http-equiv="Content-Type" '

760

'content="text/html; charset=%s">' % enc)

761

r.append('<title>%s</title>\n</head>' % title)

762

r.append('<body>\n<h1>%s</h1>' % title)

763

r.append('<hr>\n<ul>')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

764

for name in list:

765

fullname = os.path.join(path, name)

766

displayname = linkname = name

767

# Append / for directories or @ for symbolic links

768

if os.path.isdir(fullname):

769

displayname = name + "/"

770

linkname = name + "/"

771

if os.path.islink(fullname):

772

displayname = name + "@"

773

# Note: a link to a directory displays with @ and links with /

Ezio Melotti

2011-11-02 19:33:29 +0200

[diff] [blame]

774

r.append('<li><a href="%s">%s</a></li>'

Serhiy Storchaka

2014-08-17 08:22:11 +0300

[diff] [blame]

775

% (urllib.parse.quote(linkname,

776

errors='surrogatepass'),

Martin Panter

da3bb38

2016-04-11 00:40:08 +0000

[diff] [blame]

777

html.escape(displayname, quote=False)))

Ezio Melotti

2011-11-02 19:33:29 +0200

[diff] [blame]

778

r.append('</ul>\n<hr>\n</body>\n</html>\n')

Serhiy Storchaka

2014-08-17 08:22:11 +0300

[diff] [blame]

779

encoded = '\n'.join(r).encode(enc, 'surrogateescape')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

780

f = io.BytesIO()

781

f.write(encoded)

782

f.seek(0)

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

783

self.send_response(HTTPStatus.OK)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

784

self.send_header("Content-type", "text/html; charset=%s" % enc)

785

self.send_header("Content-Length", str(len(encoded)))

self.end_headers()

return f

def translate_path(self, path):

790

"""Translate a /-separated PATH to the local filename syntax.

791

792

Components that mean special things to the local file system

793

(e.g. drive or directory names) are ignored. (XXX They should

794

probably be diagnosed.)

795

796

"""

797

# abandon query parameters

798

path = path.split('?',1)[0]

799

path = path.split('#',1)[0]

Senthil Kumaran

72c238e

2013-09-13 00:21:18 -0700

[diff] [blame]

800

# Don't forget explicit trailing slash when normalizing. Issue17324

Senthil Kumaran

600b735

2013-09-29 18:59:04 -0700

[diff] [blame]

801

trailing_slash = path.rstrip().endswith('/')

Serhiy Storchaka

2014-08-17 08:22:11 +0300

[diff] [blame]

802

try:

803

path = urllib.parse.unquote(path, errors='surrogatepass')

804

except UnicodeDecodeError:

805

path = urllib.parse.unquote(path)

806

path = posixpath.normpath(path)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

807

words = path.split('/')

808

words = filter(None, words)

809

path = os.getcwd()

810

for word in words:

Martin Panter

d274b3f

2016-04-18 03:45:18 +0000

[diff] [blame]

811

if os.path.dirname(word) or word in (os.curdir, os.pardir):

812

# Ignore components that are not a simple file/directory name

813

continue

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

814

path = os.path.join(path, word)

Senthil Kumaran

72c238e

2013-09-13 00:21:18 -0700

[diff] [blame]

815

if trailing_slash:

816

path += '/'

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

817

return path

818

819

def copyfile(self, source, outputfile):

820

"""Copy all data between two file objects.

821

822

The SOURCE argument is a file object open for reading

823

(or anything with a read() method) and the DESTINATION

824

argument is a file object open for writing (or

825

anything with a write() method).

826

827

The only reason for overriding this would be to change

828

the block size or perhaps to replace newlines by CRLF

829

-- note however that this the default server uses this

830

to copy binary data as well.

831

832

"""

833

shutil.copyfileobj(source, outputfile)

834

835

def guess_type(self, path):

836

"""Guess the type of a file.

837

838

Argument is a PATH (a filename).

839

840

Return value is a string of the form type/subtype,

841

usable for a MIME Content-type header.

842

843

The default implementation looks the file's extension

844

up in the table self.extensions_map, using application/octet-stream

845

as a default; however it would be permissible (if

846

slow) to look inside the data to make a better guess.

"""

base, ext = posixpath.splitext(path)

851

if ext in self.extensions_map:

852

return self.extensions_map[ext]

853

ext = ext.lower()

854

if ext in self.extensions_map:

855

return self.extensions_map[ext]

856

else:

857

return self.extensions_map['']

858

859

if not mimetypes.inited:

860

mimetypes.init() # try to read system mime.types

861

extensions_map = mimetypes.types_map.copy()

862

extensions_map.update({

863

'': 'application/octet-stream', # Default

'.py': 'text/plain',

'.c': 'text/plain',

'.h': 'text/plain',

})

# Utilities for CGIHTTPRequestHandler

871

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

872

def _url_collapse_path(path):

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

873

"""

874

Given a URL path, remove extra '/'s and '.' path elements and collapse

Martin Panter

9955a37

2015-10-07 10:26:23 +0000

[diff] [blame]

875

any '..' references and returns a collapsed path.

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

876

877

Implements something akin to RFC-2396 5.2 step 6 to parse relative paths.

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

878

The utility of this function is limited to is_cgi method and helps

879

preventing some security attacks.

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

880

Martin Panter

2015-10-03 05:55:46 +0000

[diff] [blame]

881

Returns: The reconstituted URL, which will always start with a '/'.

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

882

883

Raises: IndexError if too many '..' occur within the path.

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

884

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

885

"""

Martin Panter

2015-10-03 05:55:46 +0000

[diff] [blame]

886

# Query component should not be involved.

887

path, _, query = path.partition('?')

888

path = urllib.parse.unquote(path)

889

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

890

# Similar to os.path.split(os.path.normpath(path)) but specific to URL

891

# path semantics rather than local operating system semantics.

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

892

path_parts = path.split('/')

893

head_parts = []

894

for part in path_parts[:-1]:

895

if part == '..':

896

head_parts.pop() # IndexError if more '..' than prior parts

897

elif part and part != '.':

898

head_parts.append( part )

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

899

if path_parts:

Senthil Kumaran

dbb369d

2012-04-11 03:15:28 +0800

[diff] [blame]

900

tail_part = path_parts.pop()

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

901

if tail_part:

902

if tail_part == '..':

903

head_parts.pop()

904

tail_part = ''

905

elif tail_part == '.':

906

tail_part = ''

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

907

else:

908

tail_part = ''

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

909

Martin Panter

2015-10-03 05:55:46 +0000

[diff] [blame]

910

if query:

911

tail_part = '?'.join((tail_part, query))

912

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

913

splitpath = ('/' + '/'.join(head_parts), tail_part)

914

collapsed_path = "/".join(splitpath)

915

916

return collapsed_path

917

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

918

919

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

nobody = None

def nobody_uid():

"""Internal routine to get nobody's uid"""

global nobody

if nobody:

return nobody

try:

import pwd

Brett Cannon

cd171c8

2013-07-04 17:43:24 -0400

[diff] [blame]

929

except ImportError:

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

930

return -1

931

try:

932

nobody = pwd.getpwnam('nobody')[2]

933

except KeyError:

Georg Brandl

cbd2ab1

2010-12-04 10:39:14 +0000

[diff] [blame]

934

nobody = 1 + max(x[2] for x in pwd.getpwall())

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

return nobody

def executable(path):

939

"""Test for executable file."""

Victor Stinner

fb25ba9

2011-06-20 17:45:54 +0200

[diff] [blame]

940

return os.access(path, os.X_OK)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

941

942

943

class CGIHTTPRequestHandler(SimpleHTTPRequestHandler):

944

945

"""Complete HTTP server with GET, HEAD and POST commands.

946

947

GET and HEAD also support running CGI scripts.

948

949

The POST command is *only* implemented for CGI scripts.

"""

# Determine platform specifics

954

have_fork = hasattr(os, 'fork')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

955

956

# Make rfile unbuffered -- we need to read one line and then pass

957

# the rest to a subprocess, so we can't use buffered input.

rbufsize = 0

def do_POST(self):

"""Serve a POST request.

962

963

This is only implemented for CGI scripts.

"""

if self.is_cgi():

self.run_cgi()

else:

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

970

self.send_error(

971

HTTPStatus.NOT_IMPLEMENTED,

972

"Can only POST to CGI scripts")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

973

974

def send_head(self):

975

"""Version of send_head that support CGI scripts"""

976

if self.is_cgi():

977

return self.run_cgi()

978

else:

979

return SimpleHTTPRequestHandler.send_head(self)

980

981

def is_cgi(self):

982

"""Test whether self.path corresponds to a CGI script.

983

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

984

Returns True and updates the cgi_info attribute to the tuple

985

(dir, rest) if self.path requires running a CGI script.

986

Returns False otherwise.

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

987

Benjamin Peterson

a7deeee

2009-05-08 20:54:42 +0000

[diff] [blame]

988

If any exception is raised, the caller should assume that

989

self.path was rejected as invalid and act accordingly.

990

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

991

The default implementation tests whether the normalized url

992

path begins with one of the strings in self.cgi_directories

993

(and the next character is a '/' or the end of the string).

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

994

995

"""

Martin Panter

2015-10-03 05:55:46 +0000

[diff] [blame]

996

collapsed_path = _url_collapse_path(self.path)

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

997

dir_sep = collapsed_path.find('/', 1)

998

head, tail = collapsed_path[:dir_sep], collapsed_path[dir_sep+1:]

Senthil Kumaran

dbb369d

2012-04-11 03:15:28 +0800

[diff] [blame]

999

if head in self.cgi_directories:

1000

self.cgi_info = head, tail

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

1001

return True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1002

return False

1003

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

1004

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1005

cgi_directories = ['/cgi-bin', '/htbin']

1006

1007

def is_executable(self, path):

1008

"""Test whether argument path is an executable file."""

1009

return executable(path)

1010

1011

def is_python(self, path):

1012

"""Test whether argument path is a Python script."""

1013

head, tail = os.path.splitext(path)

1014

return tail.lower() in (".py", ".pyw")

1015

1016

def run_cgi(self):

1017

"""Execute a CGI script."""

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1018

dir, rest = self.cgi_info

Ned Deily

915a30f

2014-07-12 22:06:26 -0700

[diff] [blame]

1019

path = dir + '/' + rest

1020

i = path.find('/', len(dir)+1)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1021

while i >= 0:

Ned Deily

915a30f

2014-07-12 22:06:26 -0700

[diff] [blame]

1022

nextdir = path[:i]

1023

nextrest = path[i+1:]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1024

1025

scriptdir = self.translate_path(nextdir)

1026

if os.path.isdir(scriptdir):

1027

dir, rest = nextdir, nextrest

Ned Deily

915a30f

2014-07-12 22:06:26 -0700

[diff] [blame]

1028

i = path.find('/', len(dir)+1)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

else:

break

# find an explicit query string, if present.

Martin Panter

a02e18a

2015-10-03 05:38:07 +0000

[diff] [blame]

1033

rest, _, query = rest.partition('?')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1034

1035

# dissect the part after the directory name into a script name &

1036

# a possible additional path, to be stored in PATH_INFO.

1037

i = rest.find('/')

1038

if i >= 0:

1039

script, rest = rest[:i], rest[i:]

1040

else:

1041

script, rest = rest, ''

1042

1043

scriptname = dir + '/' + script

1044

scriptfile = self.translate_path(scriptname)

1045

if not os.path.exists(scriptfile):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

1046

self.send_error(

1047

HTTPStatus.NOT_FOUND,

1048

"No such CGI script (%r)" % scriptname)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1049

return

1050

if not os.path.isfile(scriptfile):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

1051

self.send_error(

1052

HTTPStatus.FORBIDDEN,

1053

"CGI script is not a plain file (%r)" % scriptname)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1054

return

1055

ispy = self.is_python(scriptname)

Victor Stinner

fb25ba9

2011-06-20 17:45:54 +0200

[diff] [blame]

1056

if self.have_fork or not ispy:

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1057

if not self.is_executable(scriptfile):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

1058

self.send_error(

1059

HTTPStatus.FORBIDDEN,

1060

"CGI script is not executable (%r)" % scriptname)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1061

return

1062

1063

# Reference: http://hoohoo.ncsa.uiuc.edu/cgi/env.html

1064

# XXX Much of the following could be prepared ahead of time!

Senthil Kumaran

4271372

2010-10-03 17:55:45 +0000

[diff] [blame]

1065

env = copy.deepcopy(os.environ)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1066

env['SERVER_SOFTWARE'] = self.version_string()

1067

env['SERVER_NAME'] = self.server.server_name

1068

env['GATEWAY_INTERFACE'] = 'CGI/1.1'

1069

env['SERVER_PROTOCOL'] = self.protocol_version

1070

env['SERVER_PORT'] = str(self.server.server_port)

1071

env['REQUEST_METHOD'] = self.command

Jeremy Hylton

1afc169

2008-06-18 20:49:58 +0000

[diff] [blame]

1072

uqrest = urllib.parse.unquote(rest)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1073

env['PATH_INFO'] = uqrest

1074

env['PATH_TRANSLATED'] = self.translate_path(uqrest)

1075

env['SCRIPT_NAME'] = scriptname

1076

if query:

1077

env['QUERY_STRING'] = query

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1078

env['REMOTE_ADDR'] = self.client_address[0]

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1079

authorization = self.headers.get("authorization")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1080

if authorization:

1081

authorization = authorization.split()

1082

if len(authorization) == 2:

1083

import base64, binascii

1084

env['AUTH_TYPE'] = authorization[0]

1085

if authorization[0].lower() == "basic":

1086

try:

1087

authorization = authorization[1].encode('ascii')

Georg Brandl

706824f

2009-06-04 09:42:55 +0000

[diff] [blame]

1088

authorization = base64.decodebytes(authorization).\

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1089

decode('ascii')

1090

except (binascii.Error, UnicodeError):

1091

pass

1092

else:

1093

authorization = authorization.split(':')

1094

if len(authorization) == 2:

1095

env['REMOTE_USER'] = authorization[0]

1096

# XXX REMOTE_IDENT

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1097

if self.headers.get('content-type') is None:

1098

env['CONTENT_TYPE'] = self.headers.get_content_type()

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1099

else:

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1100

env['CONTENT_TYPE'] = self.headers['content-type']

1101

length = self.headers.get('content-length')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1102

if length:

1103

env['CONTENT_LENGTH'] = length

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1104

referer = self.headers.get('referer')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1105

if referer:

1106

env['HTTP_REFERER'] = referer

1107

accept = []

1108

for line in self.headers.getallmatchingheaders('accept'):

1109

if line[:1] in "\t\n\r ":

1110

accept.append(line.strip())

1111

else:

1112

accept = accept + line[7:].split(',')

1113

env['HTTP_ACCEPT'] = ','.join(accept)

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1114

ua = self.headers.get('user-agent')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1115

if ua:

1116

env['HTTP_USER_AGENT'] = ua

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1117

co = filter(None, self.headers.get_all('cookie', []))

Georg Brandl

62e2ca2

2010-07-31 21:54:24 +0000

[diff] [blame]

1118

cookie_str = ', '.join(co)

1119

if cookie_str:

1120

env['HTTP_COOKIE'] = cookie_str

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1121

# XXX Other HTTP_* headers

1122

# Since we're setting the env in the parent, provide empty

1123

# values to override previously set values

1124

for k in ('QUERY_STRING', 'REMOTE_HOST', 'CONTENT_LENGTH',

1125

'HTTP_USER_AGENT', 'HTTP_COOKIE', 'HTTP_REFERER'):

1126

env.setdefault(k, "")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1127

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

1128

self.send_response(HTTPStatus.OK, "Script output follows")

Senthil Kumaran

2011-05-09 23:25:02 +0800

[diff] [blame]

1129

self.flush_headers()

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1130

1131

decoded_query = query.replace('+', ' ')

1132

1133

if self.have_fork:

1134

# Unix -- fork as we should

1135

args = [script]

1136

if '=' not in decoded_query:

1137

args.append(decoded_query)

1138

nobody = nobody_uid()

1139

self.wfile.flush() # Always flush before forking

pid = os.fork()

if pid != 0:

# Parent

pid, sts = os.waitpid(pid, 0)

1144

# throw away additional data [see bug #427345]

1145

while select.select([self.rfile], [], [], 0)[0]:

1146

if not self.rfile.read(1):

1147

break

1148

if sts:

1149

self.log_error("CGI script exit status %#x", sts)

return

# Child

try:

try:

os.setuid(nobody)

Andrew Svetlov

ad28c7f

2012-12-18 22:02:39 +0200

[diff] [blame]

1155

except OSError:

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1156

pass

1157

os.dup2(self.rfile.fileno(), 0)

1158

os.dup2(self.wfile.fileno(), 1)

Senthil Kumaran

4271372

2010-10-03 17:55:45 +0000

[diff] [blame]

1159

os.execve(scriptfile, args, env)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1160

except:

1161

self.server.handle_error(self.request, self.client_address)

1162

os._exit(127)

1163

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1164

else:

1165

# Non-Unix -- use subprocess

1166

import subprocess

Senthil Kumaran

e29cd16

2009-11-11 04:17:53 +0000

[diff] [blame]

1167

cmdline = [scriptfile]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1168

if self.is_python(scriptfile):

1169

interp = sys.executable

1170

if interp.lower().endswith("w.exe"):

1171

# On Windows, use python.exe, not pythonw.exe

1172

interp = interp[:-5] + interp[-4:]

Senthil Kumaran

e29cd16

2009-11-11 04:17:53 +0000

[diff] [blame]

1173

cmdline = [interp, '-u'] + cmdline

1174

if '=' not in query:

1175

cmdline.append(query)

1176

self.log_message("command: %s", subprocess.list2cmdline(cmdline))

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1177

try:

1178

nbytes = int(length)

1179

except (TypeError, ValueError):

1180

nbytes = 0

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1181

p = subprocess.Popen(cmdline,

1182

stdin=subprocess.PIPE,

1183

stdout=subprocess.PIPE,

Senthil Kumaran

4271372

2010-10-03 17:55:45 +0000

[diff] [blame]

1184

stderr=subprocess.PIPE,

1185

env = env

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1186

)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1187

if self.command.lower() == "post" and nbytes > 0:

1188

data = self.rfile.read(nbytes)

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1189

else:

1190

data = None

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1191

# throw away additional data [see bug #427345]

1192

while select.select([self.rfile._sock], [], [], 0)[0]:

1193

if not self.rfile._sock.recv(1):

1194

break

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1195

stdout, stderr = p.communicate(data)

1196

self.wfile.write(stdout)

1197

if stderr:

1198

self.log_error('%s', stderr)

Brian Curtin

cbad4df

2010-11-05 15:04:48 +0000

[diff] [blame]

1199

p.stderr.close()

1200

p.stdout.close()

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1201

status = p.returncode

1202

if status:

1203

self.log_error("CGI script exit status %#x", status)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1204

else:

1205

self.log_message("CGI script exited OK")

1206

1207

Senthil Kumaran

2013-09-15 09:37:27 -0700

[diff] [blame]

1208

def test(HandlerClass=BaseHTTPRequestHandler,

1209

ServerClass=HTTPServer, protocol="HTTP/1.0", port=8000, bind=""):

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1210

"""Test the HTTP request handler class.

1211

Robert Collins

9644f24

2015-08-17 12:18:35 +1200

[diff] [blame]

1212

This runs an HTTP server on port 8000 (or the port argument).

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1213

1214

"""

Senthil Kumaran

2013-09-15 09:37:27 -0700

[diff] [blame]

1215

server_address = (bind, port)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1216

1217

HandlerClass.protocol_version = protocol

Martin Panter

0cab9c1

2016-04-13 00:36:52 +0000

[diff] [blame]

1218

with ServerClass(server_address, HandlerClass) as httpd:

1219

sa = httpd.socket.getsockname()

Berker Peksag

3a31cca

2016-04-29 16:48:11 +0300

[diff] [blame]

1220

serve_message = "Serving HTTP on {host} port {port} (http://{host}:{port}/) ..."

1221

print(serve_message.format(host=sa[0], port=sa[1]))

Martin Panter

0cab9c1

2016-04-13 00:36:52 +0000

[diff] [blame]

1222

try:

1223

httpd.serve_forever()

1224

except KeyboardInterrupt:

1225

print("\nKeyboard interrupt received, exiting.")

1226

sys.exit(0)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1227

1228

if __name__ == '__main__':

Serhiy Storchaka

7e4db2f

2017-05-04 08:17:47 +0300

[diff] [blame]

1229

import argparse

1230

Senthil Kumaran

2012-06-03 16:15:54 +0800

[diff] [blame]

1231

parser = argparse.ArgumentParser()

1232

parser.add_argument('--cgi', action='store_true',

1233

help='Run as CGI Server')

Senthil Kumaran

2013-09-15 09:37:27 -0700

[diff] [blame]

1234

parser.add_argument('--bind', '-b', default='', metavar='ADDRESS',

1235

help='Specify alternate bind address '

1236

'[default: all interfaces]')

Senthil Kumaran

2012-06-03 16:15:54 +0800

[diff] [blame]

1237

parser.add_argument('port', action='store',

1238

default=8000, type=int,

1239

nargs='?',

1240

help='Specify alternate port [default: 8000]')

1241

args = parser.parse_args()

1242

if args.cgi:

Senthil Kumaran

2013-09-15 09:37:27 -0700

[diff] [blame]

1243

handler_class = CGIHTTPRequestHandler

Senthil Kumaran

2012-06-03 16:15:54 +0800

[diff] [blame]

1244

else:

Senthil Kumaran