Blame - Lib/http/server.py - platform/external/python/cpython3

2008-05-26 16:32:26 +0000

[diff] [blame]

1

"""HTTP server classes.

2

3

Note: BaseHTTPRequestHandler doesn't implement any HTTP request; see

4

SimpleHTTPRequestHandler for simple implementations of GET, HEAD and POST,

5

and CGIHTTPRequestHandler for CGI scripts.

6

7

It does, however, optionally implement HTTP/1.1 persistent connections,

8

as of version 0.3.

9

10

Notes on CGIHTTPRequestHandler

11

------------------------------

12

13

This class implements GET and POST requests to cgi-bin scripts.

14

15

If the os.fork() function is not present (e.g. on Windows),

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

16

subprocess.Popen() is used as a fallback, with slightly altered semantics.

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

17

18

In all cases, the implementation is intentionally naive -- all

19

requests are executed synchronously.

20

21

SECURITY WARNING: DON'T USE THIS CODE UNLESS YOU ARE INSIDE A FIREWALL

22

-- it may execute arbitrary Python code or external programs.

23

24

Note that status code 200 is sent prior to execution of a CGI script, so

25

scripts cannot send other status codes such as 302 (redirect).

XXX To do:

- log requests even later (to capture byte count)

30

- log user-agent header and other interesting goodies

31

- send error log to separate file

"""

# See also:

#

# HTTP Working Group T. Berners-Lee

38

# INTERNET-DRAFT R. T. Fielding

39

# <draft-ietf-http-v10-spec-00.txt> H. Frystyk Nielsen

40

# Expires September 8, 1995 March 8, 1995

41

#

42

# URL: http://www.ics.uci.edu/pub/ietf/http/draft-ietf-http-v10-spec-00.txt

#

# and

#

# Network Working Group R. Fielding

47

# Request for Comments: 2616 et al

48

# Obsoletes: 2068 June 1999

49

# Category: Standards Track

50

#

51

# URL: http://www.faqs.org/rfcs/rfc2616.html

# Log files

# ---------

#

# Here's a quote from the NCSA httpd docs about log file format.

57

#

58

# | The logfile format is as follows. Each line consists of:

59

# |

60

# | host rfc931 authuser [DD/Mon/YYYY:hh:mm:ss] "request" ddd bbbb

61

# |

62

# | host: Either the DNS name or the IP number of the remote client

63

# | rfc931: Any information returned by identd for this person,

64

# | - otherwise.

65

# | authuser: If user sent a userid for authentication, the user name,

66

# | - otherwise.

67

# | DD: Day

68

# | Mon: Month (calendar name)

69

# | YYYY: Year

70

# | hh: hour (24-hour format, the machine's timezone)

71

# | mm: minutes

72

# | ss: seconds

73

# | request: The first line of the HTTP request as sent by the client.

74

# | ddd: the status code returned by the server, - if not available.

75

# | bbbb: the total number of bytes sent,

76

# | *not including the HTTP/1.0 header*, - if not available

77

# |

78

# | You can determine the name of the file accessed through request.

79

#

80

# (Actually, the latter is only true if you know the server configuration

81

# at the time the request was made!)

__version__ = "0.6"

Berker Peksag

2015-02-13 20:48:15 +0200

[diff] [blame]

85

__all__ = [

Géry Ogam

1cee216

2018-05-29 22:10:30 +0200

[diff] [blame]

86

"HTTPServer", "ThreadingHTTPServer", "BaseHTTPRequestHandler",

Berker Peksag

366c570

2015-02-13 20:48:15 +0200

[diff] [blame]

87

"SimpleHTTPRequestHandler", "CGIHTTPRequestHandler",

88

]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

89

Pierre Quentel

2017-04-02 12:26:12 +0200

[diff] [blame]

90

import copy

91

import datetime

Berker Peksag

04bc5b9

2016-03-14 06:06:03 +0200

[diff] [blame]

92

import email.utils

Georg Brandl

1f7fffb

2010-10-15 15:57:45 +0000

[diff] [blame]

93

import html

Jeremy Hylton

914ab45

2009-03-27 17:16:06 +0000

[diff] [blame]

import http.client

import io

import mimetypes

import os

import posixpath

import select

import shutil

import socket # For gethostbyaddr()

import socketserver

import sys

import time

import urllib.parse

Senthil Kumaran

2012-06-03 16:15:54 +0800

[diff] [blame]

106

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

107

from http import HTTPStatus

108

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

109

110

# Default error message template

111

DEFAULT_ERROR_MESSAGE = """\

Senthil Kumaran

1b407fe

2011-03-20 10:44:30 +0800

[diff] [blame]

112

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"

113

"http://www.w3.org/TR/html4/strict.dtd">

Ezio Melotti

2011-11-02 19:33:29 +0200

[diff] [blame]

114

<html>

Senthil Kumaran

b253c9f

2011-03-17 16:43:22 +0800

[diff] [blame]

115

<head>

Senthil Kumaran

1b407fe

2011-03-20 10:44:30 +0800

[diff] [blame]

116

Senthil Kumaran

b253c9f

2011-03-17 16:43:22 +0800

[diff] [blame]

117

<title>Error response</title>

118

</head>

119

<body>

120

<h1>Error response</h1>

121

<p>Error code: %(code)d</p>

122

<p>Message: %(message)s.</p>

123

<p>Error code explanation: %(code)s - %(explain)s.</p>

124

</body>

125

</html>

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

126

"""

127

128

DEFAULT_ERROR_CONTENT_TYPE = "text/html;charset=utf-8"

129

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

130

class HTTPServer(socketserver.TCPServer):

131

132

allow_reuse_address = 1 # Seems to make sense in testing environment

133

134

def server_bind(self):

135

"""Override server_bind to store the server name."""

136

socketserver.TCPServer.server_bind(self)

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

137

host, port = self.server_address[:2]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

138

self.server_name = socket.getfqdn(host)

139

self.server_port = port

140

141

Géry Ogam

1cee216

2018-05-29 22:10:30 +0200

[diff] [blame]

142

class ThreadingHTTPServer(socketserver.ThreadingMixIn, HTTPServer):

Julien Palard

8bcfa02

2018-03-23 17:40:33 +0100

[diff] [blame]

143

daemon_threads = True

144

145

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

146

class BaseHTTPRequestHandler(socketserver.StreamRequestHandler):

147

148

"""HTTP request handler base class.

149

150

The following explanation of HTTP serves to guide you through the

151

code as well as to expose any misunderstandings I may have about

152

HTTP (so you don't need to read the code to figure out I'm wrong

153

:-).

154

155

HTTP (HyperText Transfer Protocol) is an extensible protocol on

156

top of a reliable stream transport (e.g. TCP/IP). The protocol

157

recognizes three parts to a request:

158

159

1. One line identifying the request type and path

160

2. An optional set of RFC-822-style headers

161

3. An optional data part

162

163

The headers and data are separated by a blank line.

164

165

The first line of the request has the form

where <command> is a (case-sensitive) keyword such as GET or POST,

170

<path> is a string containing path information for the request,

171

and <version> should be the string "HTTP/1.0" or "HTTP/1.1".

172

<path> is encoded using the URL encoding scheme (using %xx to signify

173

the ASCII character with hex code xx).

174

175

The specification specifies that lines are separated by CRLF but

176

for compatibility with the widest range of clients recommends

177

servers also handle LF. Similarly, whitespace in the request line

178

is treated sensibly (allowing multiple spaces between components

179

and allowing trailing whitespace).

180

181

Similarly, for output, lines ought to be separated by CRLF pairs

182

but most clients grok LF characters just fine.

183

184

If the first line of the request has the form

(i.e. <version> is left out) then this is assumed to be an HTTP

189

0.9 request; this form has no optional headers and data part and

190

the reply consists of just the data.

191

192

The reply form of the HTTP 1.x protocol again has three parts:

193

194

1. One line giving the response code

195

2. An optional set of RFC-822-style headers

196

3. The data

197

198

Again, the headers and data are separated by a blank line.

199

200

The response code line has the form

where <version> is the protocol version ("HTTP/1.0" or "HTTP/1.1"),

205

<responsecode> is a 3-digit response code indicating success or

206

failure of the request, and <responsestring> is an optional

207

human-readable string explaining what the response code means.

208

209

This server parses the request and the headers, and then calls a

210

function specific to the request type (<command>). Specifically,

211

a request SPAM will be handled by a method do_SPAM(). If no

212

such method exists the server sends an error response to the

213

client. If it exists, it is called with no arguments:

do_SPAM()

Note that the request name is case sensitive (i.e. SPAM and spam

218

are different requests).

219

220

The various request details are stored in instance variables:

221

222

- client_address is the client IP address in the form (host,

223

port);

224

225

- command, path and version are the broken-down request line;

226

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

227

- headers is an instance of email.message.Message (or a derived

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

228

class) containing the header information;

229

230

- rfile is a file object open for reading positioned at the

231

start of the optional input data part;

232

233

- wfile is a file object open for writing.

234

235

IT IS IMPORTANT TO ADHERE TO THE PROTOCOL FOR WRITING!

236

237

The first thing to be written must be the response line. Then

238

follow 0 or more header lines, then a blank line, and then the

239

actual data (if any). The meaning of the header lines depends on

240

the command executed by the server; in most cases, when data is

241

returned, there should be at least one header line of the form

242

243

Content-type: <type>/<subtype>

244

245

where <type> and <subtype> should be registered MIME types,

246

e.g. "text/html" or "text/plain".

"""

# The Python system version, truncated to its first component.

251

sys_version = "Python/" + sys.version.split()[0]

252

253

# The server software version. You may want to override this.

254

# The format is multiple whitespace-separated strings,

255

# where each string is of the form name[/version].

256

server_version = "BaseHTTP/" + __version__

257

258

error_message_format = DEFAULT_ERROR_MESSAGE

259

error_content_type = DEFAULT_ERROR_CONTENT_TYPE

260

261

# The default request version. This only affects responses up until

262

# the point where the request line is parsed, so it mainly decides what

263

# the client gets back when sending a malformed request line.

264

# Most web servers default to HTTP 0.9, i.e. don't send a status line.

265

default_request_version = "HTTP/0.9"

266

267

def parse_request(self):

268

"""Parse a request (internal).

269

270

The request should be stored in self.raw_requestline; the results

271

are in self.command, self.path, self.request_version and

272

self.headers.

273

Martin Panter

2016-11-19 01:06:37 +0000

[diff] [blame]

274

Return True for success, False for failure; on failure, any relevant

275

error response has already been sent back.

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

276

277

"""

278

self.command = None # set in case of error on the first line

279

self.request_version = version = self.default_request_version

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

280

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

281

requestline = str(self.raw_requestline, 'iso-8859-1')

Senthil Kumaran

3075549

2011-12-23 17:03:41 +0800

[diff] [blame]

282

requestline = requestline.rstrip('\r\n')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

283

self.requestline = requestline

284

words = requestline.split()

Martin Panter

2016-11-19 01:06:37 +0000

[diff] [blame]

if len(words) == 0:

return False

if len(words) >= 3: # Enough to determine protocol version

289

version = words[-1]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

290

try:

Martin Panter

2016-11-19 01:06:37 +0000

[diff] [blame]

291

if not version.startswith('HTTP/'):

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

292

raise ValueError

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

293

base_version_number = version.split('/', 1)[1]

294

version_number = base_version_number.split(".")

295

# RFC 2145 section 3.1 says there can be only one "." and

296

# - major and minor numbers MUST be treated as

297

# separate integers;

298

# - HTTP/2.4 is a lower version than HTTP/2.13, which in

299

# turn is lower than HTTP/12.3;

300

# - Leading zeros MUST be ignored by recipients.

301

if len(version_number) != 2:

302

raise ValueError

303

version_number = int(version_number[0]), int(version_number[1])

304

except (ValueError, IndexError):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

305

self.send_error(

306

HTTPStatus.BAD_REQUEST,

307

"Bad request version (%r)" % version)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

308

return False

309

if version_number >= (1, 1) and self.protocol_version >= "HTTP/1.1":

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

310

self.close_connection = False

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

311

if version_number >= (2, 0):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

312

self.send_error(

313

HTTPStatus.HTTP_VERSION_NOT_SUPPORTED,

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

314

"Invalid HTTP version (%s)" % base_version_number)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

315

return False

Martin Panter

2016-11-19 01:06:37 +0000

[diff] [blame]

316

self.request_version = version

317

318

if not 2 <= len(words) <= 3:

319

self.send_error(

320

HTTPStatus.BAD_REQUEST,

321

"Bad request syntax (%r)" % requestline)

322

return False

323

command, path = words[:2]

324

if len(words) == 2:

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

325

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

326

if command != 'GET':

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

327

self.send_error(

328

HTTPStatus.BAD_REQUEST,

329

"Bad HTTP/0.9 request type (%r)" % command)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

330

return False

Martin Panter

2016-11-19 01:06:37 +0000

[diff] [blame]

331

self.command, self.path = command, path

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

332

333

# Examine the headers and look for a Connection directive.

Senthil Kumaran

5466bf1

2010-12-18 16:55:23 +0000

[diff] [blame]

334

try:

335

self.headers = http.client.parse_headers(self.rfile,

336

_class=self.MessageClass)

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

337

except http.client.LineTooLong as err:

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

338

self.send_error(

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

339

HTTPStatus.REQUEST_HEADER_FIELDS_TOO_LARGE,

340

"Line too long",

341

str(err))

Senthil Kumaran

5466bf1

2010-12-18 16:55:23 +0000

[diff] [blame]

342

return False

Martin Panter

acc0319

2016-04-03 00:45:46 +0000

[diff] [blame]

343

except http.client.HTTPException as err:

344

self.send_error(

345

HTTPStatus.REQUEST_HEADER_FIELDS_TOO_LARGE,

"Too many headers",

str(err)

)

return False

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

350

351

conntype = self.headers.get('Connection', "")

352

if conntype.lower() == 'close':

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

353

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

354

elif (conntype.lower() == 'keep-alive' and

355

self.protocol_version >= "HTTP/1.1"):

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

356

self.close_connection = False

Senthil Kumaran

0f476d4

2010-09-30 06:09:18 +0000

[diff] [blame]

357

# Examine the headers and look for an Expect directive

358

expect = self.headers.get('Expect', "")

359

if (expect.lower() == "100-continue" and

360

self.protocol_version >= "HTTP/1.1" and

361

self.request_version >= "HTTP/1.1"):

362

if not self.handle_expect_100():

return False

return True

def handle_expect_100(self):

367

"""Decide what to do with an "Expect: 100-continue" header.

368

369

If the client is expecting a 100 Continue response, we must

370

respond with either a 100 Continue or a final response before

371

waiting for the request body. The default is to always respond

372

with a 100 Continue. You can behave differently (for example,

373

reject unauthorized requests) by overriding this method.

374

375

This method should either return True (possibly after sending

376

a 100 Continue response) or send an error response and return

377

False.

378

379

"""

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

380

self.send_response_only(HTTPStatus.CONTINUE)

Benjamin Peterson

0442423

2014-01-18 21:50:18 -0500

[diff] [blame]

381

self.end_headers()

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

382

return True

383

384

def handle_one_request(self):

385

"""Handle a single HTTP request.

386

387

You normally don't need to override this method; see the class

388

__doc__ string for information on how to handle specific HTTP

389

commands such as GET and POST.

390

391

"""

Kristján Valur Jónsson

2009-07-01 10:01:31 +0000

[diff] [blame]

392

try:

Antoine Pitrou

c492437

2010-12-16 16:48:36 +0000

[diff] [blame]

393

self.raw_requestline = self.rfile.readline(65537)

394

if len(self.raw_requestline) > 65536:

395

self.requestline = ''

396

self.request_version = ''

397

self.command = ''

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

398

self.send_error(HTTPStatus.REQUEST_URI_TOO_LONG)

Antoine Pitrou

c492437

2010-12-16 16:48:36 +0000

[diff] [blame]

399

return

Kristján Valur Jónsson

2009-07-01 10:01:31 +0000

[diff] [blame]

400

if not self.raw_requestline:

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

401

self.close_connection = True

Kristján Valur Jónsson

2009-07-01 10:01:31 +0000

[diff] [blame]

402

return

403

if not self.parse_request():

404

# An error code has been sent, just exit

405

return

406

mname = 'do_' + self.command

407

if not hasattr(self, mname):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

408

self.send_error(

409

HTTPStatus.NOT_IMPLEMENTED,

410

"Unsupported method (%r)" % self.command)

Kristján Valur Jónsson

2009-07-01 10:01:31 +0000

[diff] [blame]

411

return

412

method = getattr(self, mname)

413

method()

414

self.wfile.flush() #actually send the response if not already done.

Christian Heimes

03c8ddd

2020-11-20 09:26:07 +0100

[diff] [blame]

415

except TimeoutError as e:

Kristján Valur Jónsson

2009-07-01 10:01:31 +0000

[diff] [blame]

416

#a read or a write timed out. Discard this connection

417

self.log_error("Request timed out: %r", e)

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

418

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

419

return

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

420

421

def handle(self):

422

"""Handle multiple requests if necessary."""

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

423

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

424

425

self.handle_one_request()

426

while not self.close_connection:

427

self.handle_one_request()

428

Senthil Kumaran

2688644

2013-03-15 07:53:21 -0700

[diff] [blame]

429

def send_error(self, code, message=None, explain=None):

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

430

"""Send and log an error reply.

431

Senthil Kumaran

2688644

2013-03-15 07:53:21 -0700

[diff] [blame]

432

Arguments are

433

* code: an HTTP error code

434

3 digits

435

* message: a simple optional 1 line reason phrase.

436

*( HTAB / SP / VCHAR / %x80-FF )

437

defaults to short entry matching the response code

438

* explain: a detailed message defaults to the long entry

439

matching the response code.

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

440

441

This sends an error response (so it must be called before any

442

output has been generated), logs the error, and finally sends

443

a piece of HTML explaining the error to the user.

"""

try:

shortmsg, longmsg = self.responses[code]

449

except KeyError:

450

shortmsg, longmsg = '???', '???'

451

if message is None:

452

message = shortmsg

Senthil Kumaran

2688644

2013-03-15 07:53:21 -0700

[diff] [blame]

453

if explain is None:

454

explain = longmsg

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

455

self.log_error("code %d, message %s", code, message)

Senthil Kumaran

1e7551d

2013-03-05 02:25:58 -0800

[diff] [blame]

456

self.send_response(code, message)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

457

self.send_header('Connection', 'close')

Martin Panter

e42e129

2016-06-08 08:29:13 +0000

[diff] [blame]

458

459

# Message body is omitted for cases described in:

460

# - RFC7230: 3.3. 1xx, 204(No Content), 304(Not Modified)

461

# - RFC7231: 6.3.6. 205(Reset Content)

462

body = None

463

if (code >= 200 and

464

code not in (HTTPStatus.NO_CONTENT,

465

HTTPStatus.RESET_CONTENT,

466

HTTPStatus.NOT_MODIFIED)):

467

# HTML encode to prevent Cross Site Scripting attacks

468

# (see bug #1100201)

469

content = (self.error_message_format % {

470

'code': code,

Martin Panter

40de69a

2016-06-08 09:45:58 +0000

[diff] [blame]

471

'message': html.escape(message, quote=False),

472

'explain': html.escape(explain, quote=False)

Martin Panter

e42e129

2016-06-08 08:29:13 +0000

[diff] [blame]

473

})

474

body = content.encode('UTF-8', 'replace')

475

self.send_header("Content-Type", self.error_content_type)

ValeriyaSinevich

b36b0a3

2018-06-18 14:17:53 -0700

[diff] [blame]

476

self.send_header('Content-Length', str(len(body)))

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

477

self.end_headers()

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

478

Martin Panter

e42e129

2016-06-08 08:29:13 +0000

[diff] [blame]

479

if self.command != 'HEAD' and body:

Senthil Kumaran

52d2720

2012-10-10 23:16:21 -0700

[diff] [blame]

480

self.wfile.write(body)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

481

482

def send_response(self, code, message=None):

Senthil Kumaran

2011-05-09 23:25:02 +0800

[diff] [blame]

483

"""Add the response header to the headers buffer and log the

484

response code.

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

485

486

Also send two standard headers with the server software

487

version and the current date.

488

489

"""

490

self.log_request(code)

Senthil Kumaran

0f476d4

2010-09-30 06:09:18 +0000

[diff] [blame]

491

self.send_response_only(code, message)

492

self.send_header('Server', self.version_string())

493

self.send_header('Date', self.date_time_string())

494

495

def send_response_only(self, code, message=None):

496

"""Send the response header only."""

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

497

if self.request_version != 'HTTP/0.9':

Martin Panter

2016-04-03 01:28:53 +0000

[diff] [blame]

498

if message is None:

499

if code in self.responses:

500

message = self.responses[code][0]

501

else:

502

message = ''

Senthil Kumaran

2011-05-09 23:25:02 +0800

[diff] [blame]

503

if not hasattr(self, '_headers_buffer'):

504

self._headers_buffer = []

505

self._headers_buffer.append(("%s %d %s\r\n" %

506

(self.protocol_version, code, message)).encode(

507

'latin-1', 'strict'))

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

508

509

def send_header(self, keyword, value):

Senthil Kumaran

2011-05-09 23:25:02 +0800

[diff] [blame]

510

"""Send a MIME header to the headers buffer."""

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

511

if self.request_version != 'HTTP/0.9':

Senthil Kumaran

e4dad4f

2010-11-21 14:36:14 +0000

[diff] [blame]

512

if not hasattr(self, '_headers_buffer'):

513

self._headers_buffer = []

514

self._headers_buffer.append(

Marc-André Lemburg

8f36af7

2011-02-25 15:42:01 +0000

[diff] [blame]

515

("%s: %s\r\n" % (keyword, value)).encode('latin-1', 'strict'))

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

516

517

if keyword.lower() == 'connection':

518

if value.lower() == 'close':

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

519

self.close_connection = True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

520

elif value.lower() == 'keep-alive':

Benjamin Peterson

2015-02-17 21:11:10 -0500

[diff] [blame]

521

self.close_connection = False

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

522

523

def end_headers(self):

524

"""Send the blank line ending the MIME headers."""

525

if self.request_version != 'HTTP/0.9':

Senthil Kumaran

e4dad4f

2010-11-21 14:36:14 +0000

[diff] [blame]

526

self._headers_buffer.append(b"\r\n")

Senthil Kumaran

2011-05-09 23:25:02 +0800

[diff] [blame]

527

self.flush_headers()

528

529

def flush_headers(self):

530

if hasattr(self, '_headers_buffer'):

Senthil Kumaran

e4dad4f

2010-11-21 14:36:14 +0000

[diff] [blame]

531

self.wfile.write(b"".join(self._headers_buffer))

532

self._headers_buffer = []

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

533

534

def log_request(self, code='-', size='-'):

535

"""Log an accepted request.

536

537

This is called by send_response().

538

539

"""

Serhiy Storchaka

c0a23e6

2015-03-07 11:51:37 +0200

[diff] [blame]

540

if isinstance(code, HTTPStatus):

541

code = code.value

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

542

self.log_message('"%s" %s %s',

543

self.requestline, str(code), str(size))

544

545

def log_error(self, format, *args):

546

"""Log an error.

547

548

This is called when a request cannot be fulfilled. By

549

default it passes the message on to log_message().

550

551

Arguments are the same as for log_message().

552

553

XXX This should go to the separate error log.

"""

self.log_message(format, *args)

558

559

def log_message(self, format, *args):

560

"""Log an arbitrary message.

561

562

This is used by all other logging functions. Override

563

it if you have specific logging wishes.

564

565

The first argument, FORMAT, is a format string for the

566

message to be logged. If the format string contains

567

any % escapes requiring parameters, they should be

568

specified as subsequent arguments (it's just like

569

printf!).

570

Senthil Kumaran

db727b4

2012-04-29 13:41:03 +0800

[diff] [blame]

571

The client ip and current date/time are prefixed to

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

every message.

"""

sys.stderr.write("%s - - [%s] %s\n" %

577

(self.address_string(),

578

self.log_date_time_string(),

579

format%args))

580

581

def version_string(self):

582

"""Return the server software version string."""

583

return self.server_version + ' ' + self.sys_version

584

585

def date_time_string(self, timestamp=None):

586

"""Return the current date and time formatted for a message header."""

587

if timestamp is None:

588

timestamp = time.time()

Berker Peksag

04bc5b9

2016-03-14 06:06:03 +0200

[diff] [blame]

589

return email.utils.formatdate(timestamp, usegmt=True)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

590

591

def log_date_time_string(self):

592

"""Return the current time formatted for logging."""

593

now = time.time()

594

year, month, day, hh, mm, ss, x, y, z = time.localtime(now)

595

s = "%02d/%3s/%04d %02d:%02d:%02d" % (

596

day, self.monthname[month], year, hh, mm, ss)

597

return s

598

599

weekdayname = ['Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat', 'Sun']

600

601

monthname = [None,

602

'Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun',

603

'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec']

604

605

def address_string(self):

Senthil Kumaran

1aacba4

2012-04-29 12:51:54 +0800

[diff] [blame]

606

"""Return the client address."""

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

607

Senthil Kumaran

1aacba4

2012-04-29 12:51:54 +0800

[diff] [blame]

608

return self.client_address[0]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

609

610

# Essentially static class variables

611

612

# The version of the HTTP protocol we support.

613

# Set this to HTTP/1.1 to enable automatic keepalive

614

protocol_version = "HTTP/1.0"

615

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

616

# MessageClass used to parse headers

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

617

MessageClass = http.client.HTTPMessage

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

618

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

619

# hack to maintain backwards compatibility

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

620

responses = {

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

621

v: (v.phrase, v.description)

622

for v in HTTPStatus.__members__.values()

623

}

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

624

625

626

class SimpleHTTPRequestHandler(BaseHTTPRequestHandler):

627

628

"""Simple HTTP request handler with GET and HEAD commands.

629

630

This serves files from the current directory and any of its

631

subdirectories. The MIME type for files is determined by

632

calling the .guess_type() method.

633

634

The GET and HEAD requests are identical except that the HEAD

635

request omits the actual contents of the file.

"""

server_version = "SimpleHTTP/" + __version__

An Long

5907e61

2020-01-09 02:28:14 +0800

[diff] [blame]

640

extensions_map = _encodings_map_default = {

641

'.gz': 'application/gzip',

642

'.Z': 'application/octet-stream',

643

'.bz2': 'application/x-bzip2',

644

'.xz': 'application/x-xz',

645

}

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

646

Stéphane Wirtel

2017-05-24 09:29:06 +0200

[diff] [blame]

647

def __init__(self, *args, directory=None, **kwargs):

648

if directory is None:

649

directory = os.getcwd()

Géry Ogam

781266e

2019-09-11 15:03:46 +0200

[diff] [blame]

650

self.directory = os.fspath(directory)

Stéphane Wirtel

2017-05-24 09:29:06 +0200

[diff] [blame]

651

super().__init__(*args, **kwargs)

652

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

653

def do_GET(self):

654

"""Serve a GET request."""

655

f = self.send_head()

656

if f:

Serhiy Storchaka

2014-01-25 19:43:02 +0200

[diff] [blame]

657

try:

658

self.copyfile(f, self.wfile)

659

finally:

660

f.close()

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

661

662

def do_HEAD(self):

663

"""Serve a HEAD request."""

f = self.send_head()

if f:

f.close()

def send_head(self):

"""Common code for GET and HEAD commands.

670

671

This sends the response code and MIME headers.

672

673

Return value is either a file object (which has to be copied

674

to the outputfile by the caller unless the command was HEAD,

675

and must be closed by the caller under all circumstances), or

676

None, in which case the caller has nothing further to do.

677

678

"""

679

path = self.translate_path(self.path)

680

f = None

681

if os.path.isdir(path):

Benjamin Peterson

94cb7a2

2014-12-26 10:53:43 -0600

[diff] [blame]

682

parts = urllib.parse.urlsplit(self.path)

683

if not parts.path.endswith('/'):

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

684

# redirect browser - doing basically what apache does

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

685

self.send_response(HTTPStatus.MOVED_PERMANENTLY)

Benjamin Peterson

94cb7a2

2014-12-26 10:53:43 -0600

[diff] [blame]

686

new_parts = (parts[0], parts[1], parts[2] + '/',

687

parts[3], parts[4])

688

new_url = urllib.parse.urlunsplit(new_parts)

689

self.send_header("Location", new_url)

Miss Islington (bot)

058f9b2

2021-05-06 12:48:36 -0700

[diff] [blame]

690

self.send_header("Content-Length", "0")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

691

self.end_headers()

692

return None

693

for index in "index.html", "index.htm":

694

index = os.path.join(path, index)

695

if os.path.exists(index):

path = index

break

else:

return self.list_directory(path)

700

ctype = self.guess_type(path)

Michael Felt

2062a20

2018-12-26 06:43:42 +0100

[diff] [blame]

701

# check for trailing "/" which should return 404. See Issue17324

702

# The test for this was added in test_httpserver.py

703

# However, some OS platforms accept a trailingSlash as a filename

704

# See discussion on python-dev and Issue34711 regarding

705

# parseing and rejection of filenames with a trailing slash

706

if path.endswith("/"):

707

self.send_error(HTTPStatus.NOT_FOUND, "File not found")

708

return None

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

709

try:

710

f = open(path, 'rb')

Andrew Svetlov

f7a17b4

2012-12-25 16:47:37 +0200

[diff] [blame]

711

except OSError:

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

712

self.send_error(HTTPStatus.NOT_FOUND, "File not found")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

713

return None

Pierre Quentel

2017-04-02 12:26:12 +0200

[diff] [blame]

714

Serhiy Storchaka

2014-01-25 19:43:02 +0200

[diff] [blame]

715

try:

Pierre Quentel

2017-04-02 12:26:12 +0200

[diff] [blame]

716

fs = os.fstat(f.fileno())

717

# Use browser cache if possible

718

if ("If-Modified-Since" in self.headers

719

and "If-None-Match" not in self.headers):

720

# compare If-Modified-Since and time of last file modification

721

try:

722

ims = email.utils.parsedate_to_datetime(

723

self.headers["If-Modified-Since"])

724

except (TypeError, IndexError, OverflowError, ValueError):

725

# ignore ill-formed values

726

pass

727

else:

728

if ims.tzinfo is None:

729

# obsolete format with no timezone, cf.

730

# https://tools.ietf.org/html/rfc7231#section-7.1.1.1

731

ims = ims.replace(tzinfo=datetime.timezone.utc)

732

if ims.tzinfo is datetime.timezone.utc:

733

# compare to UTC datetime of last modification

734

last_modif = datetime.datetime.fromtimestamp(

735

fs.st_mtime, datetime.timezone.utc)

736

# remove microseconds, like in If-Modified-Since

737

last_modif = last_modif.replace(microsecond=0)

Serhiy Storchaka

13ad3b7

2017-09-14 09:38:36 +0300

[diff] [blame]

738

Pierre Quentel

2017-04-02 12:26:12 +0200

[diff] [blame]

739

if last_modif <= ims:

740

self.send_response(HTTPStatus.NOT_MODIFIED)

self.end_headers()

f.close()

return None

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

745

self.send_response(HTTPStatus.OK)

Serhiy Storchaka

2014-01-25 19:43:02 +0200

[diff] [blame]

746

self.send_header("Content-type", ctype)

Serhiy Storchaka

2014-01-25 19:43:02 +0200

[diff] [blame]

747

self.send_header("Content-Length", str(fs[6]))

Serhiy Storchaka

13ad3b7

2017-09-14 09:38:36 +0300

[diff] [blame]

748

self.send_header("Last-Modified",

Pierre Quentel

2017-04-02 12:26:12 +0200

[diff] [blame]

749

self.date_time_string(fs.st_mtime))

Serhiy Storchaka

2014-01-25 19:43:02 +0200

[diff] [blame]

self.end_headers()

return f

except:

f.close()

raise

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

755

756

def list_directory(self, path):

757

"""Helper to produce a directory listing (absent index.html).

758

759

Return value is either a file object, or None (indicating an

760

error). In either case, the headers are sent, making the

761

interface the same as for send_head().

"""

try:

list = os.listdir(path)

Andrew Svetlov

ad28c7f

2012-12-18 22:02:39 +0200

[diff] [blame]

766

except OSError:

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

767

self.send_error(

768

HTTPStatus.NOT_FOUND,

769

"No permission to list directory")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

770

return None

771

list.sort(key=lambda a: a.lower())

772

r = []

Serhiy Storchaka

2014-08-17 08:22:11 +0300

[diff] [blame]

773

try:

774

displaypath = urllib.parse.unquote(self.path,

775

errors='surrogatepass')

776

except UnicodeDecodeError:

777

displaypath = urllib.parse.unquote(path)

Martin Panter

da3bb38

2016-04-11 00:40:08 +0000

[diff] [blame]

778

displaypath = html.escape(displaypath, quote=False)

Ezio Melotti

2011-11-02 19:33:29 +0200

[diff] [blame]

779

enc = sys.getfilesystemencoding()

780

title = 'Directory listing for %s' % displaypath

781

r.append('<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" '

782

'"http://www.w3.org/TR/html4/strict.dtd">')

783

r.append('<html>\n<head>')

784

r.append('<meta http-equiv="Content-Type" '

785

'content="text/html; charset=%s">' % enc)

786

r.append('<title>%s</title>\n</head>' % title)

787

r.append('<body>\n<h1>%s</h1>' % title)

788

r.append('<hr>\n<ul>')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

789

for name in list:

790

fullname = os.path.join(path, name)

791

displayname = linkname = name

792

# Append / for directories or @ for symbolic links

793

if os.path.isdir(fullname):

794

displayname = name + "/"

795

linkname = name + "/"

796

if os.path.islink(fullname):

797

displayname = name + "@"

798

# Note: a link to a directory displays with @ and links with /

Ezio Melotti

2011-11-02 19:33:29 +0200

[diff] [blame]

799

r.append('<li><a href="%s">%s</a></li>'

Serhiy Storchaka

2014-08-17 08:22:11 +0300

[diff] [blame]

800

% (urllib.parse.quote(linkname,

801

errors='surrogatepass'),

Martin Panter

da3bb38

2016-04-11 00:40:08 +0000

[diff] [blame]

802

html.escape(displayname, quote=False)))

Ezio Melotti

2011-11-02 19:33:29 +0200

[diff] [blame]

803

r.append('</ul>\n<hr>\n</body>\n</html>\n')

Serhiy Storchaka

2014-08-17 08:22:11 +0300

[diff] [blame]

804

encoded = '\n'.join(r).encode(enc, 'surrogateescape')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

805

f = io.BytesIO()

806

f.write(encoded)

807

f.seek(0)

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

808

self.send_response(HTTPStatus.OK)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

809

self.send_header("Content-type", "text/html; charset=%s" % enc)

810

self.send_header("Content-Length", str(len(encoded)))

self.end_headers()

return f

def translate_path(self, path):

815

"""Translate a /-separated PATH to the local filename syntax.

816

817

Components that mean special things to the local file system

818

(e.g. drive or directory names) are ignored. (XXX They should

819

probably be diagnosed.)

820

821

"""

822

# abandon query parameters

823

path = path.split('?',1)[0]

824

path = path.split('#',1)[0]

Senthil Kumaran

72c238e

2013-09-13 00:21:18 -0700

[diff] [blame]

825

# Don't forget explicit trailing slash when normalizing. Issue17324

Senthil Kumaran

600b735

2013-09-29 18:59:04 -0700

[diff] [blame]

826

trailing_slash = path.rstrip().endswith('/')

Serhiy Storchaka

2014-08-17 08:22:11 +0300

[diff] [blame]

827

try:

828

path = urllib.parse.unquote(path, errors='surrogatepass')

829

except UnicodeDecodeError:

830

path = urllib.parse.unquote(path)

831

path = posixpath.normpath(path)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

832

words = path.split('/')

833

words = filter(None, words)

Stéphane Wirtel

2017-05-24 09:29:06 +0200

[diff] [blame]

834

path = self.directory

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

835

for word in words:

Martin Panter

d274b3f

2016-04-18 03:45:18 +0000

[diff] [blame]

836

if os.path.dirname(word) or word in (os.curdir, os.pardir):

837

# Ignore components that are not a simple file/directory name

838

continue

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

839

path = os.path.join(path, word)

Senthil Kumaran

72c238e

2013-09-13 00:21:18 -0700

[diff] [blame]

840

if trailing_slash:

841

path += '/'

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

842

return path

843

844

def copyfile(self, source, outputfile):

845

"""Copy all data between two file objects.

846

847

The SOURCE argument is a file object open for reading

848

(or anything with a read() method) and the DESTINATION

849

argument is a file object open for writing (or

850

anything with a write() method).

851

852

The only reason for overriding this would be to change

853

the block size or perhaps to replace newlines by CRLF

854

-- note however that this the default server uses this

855

to copy binary data as well.

856

857

"""

858

shutil.copyfileobj(source, outputfile)

859

860

def guess_type(self, path):

861

"""Guess the type of a file.

862

863

Argument is a PATH (a filename).

864

865

Return value is a string of the form type/subtype,

866

usable for a MIME Content-type header.

867

868

The default implementation looks the file's extension

869

up in the table self.extensions_map, using application/octet-stream

870

as a default; however it would be permissible (if

871

slow) to look inside the data to make a better guess.

872

873

"""

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

874

base, ext = posixpath.splitext(path)

875

if ext in self.extensions_map:

876

return self.extensions_map[ext]

877

ext = ext.lower()

878

if ext in self.extensions_map:

879

return self.extensions_map[ext]

An Long

5907e61

2020-01-09 02:28:14 +0800

[diff] [blame]

880

guess, _ = mimetypes.guess_type(path)

881

if guess:

882

return guess

883

return 'application/octet-stream'

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

884

885

886

# Utilities for CGIHTTPRequestHandler

887

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

888

def _url_collapse_path(path):

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

889

"""

890

Given a URL path, remove extra '/'s and '.' path elements and collapse

Martin Panter

9955a37

2015-10-07 10:26:23 +0000

[diff] [blame]

891

any '..' references and returns a collapsed path.

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

892

893

Implements something akin to RFC-2396 5.2 step 6 to parse relative paths.

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

894

The utility of this function is limited to is_cgi method and helps

895

preventing some security attacks.

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

896

Martin Panter

2015-10-03 05:55:46 +0000

[diff] [blame]

897

Returns: The reconstituted URL, which will always start with a '/'.

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

898

899

Raises: IndexError if too many '..' occur within the path.

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

900

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

901

"""

Martin Panter

2015-10-03 05:55:46 +0000

[diff] [blame]

902

# Query component should not be involved.

903

path, _, query = path.partition('?')

904

path = urllib.parse.unquote(path)

905

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

906

# Similar to os.path.split(os.path.normpath(path)) but specific to URL

907

# path semantics rather than local operating system semantics.

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

908

path_parts = path.split('/')

909

head_parts = []

910

for part in path_parts[:-1]:

911

if part == '..':

912

head_parts.pop() # IndexError if more '..' than prior parts

913

elif part and part != '.':

914

head_parts.append( part )

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

915

if path_parts:

Senthil Kumaran

dbb369d

2012-04-11 03:15:28 +0800

[diff] [blame]

916

tail_part = path_parts.pop()

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

917

if tail_part:

918

if tail_part == '..':

919

head_parts.pop()

920

tail_part = ''

921

elif tail_part == '.':

922

tail_part = ''

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

923

else:

924

tail_part = ''

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

925

Martin Panter

2015-10-03 05:55:46 +0000

[diff] [blame]

926

if query:

927

tail_part = '?'.join((tail_part, query))

928

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

929

splitpath = ('/' + '/'.join(head_parts), tail_part)

930

collapsed_path = "/".join(splitpath)

931

932

return collapsed_path

933

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

934

935

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

nobody = None

def nobody_uid():

"""Internal routine to get nobody's uid"""

global nobody

if nobody:

return nobody

try:

import pwd

Brett Cannon

cd171c8

2013-07-04 17:43:24 -0400

[diff] [blame]

945

except ImportError:

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

946

return -1

947

try:

948

nobody = pwd.getpwnam('nobody')[2]

949

except KeyError:

Georg Brandl

cbd2ab1

2010-12-04 10:39:14 +0000

[diff] [blame]

950

nobody = 1 + max(x[2] for x in pwd.getpwall())

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

return nobody

def executable(path):

955

"""Test for executable file."""

Victor Stinner

fb25ba9

2011-06-20 17:45:54 +0200

[diff] [blame]

956

return os.access(path, os.X_OK)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

957

958

959

class CGIHTTPRequestHandler(SimpleHTTPRequestHandler):

960

961

"""Complete HTTP server with GET, HEAD and POST commands.

962

963

GET and HEAD also support running CGI scripts.

964

965

The POST command is *only* implemented for CGI scripts.

"""

# Determine platform specifics

970

have_fork = hasattr(os, 'fork')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

971

972

# Make rfile unbuffered -- we need to read one line and then pass

973

# the rest to a subprocess, so we can't use buffered input.

rbufsize = 0

def do_POST(self):

"""Serve a POST request.

978

979

This is only implemented for CGI scripts.

"""

if self.is_cgi():

self.run_cgi()

else:

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

986

self.send_error(

987

HTTPStatus.NOT_IMPLEMENTED,

988

"Can only POST to CGI scripts")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

989

990

def send_head(self):

991

"""Version of send_head that support CGI scripts"""

992

if self.is_cgi():

993

return self.run_cgi()

994

else:

995

return SimpleHTTPRequestHandler.send_head(self)

996

997

def is_cgi(self):

998

"""Test whether self.path corresponds to a CGI script.

999

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

1000

Returns True and updates the cgi_info attribute to the tuple

1001

(dir, rest) if self.path requires running a CGI script.

1002

Returns False otherwise.

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1003

Benjamin Peterson

a7deeee

2009-05-08 20:54:42 +0000

[diff] [blame]

1004

If any exception is raised, the caller should assume that

1005

self.path was rejected as invalid and act accordingly.

1006

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

1007

The default implementation tests whether the normalized url

1008

path begins with one of the strings in self.cgi_directories

1009

(and the next character is a '/' or the end of the string).

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1010

1011

"""

Martin Panter

2015-10-03 05:55:46 +0000

[diff] [blame]

1012

collapsed_path = _url_collapse_path(self.path)

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

1013

dir_sep = collapsed_path.find('/', 1)

Siwon Kang

91daa9d

2019-11-22 18:13:05 +0900

[diff] [blame]

1014

while dir_sep > 0 and not collapsed_path[:dir_sep] in self.cgi_directories:

1015

dir_sep = collapsed_path.find('/', dir_sep+1)

1016

if dir_sep > 0:

1017

head, tail = collapsed_path[:dir_sep], collapsed_path[dir_sep+1:]

Senthil Kumaran

dbb369d

2012-04-11 03:15:28 +0800

[diff] [blame]

1018

self.cgi_info = head, tail

Benjamin Peterson

2009-04-11 20:12:10 +0000

[diff] [blame]

1019

return True

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1020

return False

1021

Senthil Kumaran

2012-04-12 02:34:32 +0800

[diff] [blame]

1022

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1023

cgi_directories = ['/cgi-bin', '/htbin']

1024

1025

def is_executable(self, path):

1026

"""Test whether argument path is an executable file."""

1027

return executable(path)

1028

1029

def is_python(self, path):

1030

"""Test whether argument path is a Python script."""

1031

head, tail = os.path.splitext(path)

1032

return tail.lower() in (".py", ".pyw")

1033

1034

def run_cgi(self):

1035

"""Execute a CGI script."""

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1036

dir, rest = self.cgi_info

Ned Deily

915a30f

2014-07-12 22:06:26 -0700

[diff] [blame]

1037

path = dir + '/' + rest

1038

i = path.find('/', len(dir)+1)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1039

while i >= 0:

Ned Deily

915a30f

2014-07-12 22:06:26 -0700

[diff] [blame]

1040

nextdir = path[:i]

1041

nextrest = path[i+1:]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1042

1043

scriptdir = self.translate_path(nextdir)

1044

if os.path.isdir(scriptdir):

1045

dir, rest = nextdir, nextrest

Ned Deily

915a30f

2014-07-12 22:06:26 -0700

[diff] [blame]

1046

i = path.find('/', len(dir)+1)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

else:

break

# find an explicit query string, if present.

Martin Panter

a02e18a

2015-10-03 05:38:07 +0000

[diff] [blame]

1051

rest, _, query = rest.partition('?')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1052

1053

# dissect the part after the directory name into a script name &

1054

# a possible additional path, to be stored in PATH_INFO.

1055

i = rest.find('/')

1056

if i >= 0:

1057

script, rest = rest[:i], rest[i:]

1058

else:

1059

script, rest = rest, ''

1060

1061

scriptname = dir + '/' + script

1062

scriptfile = self.translate_path(scriptname)

1063

if not os.path.exists(scriptfile):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

1064

self.send_error(

1065

HTTPStatus.NOT_FOUND,

1066

"No such CGI script (%r)" % scriptname)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1067

return

1068

if not os.path.isfile(scriptfile):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

1069

self.send_error(

1070

HTTPStatus.FORBIDDEN,

1071

"CGI script is not a plain file (%r)" % scriptname)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1072

return

1073

ispy = self.is_python(scriptname)

Victor Stinner

fb25ba9

2011-06-20 17:45:54 +0200

[diff] [blame]

1074

if self.have_fork or not ispy:

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1075

if not self.is_executable(scriptfile):

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

1076

self.send_error(

1077

HTTPStatus.FORBIDDEN,

1078

"CGI script is not executable (%r)" % scriptname)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1079

return

1080

1081

# Reference: http://hoohoo.ncsa.uiuc.edu/cgi/env.html

1082

# XXX Much of the following could be prepared ahead of time!

Senthil Kumaran

4271372

2010-10-03 17:55:45 +0000

[diff] [blame]

1083

env = copy.deepcopy(os.environ)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1084

env['SERVER_SOFTWARE'] = self.version_string()

1085

env['SERVER_NAME'] = self.server.server_name

1086

env['GATEWAY_INTERFACE'] = 'CGI/1.1'

1087

env['SERVER_PROTOCOL'] = self.protocol_version

1088

env['SERVER_PORT'] = str(self.server.server_port)

1089

env['REQUEST_METHOD'] = self.command

Jeremy Hylton

1afc169

2008-06-18 20:49:58 +0000

[diff] [blame]

1090

uqrest = urllib.parse.unquote(rest)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1091

env['PATH_INFO'] = uqrest

1092

env['PATH_TRANSLATED'] = self.translate_path(uqrest)

1093

env['SCRIPT_NAME'] = scriptname

Senthil Kumaran

3ec9d01

2020-12-02 19:48:14 -0800

[diff] [blame]

1094

env['QUERY_STRING'] = query

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1095

env['REMOTE_ADDR'] = self.client_address[0]

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1096

authorization = self.headers.get("authorization")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1097

if authorization:

1098

authorization = authorization.split()

1099

if len(authorization) == 2:

1100

import base64, binascii

1101

env['AUTH_TYPE'] = authorization[0]

1102

if authorization[0].lower() == "basic":

1103

try:

1104

authorization = authorization[1].encode('ascii')

Georg Brandl

706824f

2009-06-04 09:42:55 +0000

[diff] [blame]

1105

authorization = base64.decodebytes(authorization).\

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1106

decode('ascii')

1107

except (binascii.Error, UnicodeError):

1108

pass

1109

else:

1110

authorization = authorization.split(':')

1111

if len(authorization) == 2:

1112

env['REMOTE_USER'] = authorization[0]

1113

# XXX REMOTE_IDENT

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1114

if self.headers.get('content-type') is None:

1115

env['CONTENT_TYPE'] = self.headers.get_content_type()

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1116

else:

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1117

env['CONTENT_TYPE'] = self.headers['content-type']

1118

length = self.headers.get('content-length')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1119

if length:

1120

env['CONTENT_LENGTH'] = length

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1121

referer = self.headers.get('referer')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1122

if referer:

1123

env['HTTP_REFERER'] = referer

Senthil Kumaran

da3d2ab

2020-12-05 05:26:24 -0800

[diff] [blame]

1124

accept = self.headers.get_all('accept', ())

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1125

env['HTTP_ACCEPT'] = ','.join(accept)

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1126

ua = self.headers.get('user-agent')

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1127

if ua:

1128

env['HTTP_USER_AGENT'] = ua

Barry Warsaw

2008-06-12 04:06:45 +0000

[diff] [blame]

1129

co = filter(None, self.headers.get_all('cookie', []))

Georg Brandl

62e2ca2

2010-07-31 21:54:24 +0000

[diff] [blame]

1130

cookie_str = ', '.join(co)

1131

if cookie_str:

1132

env['HTTP_COOKIE'] = cookie_str

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1133

# XXX Other HTTP_* headers

1134

# Since we're setting the env in the parent, provide empty

1135

# values to override previously set values

1136

for k in ('QUERY_STRING', 'REMOTE_HOST', 'CONTENT_LENGTH',

1137

'HTTP_USER_AGENT', 'HTTP_COOKIE', 'HTTP_REFERER'):

1138

env.setdefault(k, "")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1139

Serhiy Storchaka

2014-12-23 16:28:28 +0200

[diff] [blame]

1140

self.send_response(HTTPStatus.OK, "Script output follows")

Senthil Kumaran

2011-05-09 23:25:02 +0800

[diff] [blame]

1141

self.flush_headers()

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1142

1143

decoded_query = query.replace('+', ' ')

1144

1145

if self.have_fork:

1146

# Unix -- fork as we should

1147

args = [script]

1148

if '=' not in decoded_query:

1149

args.append(decoded_query)

1150

nobody = nobody_uid()

1151

self.wfile.flush() # Always flush before forking

pid = os.fork()

if pid != 0:

# Parent

pid, sts = os.waitpid(pid, 0)

1156

# throw away additional data [see bug #427345]

1157

while select.select([self.rfile], [], [], 0)[0]:

1158

if not self.rfile.read(1):

1159

break

Victor Stinner

9a679a0

2020-04-02 03:42:05 +0200

[diff] [blame]

1160

exitcode = os.waitstatus_to_exitcode(sts)

1161

if exitcode:

1162

self.log_error(f"CGI script exit code {exitcode}")

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

return

# Child

try:

try:

os.setuid(nobody)

Andrew Svetlov

ad28c7f

2012-12-18 22:02:39 +0200

[diff] [blame]

1168

except OSError:

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1169

pass

1170

os.dup2(self.rfile.fileno(), 0)

1171

os.dup2(self.wfile.fileno(), 1)

Senthil Kumaran

4271372

2010-10-03 17:55:45 +0000

[diff] [blame]

1172

os.execve(scriptfile, args, env)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1173

except:

1174

self.server.handle_error(self.request, self.client_address)

1175

os._exit(127)

1176

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1177

else:

1178

# Non-Unix -- use subprocess

1179

import subprocess

Senthil Kumaran

e29cd16

2009-11-11 04:17:53 +0000

[diff] [blame]

1180

cmdline = [scriptfile]

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1181

if self.is_python(scriptfile):

1182

interp = sys.executable

1183

if interp.lower().endswith("w.exe"):

1184

# On Windows, use python.exe, not pythonw.exe

1185

interp = interp[:-5] + interp[-4:]

Senthil Kumaran

e29cd16

2009-11-11 04:17:53 +0000

[diff] [blame]

1186

cmdline = [interp, '-u'] + cmdline

1187

if '=' not in query:

1188

cmdline.append(query)

1189

self.log_message("command: %s", subprocess.list2cmdline(cmdline))

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1190

try:

1191

nbytes = int(length)

1192

except (TypeError, ValueError):

1193

nbytes = 0

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1194

p = subprocess.Popen(cmdline,

1195

stdin=subprocess.PIPE,

1196

stdout=subprocess.PIPE,

Senthil Kumaran

4271372

2010-10-03 17:55:45 +0000

[diff] [blame]

1197

stderr=subprocess.PIPE,

1198

env = env

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1199

)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1200

if self.command.lower() == "post" and nbytes > 0:

1201

data = self.rfile.read(nbytes)

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1202

else:

1203

data = None

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1204

# throw away additional data [see bug #427345]

1205

while select.select([self.rfile._sock], [], [], 0)[0]:

1206

if not self.rfile._sock.recv(1):

1207

break

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1208

stdout, stderr = p.communicate(data)

1209

self.wfile.write(stdout)

1210

if stderr:

1211

self.log_error('%s', stderr)

Brian Curtin

cbad4df

2010-11-05 15:04:48 +0000

[diff] [blame]

1212

p.stderr.close()

1213

p.stdout.close()

Amaury Forgeot d'Arc

2008-06-18 22:19:22 +0000

[diff] [blame]

1214

status = p.returncode

1215

if status:

1216

self.log_error("CGI script exit status %#x", status)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1217

else:

1218

self.log_message("CGI script exited OK")

1219

1220

Jason R. Coombs

2019-02-07 08:22:45 -0500

[diff] [blame]

1221

def _get_best_family(*address):

1222

infos = socket.getaddrinfo(

1223

*address,

1224

type=socket.SOCK_STREAM,

1225

flags=socket.AI_PASSIVE,

1226

)

1227

family, type, proto, canonname, sockaddr = next(iter(infos))

1228

return family, sockaddr

1229

1230

Senthil Kumaran

defe7f4

2013-09-15 09:37:27 -0700

[diff] [blame]

1231

def test(HandlerClass=BaseHTTPRequestHandler,

Géry Ogam

1cee216

2018-05-29 22:10:30 +0200

[diff] [blame]

1232

ServerClass=ThreadingHTTPServer,

Jason R. Coombs

2019-02-07 08:22:45 -0500

[diff] [blame]

1233

protocol="HTTP/1.0", port=8000, bind=None):

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1234

"""Test the HTTP request handler class.

1235

Robert Collins

9644f24

2015-08-17 12:18:35 +1200

[diff] [blame]

1236

This runs an HTTP server on port 8000 (or the port argument).

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1237

1238

"""

Jason R. Coombs

2019-02-07 08:22:45 -0500

[diff] [blame]

1239

ServerClass.address_family, addr = _get_best_family(bind, port)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1240

HandlerClass.protocol_version = protocol

Jason R. Coombs

2019-02-07 08:22:45 -0500

[diff] [blame]

1241

with ServerClass(addr, HandlerClass) as httpd:

1242

host, port = httpd.socket.getsockname()[:2]

1243

url_host = f'[{host}]' if ':' in host else host

1244

print(

1245

f"Serving HTTP on {host} port {port} "

1246

f"(http://{url_host}:{port}/) ..."

1247

)

Martin Panter

0cab9c1

2016-04-13 00:36:52 +0000

[diff] [blame]

1248

try:

1249

httpd.serve_forever()

1250

except KeyboardInterrupt:

1251

print("\nKeyboard interrupt received, exiting.")

1252

sys.exit(0)

Georg Brandl

2008-05-26 16:32:26 +0000

[diff] [blame]

1253

1254

if __name__ == '__main__':

Serhiy Storchaka

7e4db2f

2017-05-04 08:17:47 +0300

[diff] [blame]

1255

import argparse

Miss Islington (bot)

2022-02-14 12:12:30 -0800

[diff] [blame^]

1256

import contextlib

Serhiy Storchaka

7e4db2f

2017-05-04 08:17:47 +0300

[diff] [blame]

1257

Senthil Kumaran

2012-06-03 16:15:54 +0800

[diff] [blame]

1258

parser = argparse.ArgumentParser()

1259

parser.add_argument('--cgi', action='store_true',

Miss Islington (bot)

2022-02-14 12:12:30 -0800

[diff] [blame^]

1260

help='run as CGI server')

Jason R. Coombs

2019-02-07 08:22:45 -0500

[diff] [blame]

1261

parser.add_argument('--bind', '-b', metavar='ADDRESS',

Miss Islington (bot)

2022-02-14 12:12:30 -0800

[diff] [blame^]

1262

help='specify alternate bind address '

1263

'(default: all interfaces)')

Stéphane Wirtel

2017-05-24 09:29:06 +0200

[diff] [blame]

1264

parser.add_argument('--directory', '-d', default=os.getcwd(),

Miss Islington (bot)

2022-02-14 12:12:30 -0800

[diff] [blame^]

1265

help='specify alternate directory '

1266

'(default: current directory)')

1267

parser.add_argument('port', action='store', default=8000, type=int,

Senthil Kumaran

2012-06-03 16:15:54 +0800

[diff] [blame]

1268

nargs='?',

Miss Islington (bot)

2022-02-14 12:12:30 -0800

[diff] [blame^]

1269

help='specify alternate port (default: 8000)')

Senthil Kumaran

2012-06-03 16:15:54 +0800

[diff] [blame]

1270

args = parser.parse_args()

1271

if args.cgi:

Senthil Kumaran

defe7f4

2013-09-15 09:37:27 -0700

[diff] [blame]

1272

handler_class = CGIHTTPRequestHandler

Senthil Kumaran

2012-06-03 16:15:54 +0800

[diff] [blame]

1273

else:

Miss Islington (bot)

2022-02-14 12:12:30 -0800

[diff] [blame^]

1274

handler_class = SimpleHTTPRequestHandler

Jason R. Coombs

2020-01-05 22:32:19 -0500

[diff] [blame]

1275

1276

# ensure dual-stack is not disabled; ref #38907

1277

class DualStackServer(ThreadingHTTPServer):

Miss Islington (bot)

2022-02-14 12:12:30 -0800

[diff] [blame^]

1278

Jason R. Coombs

2020-01-05 22:32:19 -0500

[diff] [blame]

1279

def server_bind(self):

Jason R. Coombs

7cdc31a

2020-01-06 07:59:36 -0500

[diff] [blame]

1280

# suppress exception when protocol is IPv4

1281

with contextlib.suppress(Exception):

1282

self.socket.setsockopt(

1283

socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 0)

Jason R. Coombs

2020-01-05 22:32:19 -0500

[diff] [blame]

1284

return super().server_bind()

1285

Miss Islington (bot)

2022-02-14 12:12:30 -0800

[diff] [blame^]

1286

def finish_request(self, request, client_address):

1287

self.RequestHandlerClass(request, client_address, self,

1288

directory=args.directory)

1289

Jason R. Coombs