Gitiles
Code Review Sign In
gerrit-public.fairphone.software / platform / external / python / cpython3 / f0c6cd3581831cb5f10fe8244bffb9c5f2a754b2 / . / Lib / http / server.py
blob: 47655e758aeb5b724177cde125feeb0a2ae66a6b [file] [log] [blame]
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1"""HTTP server classes.
2
3Note: BaseHTTPRequestHandler doesn't implement any HTTP request; see
4SimpleHTTPRequestHandler for simple implementations of GET, HEAD and POST,
5and CGIHTTPRequestHandler for CGI scripts.
6
7It does, however, optionally implement HTTP/1.1 persistent connections,
8as of version 0.3.
9
10Notes on CGIHTTPRequestHandler
11------------------------------
12
13This class implements GET and POST requests to cgi-bin scripts.
14
15If the os.fork() function is not present (e.g. on Windows),
Amaury Forgeot d'Arccb0d2d72008-06-18 22:19:22 +0000[diff] [blame]16subprocess.Popen() is used as a fallback, with slightly altered semantics.
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]17
18In all cases, the implementation is intentionally naive -- all
19requests are executed synchronously.
20
21SECURITY WARNING: DON'T USE THIS CODE UNLESS YOU ARE INSIDE A FIREWALL
22-- it may execute arbitrary Python code or external programs.
23
24Note that status code 200 is sent prior to execution of a CGI script, so
25scripts cannot send other status codes such as 302 (redirect).
26
27XXX To do:
28
29- log requests even later (to capture byte count)
30- log user-agent header and other interesting goodies
31- send error log to separate file
32"""
33
34
35# See also:
36#
37# HTTP Working Group T. Berners-Lee
38# INTERNET-DRAFT R. T. Fielding
39# <draft-ietf-http-v10-spec-00.txt> H. Frystyk Nielsen
40# Expires September 8, 1995 March 8, 1995
41#
42# URL: http://www.ics.uci.edu/pub/ietf/http/draft-ietf-http-v10-spec-00.txt
43#
44# and
45#
46# Network Working Group R. Fielding
47# Request for Comments: 2616 et al
48# Obsoletes: 2068 June 1999
49# Category: Standards Track
50#
51# URL: http://www.faqs.org/rfcs/rfc2616.html
52
53# Log files
54# ---------
55#
56# Here's a quote from the NCSA httpd docs about log file format.
57#
58# | The logfile format is as follows. Each line consists of:
59# |
60# | host rfc931 authuser [DD/Mon/YYYY:hh:mm:ss] "request" ddd bbbb
61# |
62# | host: Either the DNS name or the IP number of the remote client
63# | rfc931: Any information returned by identd for this person,
64# | - otherwise.
65# | authuser: If user sent a userid for authentication, the user name,
66# | - otherwise.
67# | DD: Day
68# | Mon: Month (calendar name)
69# | YYYY: Year
70# | hh: hour (24-hour format, the machine's timezone)
71# | mm: minutes
72# | ss: seconds
73# | request: The first line of the HTTP request as sent by the client.
74# | ddd: the status code returned by the server, - if not available.
75# | bbbb: the total number of bytes sent,
76# | *not including the HTTP/1.0 header*, - if not available
77# |
78# | You can determine the name of the file accessed through request.
79#
80# (Actually, the latter is only true if you know the server configuration
81# at the time the request was made!)
82
83__version__ = "0.6"
84
Berker Peksag366c5702015-02-13 20:48:15 +0200[diff] [blame]85__all__ = [
86 "HTTPServer", "BaseHTTPRequestHandler",
87 "SimpleHTTPRequestHandler", "CGIHTTPRequestHandler",
88]
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]89
Georg Brandl1f7fffb2010-10-15 15:57:45 +0000[diff] [blame]90import html
Jeremy Hylton914ab452009-03-27 17:16:06 +0000[diff] [blame]91import http.client
92import io
93import mimetypes
94import os
95import posixpath
96import select
97import shutil
98import socket # For gethostbyaddr()
99import socketserver
100import sys
101import time
102import urllib.parse
Senthil Kumaran42713722010-10-03 17:55:45 +0000[diff] [blame]103import copy
Senthil Kumaran1251faf2012-06-03 16:15:54 +0800[diff] [blame]104import argparse
105
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]106
107# Default error message template
108DEFAULT_ERROR_MESSAGE = """\
Senthil Kumaran1b407fe2011-03-20 10:44:30 +0800[diff] [blame]109<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
110 "http://www.w3.org/TR/html4/strict.dtd">
Ezio Melottica897e92011-11-02 19:33:29 +0200[diff] [blame]111<html>
Senthil Kumaranb253c9f2011-03-17 16:43:22 +0800[diff] [blame]112 <head>
Senthil Kumaran1b407fe2011-03-20 10:44:30 +0800[diff] [blame]113 <meta http-equiv="Content-Type" content="text/html;charset=utf-8">
Senthil Kumaranb253c9f2011-03-17 16:43:22 +0800[diff] [blame]114 <title>Error response</title>
115 </head>
116 <body>
117 <h1>Error response</h1>
118 <p>Error code: %(code)d</p>
119 <p>Message: %(message)s.</p>
120 <p>Error code explanation: %(code)s - %(explain)s.</p>
121 </body>
122</html>
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]123"""
124
125DEFAULT_ERROR_CONTENT_TYPE = "text/html;charset=utf-8"
126
127def _quote_html(html):
128 return html.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;")
129
130class HTTPServer(socketserver.TCPServer):
131
132 allow_reuse_address = 1 # Seems to make sense in testing environment
133
134 def server_bind(self):
135 """Override server_bind to store the server name."""
136 socketserver.TCPServer.server_bind(self)
137 host, port = self.socket.getsockname()[:2]
138 self.server_name = socket.getfqdn(host)
139 self.server_port = port
140
141
142class BaseHTTPRequestHandler(socketserver.StreamRequestHandler):
143
144 """HTTP request handler base class.
145
146 The following explanation of HTTP serves to guide you through the
147 code as well as to expose any misunderstandings I may have about
148 HTTP (so you don't need to read the code to figure out I'm wrong
149 :-).
150
151 HTTP (HyperText Transfer Protocol) is an extensible protocol on
152 top of a reliable stream transport (e.g. TCP/IP). The protocol
153 recognizes three parts to a request:
154
155 1. One line identifying the request type and path
156 2. An optional set of RFC-822-style headers
157 3. An optional data part
158
159 The headers and data are separated by a blank line.
160
161 The first line of the request has the form
162
163 <command> <path> <version>
164
165 where <command> is a (case-sensitive) keyword such as GET or POST,
166 <path> is a string containing path information for the request,
167 and <version> should be the string "HTTP/1.0" or "HTTP/1.1".
168 <path> is encoded using the URL encoding scheme (using %xx to signify
169 the ASCII character with hex code xx).
170
171 The specification specifies that lines are separated by CRLF but
172 for compatibility with the widest range of clients recommends
173 servers also handle LF. Similarly, whitespace in the request line
174 is treated sensibly (allowing multiple spaces between components
175 and allowing trailing whitespace).
176
177 Similarly, for output, lines ought to be separated by CRLF pairs
178 but most clients grok LF characters just fine.
179
180 If the first line of the request has the form
181
182 <command> <path>
183
184 (i.e. <version> is left out) then this is assumed to be an HTTP
185 0.9 request; this form has no optional headers and data part and
186 the reply consists of just the data.
187
188 The reply form of the HTTP 1.x protocol again has three parts:
189
190 1. One line giving the response code
191 2. An optional set of RFC-822-style headers
192 3. The data
193
194 Again, the headers and data are separated by a blank line.
195
196 The response code line has the form
197
198 <version> <responsecode> <responsestring>
199
200 where <version> is the protocol version ("HTTP/1.0" or "HTTP/1.1"),
201 <responsecode> is a 3-digit response code indicating success or
202 failure of the request, and <responsestring> is an optional
203 human-readable string explaining what the response code means.
204
205 This server parses the request and the headers, and then calls a
206 function specific to the request type (<command>). Specifically,
207 a request SPAM will be handled by a method do_SPAM(). If no
208 such method exists the server sends an error response to the
209 client. If it exists, it is called with no arguments:
210
211 do_SPAM()
212
213 Note that the request name is case sensitive (i.e. SPAM and spam
214 are different requests).
215
216 The various request details are stored in instance variables:
217
218 - client_address is the client IP address in the form (host,
219 port);
220
221 - command, path and version are the broken-down request line;
222
Barry Warsaw820c1202008-06-12 04:06:45 +0000[diff] [blame]223 - headers is an instance of email.message.Message (or a derived
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]224 class) containing the header information;
225
226 - rfile is a file object open for reading positioned at the
227 start of the optional input data part;
228
229 - wfile is a file object open for writing.
230
231 IT IS IMPORTANT TO ADHERE TO THE PROTOCOL FOR WRITING!
232
233 The first thing to be written must be the response line. Then
234 follow 0 or more header lines, then a blank line, and then the
235 actual data (if any). The meaning of the header lines depends on
236 the command executed by the server; in most cases, when data is
237 returned, there should be at least one header line of the form
238
239 Content-type: <type>/<subtype>
240
241 where <type> and <subtype> should be registered MIME types,
242 e.g. "text/html" or "text/plain".
243
244 """
245
246 # The Python system version, truncated to its first component.
247 sys_version = "Python/" + sys.version.split()[0]
248
249 # The server software version. You may want to override this.
250 # The format is multiple whitespace-separated strings,
251 # where each string is of the form name[/version].
252 server_version = "BaseHTTP/" + __version__
253
254 error_message_format = DEFAULT_ERROR_MESSAGE
255 error_content_type = DEFAULT_ERROR_CONTENT_TYPE
256
257 # The default request version. This only affects responses up until
258 # the point where the request line is parsed, so it mainly decides what
259 # the client gets back when sending a malformed request line.
260 # Most web servers default to HTTP 0.9, i.e. don't send a status line.
261 default_request_version = "HTTP/0.9"
262
263 def parse_request(self):
264 """Parse a request (internal).
265
266 The request should be stored in self.raw_requestline; the results
267 are in self.command, self.path, self.request_version and
268 self.headers.
269
270 Return True for success, False for failure; on failure, an
271 error is sent back.
272
273 """
274 self.command = None # set in case of error on the first line
275 self.request_version = version = self.default_request_version
Benjamin Peterson70e28472015-02-17 21:11:10 -0500[diff] [blame]276 self.close_connection = True
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]277 requestline = str(self.raw_requestline, 'iso-8859-1')
Senthil Kumaran30755492011-12-23 17:03:41 +0800[diff] [blame]278 requestline = requestline.rstrip('\r\n')
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]279 self.requestline = requestline
280 words = requestline.split()
281 if len(words) == 3:
Senthil Kumaran30755492011-12-23 17:03:41 +0800[diff] [blame]282 command, path, version = words
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]283 if version[:5] != 'HTTP/':
284 self.send_error(400, "Bad request version (%r)" % version)
285 return False
286 try:
287 base_version_number = version.split('/', 1)[1]
288 version_number = base_version_number.split(".")
289 # RFC 2145 section 3.1 says there can be only one "." and
290 # - major and minor numbers MUST be treated as
291 # separate integers;
292 # - HTTP/2.4 is a lower version than HTTP/2.13, which in
293 # turn is lower than HTTP/12.3;
294 # - Leading zeros MUST be ignored by recipients.
295 if len(version_number) != 2:
296 raise ValueError
297 version_number = int(version_number[0]), int(version_number[1])
298 except (ValueError, IndexError):
299 self.send_error(400, "Bad request version (%r)" % version)
300 return False
301 if version_number >= (1, 1) and self.protocol_version >= "HTTP/1.1":
Benjamin Peterson70e28472015-02-17 21:11:10 -0500[diff] [blame]302 self.close_connection = False
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]303 if version_number >= (2, 0):
304 self.send_error(505,
305 "Invalid HTTP Version (%s)" % base_version_number)
306 return False
307 elif len(words) == 2:
Senthil Kumaran30755492011-12-23 17:03:41 +0800[diff] [blame]308 command, path = words
Benjamin Peterson70e28472015-02-17 21:11:10 -0500[diff] [blame]309 self.close_connection = True
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]310 if command != 'GET':
311 self.send_error(400,
312 "Bad HTTP/0.9 request type (%r)" % command)
313 return False
314 elif not words:
315 return False
316 else:
317 self.send_error(400, "Bad request syntax (%r)" % requestline)
318 return False
319 self.command, self.path, self.request_version = command, path, version
320
321 # Examine the headers and look for a Connection directive.
Senthil Kumaran5466bf12010-12-18 16:55:23 +0000[diff] [blame]322 try:
323 self.headers = http.client.parse_headers(self.rfile,
324 _class=self.MessageClass)
325 except http.client.LineTooLong:
326 self.send_error(400, "Line too long")
327 return False
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]328
329 conntype = self.headers.get('Connection', "")
330 if conntype.lower() == 'close':
Benjamin Peterson70e28472015-02-17 21:11:10 -0500[diff] [blame]331 self.close_connection = True
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]332 elif (conntype.lower() == 'keep-alive' and
333 self.protocol_version >= "HTTP/1.1"):
Benjamin Peterson70e28472015-02-17 21:11:10 -0500[diff] [blame]334 self.close_connection = False
Senthil Kumaran0f476d42010-09-30 06:09:18 +0000[diff] [blame]335 # Examine the headers and look for an Expect directive
336 expect = self.headers.get('Expect', "")
337 if (expect.lower() == "100-continue" and
338 self.protocol_version >= "HTTP/1.1" and
339 self.request_version >= "HTTP/1.1"):
340 if not self.handle_expect_100():
341 return False
342 return True
343
344 def handle_expect_100(self):
345 """Decide what to do with an "Expect: 100-continue" header.
346
347 If the client is expecting a 100 Continue response, we must
348 respond with either a 100 Continue or a final response before
349 waiting for the request body. The default is to always respond
350 with a 100 Continue. You can behave differently (for example,
351 reject unauthorized requests) by overriding this method.
352
353 This method should either return True (possibly after sending
354 a 100 Continue response) or send an error response and return
355 False.
356
357 """
358 self.send_response_only(100)
Benjamin Peterson04424232014-01-18 21:50:18 -0500[diff] [blame]359 self.end_headers()
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]360 return True
361
362 def handle_one_request(self):
363 """Handle a single HTTP request.
364
365 You normally don't need to override this method; see the class
366 __doc__ string for information on how to handle specific HTTP
367 commands such as GET and POST.
368
369 """
Kristján Valur Jónsson985fc6a2009-07-01 10:01:31 +0000[diff] [blame]370 try:
Antoine Pitrouc4924372010-12-16 16:48:36 +0000[diff] [blame]371 self.raw_requestline = self.rfile.readline(65537)
372 if len(self.raw_requestline) > 65536:
373 self.requestline = ''
374 self.request_version = ''
375 self.command = ''
376 self.send_error(414)
377 return
Kristján Valur Jónsson985fc6a2009-07-01 10:01:31 +0000[diff] [blame]378 if not self.raw_requestline:
Benjamin Peterson70e28472015-02-17 21:11:10 -0500[diff] [blame]379 self.close_connection = True
Kristján Valur Jónsson985fc6a2009-07-01 10:01:31 +0000[diff] [blame]380 return
381 if not self.parse_request():
382 # An error code has been sent, just exit
383 return
384 mname = 'do_' + self.command
385 if not hasattr(self, mname):
386 self.send_error(501, "Unsupported method (%r)" % self.command)
387 return
388 method = getattr(self, mname)
389 method()
390 self.wfile.flush() #actually send the response if not already done.
391 except socket.timeout as e:
392 #a read or a write timed out. Discard this connection
393 self.log_error("Request timed out: %r", e)
Benjamin Peterson70e28472015-02-17 21:11:10 -0500[diff] [blame]394 self.close_connection = True
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]395 return
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]396
397 def handle(self):
398 """Handle multiple requests if necessary."""
Benjamin Peterson70e28472015-02-17 21:11:10 -0500[diff] [blame]399 self.close_connection = True
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]400
401 self.handle_one_request()
402 while not self.close_connection:
403 self.handle_one_request()
404
Senthil Kumaran26886442013-03-15 07:53:21 -0700[diff] [blame]405 def send_error(self, code, message=None, explain=None):
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]406 """Send and log an error reply.
407
Senthil Kumaran26886442013-03-15 07:53:21 -0700[diff] [blame]408 Arguments are
409 * code: an HTTP error code
410 3 digits
411 * message: a simple optional 1 line reason phrase.
412 *( HTAB / SP / VCHAR / %x80-FF )
413 defaults to short entry matching the response code
414 * explain: a detailed message defaults to the long entry
415 matching the response code.
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]416
417 This sends an error response (so it must be called before any
418 output has been generated), logs the error, and finally sends
419 a piece of HTML explaining the error to the user.
420
421 """
422
423 try:
424 shortmsg, longmsg = self.responses[code]
425 except KeyError:
426 shortmsg, longmsg = '???', '???'
427 if message is None:
428 message = shortmsg
Senthil Kumaran26886442013-03-15 07:53:21 -0700[diff] [blame]429 if explain is None:
430 explain = longmsg
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]431 self.log_error("code %d, message %s", code, message)
432 # using _quote_html to prevent Cross Site Scripting attacks (see bug #1100201)
433 content = (self.error_message_format %
Senthil Kumaran26886442013-03-15 07:53:21 -0700[diff] [blame]434 {'code': code, 'message': _quote_html(message), 'explain': _quote_html(explain)})
Senthil Kumaran52d27202012-10-10 23:16:21 -0700[diff] [blame]435 body = content.encode('UTF-8', 'replace')
Senthil Kumaran1e7551d2013-03-05 02:25:58 -0800[diff] [blame]436 self.send_response(code, message)
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]437 self.send_header("Content-Type", self.error_content_type)
438 self.send_header('Connection', 'close')
Senthil Kumaran52d27202012-10-10 23:16:21 -0700[diff] [blame]439 self.send_header('Content-Length', int(len(body)))
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]440 self.end_headers()
441 if self.command != 'HEAD' and code >= 200 and code not in (204, 304):
Senthil Kumaran52d27202012-10-10 23:16:21 -0700[diff] [blame]442 self.wfile.write(body)
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]443
444 def send_response(self, code, message=None):
Senthil Kumaranc7ae19b2011-05-09 23:25:02 +0800[diff] [blame]445 """Add the response header to the headers buffer and log the
446 response code.
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]447
448 Also send two standard headers with the server software
449 version and the current date.
450
451 """
452 self.log_request(code)
Senthil Kumaran0f476d42010-09-30 06:09:18 +0000[diff] [blame]453 self.send_response_only(code, message)
454 self.send_header('Server', self.version_string())
455 self.send_header('Date', self.date_time_string())
456
457 def send_response_only(self, code, message=None):
458 """Send the response header only."""
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]459 if message is None:
460 if code in self.responses:
461 message = self.responses[code][0]
462 else:
463 message = ''
464 if self.request_version != 'HTTP/0.9':
Senthil Kumaranc7ae19b2011-05-09 23:25:02 +0800[diff] [blame]465 if not hasattr(self, '_headers_buffer'):
466 self._headers_buffer = []
467 self._headers_buffer.append(("%s %d %s\r\n" %
468 (self.protocol_version, code, message)).encode(
469 'latin-1', 'strict'))
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]470
471 def send_header(self, keyword, value):
Senthil Kumaranc7ae19b2011-05-09 23:25:02 +0800[diff] [blame]472 """Send a MIME header to the headers buffer."""
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]473 if self.request_version != 'HTTP/0.9':
Senthil Kumarane4dad4f2010-11-21 14:36:14 +0000[diff] [blame]474 if not hasattr(self, '_headers_buffer'):
475 self._headers_buffer = []
476 self._headers_buffer.append(
Marc-André Lemburg8f36af72011-02-25 15:42:01 +0000[diff] [blame]477 ("%s: %s\r\n" % (keyword, value)).encode('latin-1', 'strict'))
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]478
479 if keyword.lower() == 'connection':
480 if value.lower() == 'close':
Benjamin Peterson70e28472015-02-17 21:11:10 -0500[diff] [blame]481 self.close_connection = True
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]482 elif value.lower() == 'keep-alive':
Benjamin Peterson70e28472015-02-17 21:11:10 -0500[diff] [blame]483 self.close_connection = False
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]484
485 def end_headers(self):
486 """Send the blank line ending the MIME headers."""
487 if self.request_version != 'HTTP/0.9':
Senthil Kumarane4dad4f2010-11-21 14:36:14 +0000[diff] [blame]488 self._headers_buffer.append(b"\r\n")
Senthil Kumaranc7ae19b2011-05-09 23:25:02 +0800[diff] [blame]489 self.flush_headers()
490
491 def flush_headers(self):
492 if hasattr(self, '_headers_buffer'):
Senthil Kumarane4dad4f2010-11-21 14:36:14 +0000[diff] [blame]493 self.wfile.write(b"".join(self._headers_buffer))
494 self._headers_buffer = []
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]495
496 def log_request(self, code='-', size='-'):
497 """Log an accepted request.
498
499 This is called by send_response().
500
501 """
502
503 self.log_message('"%s" %s %s',
504 self.requestline, str(code), str(size))
505
506 def log_error(self, format, *args):
507 """Log an error.
508
509 This is called when a request cannot be fulfilled. By
510 default it passes the message on to log_message().
511
512 Arguments are the same as for log_message().
513
514 XXX This should go to the separate error log.
515
516 """
517
518 self.log_message(format, *args)
519
520 def log_message(self, format, *args):
521 """Log an arbitrary message.
522
523 This is used by all other logging functions. Override
524 it if you have specific logging wishes.
525
526 The first argument, FORMAT, is a format string for the
527 message to be logged. If the format string contains
528 any % escapes requiring parameters, they should be
529 specified as subsequent arguments (it's just like
530 printf!).
531
Senthil Kumarandb727b42012-04-29 13:41:03 +0800[diff] [blame]532 The client ip and current date/time are prefixed to
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]533 every message.
534
535 """
536
537 sys.stderr.write("%s - - [%s] %s\n" %
538 (self.address_string(),
539 self.log_date_time_string(),
540 format%args))
541
542 def version_string(self):
543 """Return the server software version string."""
544 return self.server_version + ' ' + self.sys_version
545
546 def date_time_string(self, timestamp=None):
547 """Return the current date and time formatted for a message header."""
548 if timestamp is None:
549 timestamp = time.time()
550 year, month, day, hh, mm, ss, wd, y, z = time.gmtime(timestamp)
551 s = "%s, %02d %3s %4d %02d:%02d:%02d GMT" % (
552 self.weekdayname[wd],
553 day, self.monthname[month], year,
554 hh, mm, ss)
555 return s
556
557 def log_date_time_string(self):
558 """Return the current time formatted for logging."""
559 now = time.time()
560 year, month, day, hh, mm, ss, x, y, z = time.localtime(now)
561 s = "%02d/%3s/%04d %02d:%02d:%02d" % (
562 day, self.monthname[month], year, hh, mm, ss)
563 return s
564
565 weekdayname = ['Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat', 'Sun']
566
567 monthname = [None,
568 'Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun',
569 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec']
570
571 def address_string(self):
Senthil Kumaran1aacba42012-04-29 12:51:54 +0800[diff] [blame]572 """Return the client address."""
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]573
Senthil Kumaran1aacba42012-04-29 12:51:54 +0800[diff] [blame]574 return self.client_address[0]
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]575
576 # Essentially static class variables
577
578 # The version of the HTTP protocol we support.
579 # Set this to HTTP/1.1 to enable automatic keepalive
580 protocol_version = "HTTP/1.0"
581
Barry Warsaw820c1202008-06-12 04:06:45 +0000[diff] [blame]582 # MessageClass used to parse headers
Barry Warsaw820c1202008-06-12 04:06:45 +0000[diff] [blame]583 MessageClass = http.client.HTTPMessage
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]584
585 # Table mapping response codes to messages; entries have the
586 # form {code: (shortmessage, longmessage)}.
Hynek Schlawack51b2ed52012-05-16 09:51:07 +0200[diff] [blame]587 # See RFC 2616 and 6585.
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]588 responses = {
589 100: ('Continue', 'Request received, please continue'),
590 101: ('Switching Protocols',
591 'Switching to new protocol; obey Upgrade header'),
592
593 200: ('OK', 'Request fulfilled, document follows'),
594 201: ('Created', 'Document created, URL follows'),
595 202: ('Accepted',
596 'Request accepted, processing continues off-line'),
597 203: ('Non-Authoritative Information', 'Request fulfilled from cache'),
598 204: ('No Content', 'Request fulfilled, nothing follows'),
599 205: ('Reset Content', 'Clear input form for further input.'),
600 206: ('Partial Content', 'Partial content follows.'),
601
602 300: ('Multiple Choices',
603 'Object has several resources -- see URI list'),
604 301: ('Moved Permanently', 'Object moved permanently -- see URI list'),
605 302: ('Found', 'Object moved temporarily -- see URI list'),
606 303: ('See Other', 'Object moved -- see Method and URL list'),
607 304: ('Not Modified',
608 'Document has not changed since given time'),
609 305: ('Use Proxy',
610 'You must use proxy specified in Location to access this '
611 'resource.'),
612 307: ('Temporary Redirect',
613 'Object moved temporarily -- see URI list'),
614
615 400: ('Bad Request',
616 'Bad request syntax or unsupported method'),
617 401: ('Unauthorized',
618 'No permission -- see authorization schemes'),
619 402: ('Payment Required',
620 'No payment -- see charging schemes'),
621 403: ('Forbidden',
622 'Request forbidden -- authorization will not help'),
623 404: ('Not Found', 'Nothing matches the given URI'),
624 405: ('Method Not Allowed',
Senthil Kumaran7aa26212010-02-22 11:00:50 +0000[diff] [blame]625 'Specified method is invalid for this resource.'),
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]626 406: ('Not Acceptable', 'URI not available in preferred format.'),
627 407: ('Proxy Authentication Required', 'You must authenticate with '
628 'this proxy before proceeding.'),
629 408: ('Request Timeout', 'Request timed out; try again later.'),
630 409: ('Conflict', 'Request conflict.'),
631 410: ('Gone',
632 'URI no longer exists and has been permanently removed.'),
633 411: ('Length Required', 'Client must specify Content-Length.'),
634 412: ('Precondition Failed', 'Precondition in headers is false.'),
635 413: ('Request Entity Too Large', 'Entity is too large.'),
636 414: ('Request-URI Too Long', 'URI is too long.'),
637 415: ('Unsupported Media Type', 'Entity body in unsupported format.'),
638 416: ('Requested Range Not Satisfiable',
639 'Cannot satisfy request range.'),
640 417: ('Expectation Failed',
641 'Expect condition could not be satisfied.'),
Hynek Schlawack51b2ed52012-05-16 09:51:07 +0200[diff] [blame]642 428: ('Precondition Required',
643 'The origin server requires the request to be conditional.'),
644 429: ('Too Many Requests', 'The user has sent too many requests '
645 'in a given amount of time ("rate limiting").'),
646 431: ('Request Header Fields Too Large', 'The server is unwilling to '
647 'process the request because its header fields are too large.'),
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]648
649 500: ('Internal Server Error', 'Server got itself in trouble'),
650 501: ('Not Implemented',
651 'Server does not support this operation'),
652 502: ('Bad Gateway', 'Invalid responses from another server/proxy.'),
653 503: ('Service Unavailable',
654 'The server cannot process the request due to a high load'),
655 504: ('Gateway Timeout',
656 'The gateway server did not receive a timely response'),
657 505: ('HTTP Version Not Supported', 'Cannot fulfill request.'),
Hynek Schlawack51b2ed52012-05-16 09:51:07 +0200[diff] [blame]658 511: ('Network Authentication Required',
659 'The client needs to authenticate to gain network access.'),
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]660 }
661
662
663class SimpleHTTPRequestHandler(BaseHTTPRequestHandler):
664
665 """Simple HTTP request handler with GET and HEAD commands.
666
667 This serves files from the current directory and any of its
668 subdirectories. The MIME type for files is determined by
669 calling the .guess_type() method.
670
671 The GET and HEAD requests are identical except that the HEAD
672 request omits the actual contents of the file.
673
674 """
675
676 server_version = "SimpleHTTP/" + __version__
677
678 def do_GET(self):
679 """Serve a GET request."""
680 f = self.send_head()
681 if f:
Serhiy Storchaka91b0bc22014-01-25 19:43:02 +0200[diff] [blame]682 try:
683 self.copyfile(f, self.wfile)
684 finally:
685 f.close()
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]686
687 def do_HEAD(self):
688 """Serve a HEAD request."""
689 f = self.send_head()
690 if f:
691 f.close()
692
693 def send_head(self):
694 """Common code for GET and HEAD commands.
695
696 This sends the response code and MIME headers.
697
698 Return value is either a file object (which has to be copied
699 to the outputfile by the caller unless the command was HEAD,
700 and must be closed by the caller under all circumstances), or
701 None, in which case the caller has nothing further to do.
702
703 """
704 path = self.translate_path(self.path)
705 f = None
706 if os.path.isdir(path):
Benjamin Peterson94cb7a22014-12-26 10:53:43 -0600[diff] [blame]707 parts = urllib.parse.urlsplit(self.path)
708 if not parts.path.endswith('/'):
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]709 # redirect browser - doing basically what apache does
710 self.send_response(301)
Benjamin Peterson94cb7a22014-12-26 10:53:43 -0600[diff] [blame]711 new_parts = (parts[0], parts[1], parts[2] + '/',
712 parts[3], parts[4])
713 new_url = urllib.parse.urlunsplit(new_parts)
714 self.send_header("Location", new_url)
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]715 self.end_headers()
716 return None
717 for index in "index.html", "index.htm":
718 index = os.path.join(path, index)
719 if os.path.exists(index):
720 path = index
721 break
722 else:
723 return self.list_directory(path)
724 ctype = self.guess_type(path)
725 try:
726 f = open(path, 'rb')
Andrew Svetlovf7a17b42012-12-25 16:47:37 +0200[diff] [blame]727 except OSError:
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]728 self.send_error(404, "File not found")
729 return None
Serhiy Storchaka91b0bc22014-01-25 19:43:02 +0200[diff] [blame]730 try:
731 self.send_response(200)
732 self.send_header("Content-type", ctype)
733 fs = os.fstat(f.fileno())
734 self.send_header("Content-Length", str(fs[6]))
735 self.send_header("Last-Modified", self.date_time_string(fs.st_mtime))
736 self.end_headers()
737 return f
738 except:
739 f.close()
740 raise
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]741
742 def list_directory(self, path):
743 """Helper to produce a directory listing (absent index.html).
744
745 Return value is either a file object, or None (indicating an
746 error). In either case, the headers are sent, making the
747 interface the same as for send_head().
748
749 """
750 try:
751 list = os.listdir(path)
Andrew Svetlovad28c7f2012-12-18 22:02:39 +0200[diff] [blame]752 except OSError:
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]753 self.send_error(404, "No permission to list directory")
754 return None
755 list.sort(key=lambda a: a.lower())
756 r = []
Serhiy Storchakacb5bc402014-08-17 08:22:11 +0300[diff] [blame]757 try:
758 displaypath = urllib.parse.unquote(self.path,
759 errors='surrogatepass')
760 except UnicodeDecodeError:
761 displaypath = urllib.parse.unquote(path)
762 displaypath = html.escape(displaypath)
Ezio Melottica897e92011-11-02 19:33:29 +0200[diff] [blame]763 enc = sys.getfilesystemencoding()
764 title = 'Directory listing for %s' % displaypath
765 r.append('<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" '
766 '"http://www.w3.org/TR/html4/strict.dtd">')
767 r.append('<html>\n<head>')
768 r.append('<meta http-equiv="Content-Type" '
769 'content="text/html; charset=%s">' % enc)
770 r.append('<title>%s</title>\n</head>' % title)
771 r.append('<body>\n<h1>%s</h1>' % title)
772 r.append('<hr>\n<ul>')
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]773 for name in list:
774 fullname = os.path.join(path, name)
775 displayname = linkname = name
776 # Append / for directories or @ for symbolic links
777 if os.path.isdir(fullname):
778 displayname = name + "/"
779 linkname = name + "/"
780 if os.path.islink(fullname):
781 displayname = name + "@"
782 # Note: a link to a directory displays with @ and links with /
Ezio Melottica897e92011-11-02 19:33:29 +0200[diff] [blame]783 r.append('<li><a href="%s">%s</a></li>'
Serhiy Storchakacb5bc402014-08-17 08:22:11 +0300[diff] [blame]784 % (urllib.parse.quote(linkname,
785 errors='surrogatepass'),
786 html.escape(displayname)))
Ezio Melottica897e92011-11-02 19:33:29 +0200[diff] [blame]787 r.append('</ul>\n<hr>\n</body>\n</html>\n')
Serhiy Storchakacb5bc402014-08-17 08:22:11 +0300[diff] [blame]788 encoded = '\n'.join(r).encode(enc, 'surrogateescape')
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]789 f = io.BytesIO()
790 f.write(encoded)
791 f.seek(0)
792 self.send_response(200)
793 self.send_header("Content-type", "text/html; charset=%s" % enc)
794 self.send_header("Content-Length", str(len(encoded)))
795 self.end_headers()
796 return f
797
798 def translate_path(self, path):
799 """Translate a /-separated PATH to the local filename syntax.
800
801 Components that mean special things to the local file system
802 (e.g. drive or directory names) are ignored. (XXX They should
803 probably be diagnosed.)
804
805 """
806 # abandon query parameters
807 path = path.split('?',1)[0]
808 path = path.split('#',1)[0]
Senthil Kumaran72c238e2013-09-13 00:21:18 -0700[diff] [blame]809 # Don't forget explicit trailing slash when normalizing. Issue17324
Senthil Kumaran600b7352013-09-29 18:59:04 -0700[diff] [blame]810 trailing_slash = path.rstrip().endswith('/')
Serhiy Storchakacb5bc402014-08-17 08:22:11 +0300[diff] [blame]811 try:
812 path = urllib.parse.unquote(path, errors='surrogatepass')
813 except UnicodeDecodeError:
814 path = urllib.parse.unquote(path)
815 path = posixpath.normpath(path)
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]816 words = path.split('/')
817 words = filter(None, words)
818 path = os.getcwd()
819 for word in words:
820 drive, word = os.path.splitdrive(word)
821 head, word = os.path.split(word)
822 if word in (os.curdir, os.pardir): continue
823 path = os.path.join(path, word)
Senthil Kumaran72c238e2013-09-13 00:21:18 -0700[diff] [blame]824 if trailing_slash:
825 path += '/'
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]826 return path
827
828 def copyfile(self, source, outputfile):
829 """Copy all data between two file objects.
830
831 The SOURCE argument is a file object open for reading
832 (or anything with a read() method) and the DESTINATION
833 argument is a file object open for writing (or
834 anything with a write() method).
835
836 The only reason for overriding this would be to change
837 the block size or perhaps to replace newlines by CRLF
838 -- note however that this the default server uses this
839 to copy binary data as well.
840
841 """
842 shutil.copyfileobj(source, outputfile)
843
844 def guess_type(self, path):
845 """Guess the type of a file.
846
847 Argument is a PATH (a filename).
848
849 Return value is a string of the form type/subtype,
850 usable for a MIME Content-type header.
851
852 The default implementation looks the file's extension
853 up in the table self.extensions_map, using application/octet-stream
854 as a default; however it would be permissible (if
855 slow) to look inside the data to make a better guess.
856
857 """
858
859 base, ext = posixpath.splitext(path)
860 if ext in self.extensions_map:
861 return self.extensions_map[ext]
862 ext = ext.lower()
863 if ext in self.extensions_map:
864 return self.extensions_map[ext]
865 else:
866 return self.extensions_map['']
867
868 if not mimetypes.inited:
869 mimetypes.init() # try to read system mime.types
870 extensions_map = mimetypes.types_map.copy()
871 extensions_map.update({
872 '': 'application/octet-stream', # Default
873 '.py': 'text/plain',
874 '.c': 'text/plain',
875 '.h': 'text/plain',
876 })
877
878
879# Utilities for CGIHTTPRequestHandler
880
Senthil Kumarand70846b2012-04-12 02:34:32 +0800[diff] [blame]881def _url_collapse_path(path):
Benjamin Petersonad71f0f2009-04-11 20:12:10 +0000[diff] [blame]882 """
883 Given a URL path, remove extra '/'s and '.' path elements and collapse
Senthil Kumarand70846b2012-04-12 02:34:32 +0800[diff] [blame]884 any '..' references and returns a colllapsed path.
Benjamin Petersonad71f0f2009-04-11 20:12:10 +0000[diff] [blame]885
886 Implements something akin to RFC-2396 5.2 step 6 to parse relative paths.
Senthil Kumarand70846b2012-04-12 02:34:32 +0800[diff] [blame]887 The utility of this function is limited to is_cgi method and helps
888 preventing some security attacks.
Benjamin Petersonad71f0f2009-04-11 20:12:10 +0000[diff] [blame]889
890 Returns: A tuple of (head, tail) where tail is everything after the final /
891 and head is everything before it. Head will always start with a '/' and,
892 if it contains anything else, never have a trailing '/'.
893
894 Raises: IndexError if too many '..' occur within the path.
Senthil Kumarand70846b2012-04-12 02:34:32 +0800[diff] [blame]895
Benjamin Petersonad71f0f2009-04-11 20:12:10 +0000[diff] [blame]896 """
897 # Similar to os.path.split(os.path.normpath(path)) but specific to URL
898 # path semantics rather than local operating system semantics.
Senthil Kumarand70846b2012-04-12 02:34:32 +0800[diff] [blame]899 path_parts = path.split('/')
900 head_parts = []
901 for part in path_parts[:-1]:
902 if part == '..':
903 head_parts.pop() # IndexError if more '..' than prior parts
904 elif part and part != '.':
905 head_parts.append( part )
Benjamin Petersonad71f0f2009-04-11 20:12:10 +0000[diff] [blame]906 if path_parts:
Senthil Kumarandbb369d2012-04-11 03:15:28 +0800[diff] [blame]907 tail_part = path_parts.pop()
Senthil Kumarand70846b2012-04-12 02:34:32 +0800[diff] [blame]908 if tail_part:
909 if tail_part == '..':
910 head_parts.pop()
911 tail_part = ''
912 elif tail_part == '.':
913 tail_part = ''
Benjamin Petersonad71f0f2009-04-11 20:12:10 +0000[diff] [blame]914 else:
915 tail_part = ''
Senthil Kumarand70846b2012-04-12 02:34:32 +0800[diff] [blame]916
917 splitpath = ('/' + '/'.join(head_parts), tail_part)
918 collapsed_path = "/".join(splitpath)
919
920 return collapsed_path
921
Benjamin Petersonad71f0f2009-04-11 20:12:10 +0000[diff] [blame]922
923
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]924nobody = None
925
926def nobody_uid():
927 """Internal routine to get nobody's uid"""
928 global nobody
929 if nobody:
930 return nobody
931 try:
932 import pwd
Brett Cannoncd171c82013-07-04 17:43:24 -0400[diff] [blame]933 except ImportError:
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]934 return -1
935 try:
936 nobody = pwd.getpwnam('nobody')[2]
937 except KeyError:
Georg Brandlcbd2ab12010-12-04 10:39:14 +0000[diff] [blame]938 nobody = 1 + max(x[2] for x in pwd.getpwall())
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]939 return nobody
940
941
942def executable(path):
943 """Test for executable file."""
Victor Stinnerfb25ba92011-06-20 17:45:54 +0200[diff] [blame]944 return os.access(path, os.X_OK)
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]945
946
947class CGIHTTPRequestHandler(SimpleHTTPRequestHandler):
948
949 """Complete HTTP server with GET, HEAD and POST commands.
950
951 GET and HEAD also support running CGI scripts.
952
953 The POST command is *only* implemented for CGI scripts.
954
955 """
956
957 # Determine platform specifics
958 have_fork = hasattr(os, 'fork')
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]959
960 # Make rfile unbuffered -- we need to read one line and then pass
961 # the rest to a subprocess, so we can't use buffered input.
962 rbufsize = 0
963
964 def do_POST(self):
965 """Serve a POST request.
966
967 This is only implemented for CGI scripts.
968
969 """
970
971 if self.is_cgi():
972 self.run_cgi()
973 else:
974 self.send_error(501, "Can only POST to CGI scripts")
975
976 def send_head(self):
977 """Version of send_head that support CGI scripts"""
978 if self.is_cgi():
979 return self.run_cgi()
980 else:
981 return SimpleHTTPRequestHandler.send_head(self)
982
983 def is_cgi(self):
984 """Test whether self.path corresponds to a CGI script.
985
Benjamin Petersonad71f0f2009-04-11 20:12:10 +0000[diff] [blame]986 Returns True and updates the cgi_info attribute to the tuple
987 (dir, rest) if self.path requires running a CGI script.
988 Returns False otherwise.
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]989
Benjamin Petersona7deeee2009-05-08 20:54:42 +0000[diff] [blame]990 If any exception is raised, the caller should assume that
991 self.path was rejected as invalid and act accordingly.
992
Benjamin Petersonad71f0f2009-04-11 20:12:10 +0000[diff] [blame]993 The default implementation tests whether the normalized url
994 path begins with one of the strings in self.cgi_directories
995 (and the next character is a '/' or the end of the string).
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]996
997 """
Benjamin Peterson73b8b1c2014-06-14 18:36:29 -0700[diff] [blame]998 collapsed_path = _url_collapse_path(urllib.parse.unquote(self.path))
Senthil Kumarand70846b2012-04-12 02:34:32 +0800[diff] [blame]999 dir_sep = collapsed_path.find('/', 1)
1000 head, tail = collapsed_path[:dir_sep], collapsed_path[dir_sep+1:]
Senthil Kumarandbb369d2012-04-11 03:15:28 +0800[diff] [blame]1001 if head in self.cgi_directories:
1002 self.cgi_info = head, tail
Benjamin Petersonad71f0f2009-04-11 20:12:10 +0000[diff] [blame]1003 return True
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1004 return False
1005
Senthil Kumarand70846b2012-04-12 02:34:32 +0800[diff] [blame]1006
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1007 cgi_directories = ['/cgi-bin', '/htbin']
1008
1009 def is_executable(self, path):
1010 """Test whether argument path is an executable file."""
1011 return executable(path)
1012
1013 def is_python(self, path):
1014 """Test whether argument path is a Python script."""
1015 head, tail = os.path.splitext(path)
1016 return tail.lower() in (".py", ".pyw")
1017
1018 def run_cgi(self):
1019 """Execute a CGI script."""
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1020 dir, rest = self.cgi_info
Ned Deily915a30f2014-07-12 22:06:26 -0700[diff] [blame]1021 path = dir + '/' + rest
1022 i = path.find('/', len(dir)+1)
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1023 while i >= 0:
Ned Deily915a30f2014-07-12 22:06:26 -0700[diff] [blame]1024 nextdir = path[:i]
1025 nextrest = path[i+1:]
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1026
1027 scriptdir = self.translate_path(nextdir)
1028 if os.path.isdir(scriptdir):
1029 dir, rest = nextdir, nextrest
Ned Deily915a30f2014-07-12 22:06:26 -0700[diff] [blame]1030 i = path.find('/', len(dir)+1)
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1031 else:
1032 break
1033
1034 # find an explicit query string, if present.
1035 i = rest.rfind('?')
1036 if i >= 0:
1037 rest, query = rest[:i], rest[i+1:]
1038 else:
1039 query = ''
1040
1041 # dissect the part after the directory name into a script name &
1042 # a possible additional path, to be stored in PATH_INFO.
1043 i = rest.find('/')
1044 if i >= 0:
1045 script, rest = rest[:i], rest[i:]
1046 else:
1047 script, rest = rest, ''
1048
1049 scriptname = dir + '/' + script
1050 scriptfile = self.translate_path(scriptname)
1051 if not os.path.exists(scriptfile):
1052 self.send_error(404, "No such CGI script (%r)" % scriptname)
1053 return
1054 if not os.path.isfile(scriptfile):
1055 self.send_error(403, "CGI script is not a plain file (%r)" %
1056 scriptname)
1057 return
1058 ispy = self.is_python(scriptname)
Victor Stinnerfb25ba92011-06-20 17:45:54 +0200[diff] [blame]1059 if self.have_fork or not ispy:
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1060 if not self.is_executable(scriptfile):
1061 self.send_error(403, "CGI script is not executable (%r)" %
1062 scriptname)
1063 return
1064
1065 # Reference: http://hoohoo.ncsa.uiuc.edu/cgi/env.html
1066 # XXX Much of the following could be prepared ahead of time!
Senthil Kumaran42713722010-10-03 17:55:45 +0000[diff] [blame]1067 env = copy.deepcopy(os.environ)
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1068 env['SERVER_SOFTWARE'] = self.version_string()
1069 env['SERVER_NAME'] = self.server.server_name
1070 env['GATEWAY_INTERFACE'] = 'CGI/1.1'
1071 env['SERVER_PROTOCOL'] = self.protocol_version
1072 env['SERVER_PORT'] = str(self.server.server_port)
1073 env['REQUEST_METHOD'] = self.command
Jeremy Hylton1afc1692008-06-18 20:49:58 +0000[diff] [blame]1074 uqrest = urllib.parse.unquote(rest)
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1075 env['PATH_INFO'] = uqrest
1076 env['PATH_TRANSLATED'] = self.translate_path(uqrest)
1077 env['SCRIPT_NAME'] = scriptname
1078 if query:
1079 env['QUERY_STRING'] = query
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1080 env['REMOTE_ADDR'] = self.client_address[0]
Barry Warsaw820c1202008-06-12 04:06:45 +0000[diff] [blame]1081 authorization = self.headers.get("authorization")
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1082 if authorization:
1083 authorization = authorization.split()
1084 if len(authorization) == 2:
1085 import base64, binascii
1086 env['AUTH_TYPE'] = authorization[0]
1087 if authorization[0].lower() == "basic":
1088 try:
1089 authorization = authorization[1].encode('ascii')
Georg Brandl706824f2009-06-04 09:42:55 +0000[diff] [blame]1090 authorization = base64.decodebytes(authorization).\
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1091 decode('ascii')
1092 except (binascii.Error, UnicodeError):
1093 pass
1094 else:
1095 authorization = authorization.split(':')
1096 if len(authorization) == 2:
1097 env['REMOTE_USER'] = authorization[0]
1098 # XXX REMOTE_IDENT
Barry Warsaw820c1202008-06-12 04:06:45 +0000[diff] [blame]1099 if self.headers.get('content-type') is None:
1100 env['CONTENT_TYPE'] = self.headers.get_content_type()
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1101 else:
Barry Warsaw820c1202008-06-12 04:06:45 +0000[diff] [blame]1102 env['CONTENT_TYPE'] = self.headers['content-type']
1103 length = self.headers.get('content-length')
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1104 if length:
1105 env['CONTENT_LENGTH'] = length
Barry Warsaw820c1202008-06-12 04:06:45 +0000[diff] [blame]1106 referer = self.headers.get('referer')
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1107 if referer:
1108 env['HTTP_REFERER'] = referer
1109 accept = []
1110 for line in self.headers.getallmatchingheaders('accept'):
1111 if line[:1] in "\t\n\r ":
1112 accept.append(line.strip())
1113 else:
1114 accept = accept + line[7:].split(',')
1115 env['HTTP_ACCEPT'] = ','.join(accept)
Barry Warsaw820c1202008-06-12 04:06:45 +0000[diff] [blame]1116 ua = self.headers.get('user-agent')
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1117 if ua:
1118 env['HTTP_USER_AGENT'] = ua
Barry Warsaw820c1202008-06-12 04:06:45 +0000[diff] [blame]1119 co = filter(None, self.headers.get_all('cookie', []))
Georg Brandl62e2ca22010-07-31 21:54:24 +0000[diff] [blame]1120 cookie_str = ', '.join(co)
1121 if cookie_str:
1122 env['HTTP_COOKIE'] = cookie_str
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1123 # XXX Other HTTP_* headers
1124 # Since we're setting the env in the parent, provide empty
1125 # values to override previously set values
1126 for k in ('QUERY_STRING', 'REMOTE_HOST', 'CONTENT_LENGTH',
1127 'HTTP_USER_AGENT', 'HTTP_COOKIE', 'HTTP_REFERER'):
1128 env.setdefault(k, "")
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1129
1130 self.send_response(200, "Script output follows")
Senthil Kumaranc7ae19b2011-05-09 23:25:02 +0800[diff] [blame]1131 self.flush_headers()
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1132
1133 decoded_query = query.replace('+', ' ')
1134
1135 if self.have_fork:
1136 # Unix -- fork as we should
1137 args = [script]
1138 if '=' not in decoded_query:
1139 args.append(decoded_query)
1140 nobody = nobody_uid()
1141 self.wfile.flush() # Always flush before forking
1142 pid = os.fork()
1143 if pid != 0:
1144 # Parent
1145 pid, sts = os.waitpid(pid, 0)
1146 # throw away additional data [see bug #427345]
1147 while select.select([self.rfile], [], [], 0)[0]:
1148 if not self.rfile.read(1):
1149 break
1150 if sts:
1151 self.log_error("CGI script exit status %#x", sts)
1152 return
1153 # Child
1154 try:
1155 try:
1156 os.setuid(nobody)
Andrew Svetlovad28c7f2012-12-18 22:02:39 +0200[diff] [blame]1157 except OSError:
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1158 pass
1159 os.dup2(self.rfile.fileno(), 0)
1160 os.dup2(self.wfile.fileno(), 1)
Senthil Kumaran42713722010-10-03 17:55:45 +0000[diff] [blame]1161 os.execve(scriptfile, args, env)
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1162 except:
1163 self.server.handle_error(self.request, self.client_address)
1164 os._exit(127)
1165
Amaury Forgeot d'Arccb0d2d72008-06-18 22:19:22 +0000[diff] [blame]1166 else:
1167 # Non-Unix -- use subprocess
1168 import subprocess
Senthil Kumarane29cd162009-11-11 04:17:53 +0000[diff] [blame]1169 cmdline = [scriptfile]
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1170 if self.is_python(scriptfile):
1171 interp = sys.executable
1172 if interp.lower().endswith("w.exe"):
1173 # On Windows, use python.exe, not pythonw.exe
1174 interp = interp[:-5] + interp[-4:]
Senthil Kumarane29cd162009-11-11 04:17:53 +0000[diff] [blame]1175 cmdline = [interp, '-u'] + cmdline
1176 if '=' not in query:
1177 cmdline.append(query)
1178 self.log_message("command: %s", subprocess.list2cmdline(cmdline))
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1179 try:
1180 nbytes = int(length)
1181 except (TypeError, ValueError):
1182 nbytes = 0
Amaury Forgeot d'Arccb0d2d72008-06-18 22:19:22 +0000[diff] [blame]1183 p = subprocess.Popen(cmdline,
1184 stdin=subprocess.PIPE,
1185 stdout=subprocess.PIPE,
Senthil Kumaran42713722010-10-03 17:55:45 +0000[diff] [blame]1186 stderr=subprocess.PIPE,
1187 env = env
Amaury Forgeot d'Arccb0d2d72008-06-18 22:19:22 +0000[diff] [blame]1188 )
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1189 if self.command.lower() == "post" and nbytes > 0:
1190 data = self.rfile.read(nbytes)
Amaury Forgeot d'Arccb0d2d72008-06-18 22:19:22 +0000[diff] [blame]1191 else:
1192 data = None
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1193 # throw away additional data [see bug #427345]
1194 while select.select([self.rfile._sock], [], [], 0)[0]:
1195 if not self.rfile._sock.recv(1):
1196 break
Amaury Forgeot d'Arccb0d2d72008-06-18 22:19:22 +0000[diff] [blame]1197 stdout, stderr = p.communicate(data)
1198 self.wfile.write(stdout)
1199 if stderr:
1200 self.log_error('%s', stderr)
Brian Curtincbad4df2010-11-05 15:04:48 +0000[diff] [blame]1201 p.stderr.close()
1202 p.stdout.close()
Amaury Forgeot d'Arccb0d2d72008-06-18 22:19:22 +0000[diff] [blame]1203 status = p.returncode
1204 if status:
1205 self.log_error("CGI script exit status %#x", status)
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1206 else:
1207 self.log_message("CGI script exited OK")
1208
1209
Senthil Kumarandefe7f42013-09-15 09:37:27 -0700[diff] [blame]1210def test(HandlerClass=BaseHTTPRequestHandler,
1211 ServerClass=HTTPServer, protocol="HTTP/1.0", port=8000, bind=""):
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1212 """Test the HTTP request handler class.
1213
1214 This runs an HTTP server on port 8000 (or the first command line
1215 argument).
1216
1217 """
Senthil Kumarandefe7f42013-09-15 09:37:27 -0700[diff] [blame]1218 server_address = (bind, port)
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1219
1220 HandlerClass.protocol_version = protocol
1221 httpd = ServerClass(server_address, HandlerClass)
1222
1223 sa = httpd.socket.getsockname()
1224 print("Serving HTTP on", sa[0], "port", sa[1], "...")
Alexandre Vassalottib5292a22009-04-03 07:16:55 +0000[diff] [blame]1225 try:
1226 httpd.serve_forever()
1227 except KeyboardInterrupt:
1228 print("\nKeyboard interrupt received, exiting.")
1229 httpd.server_close()
1230 sys.exit(0)
Georg Brandl24420152008-05-26 16:32:26 +0000[diff] [blame]1231
1232if __name__ == '__main__':
Senthil Kumaran1251faf2012-06-03 16:15:54 +0800[diff] [blame]1233 parser = argparse.ArgumentParser()
1234 parser.add_argument('--cgi', action='store_true',
1235 help='Run as CGI Server')
Senthil Kumarandefe7f42013-09-15 09:37:27 -0700[diff] [blame]1236 parser.add_argument('--bind', '-b', default='', metavar='ADDRESS',
1237 help='Specify alternate bind address '
1238 '[default: all interfaces]')
Senthil Kumaran1251faf2012-06-03 16:15:54 +0800[diff] [blame]1239 parser.add_argument('port', action='store',
1240 default=8000, type=int,
1241 nargs='?',
1242 help='Specify alternate port [default: 8000]')
1243 args = parser.parse_args()
1244 if args.cgi:
Senthil Kumarandefe7f42013-09-15 09:37:27 -0700[diff] [blame]1245 handler_class = CGIHTTPRequestHandler
Senthil Kumaran1251faf2012-06-03 16:15:54 +0800[diff] [blame]1246 else:
Senthil Kumarandefe7f42013-09-15 09:37:27 -0700[diff] [blame]1247 handler_class = SimpleHTTPRequestHandler
1248 test(HandlerClass=handler_class, port=args.port, bind=args.bind)