U /vh8@s dZddlmZddlZddlmZddlmZddl m Z ddl m Z dd l mZdd lmZejrdd lmZdd lmZdd lmZGdddeZGdddeZefdddddddZGdddZGdddZGdddZGdd d ZGd!d"d"ZdS)#a WSGI Protocol Linter ==================== This module provides a middleware that performs sanity checks on the behavior of the WSGI server and application. It checks that the :pep:`3333` WSGI spec is properly implemented. It also warns on some common HTTP errors such as non-empty responses for 304 status codes. .. autoclass:: LintMiddleware :copyright: 2007 Pallets :license: BSD-3-Clause ) annotationsN) TracebackType)urlparse)warn)Headers)is_entity_header) FileWrapper) StartResponse)WSGIApplication)WSGIEnvironmentc@seZdZdZdS) WSGIWarningz Warning class for WSGI warnings.N__name__ __module__ __qualname____doc__rrjs zErrorStream.writer5cCs|jdSr&)r(flushr7rrrr@nszErrorStream.flushzt.Iterable[str])seqrcCs|D]}||qdSr&)r>)r*rAlinerrr writelinesqszErrorStream.writelinescCstdtdd|jdS)Nz(The application closed the error stream!rr r9r7rrrr:uszErrorStream.closeN)rrrr+r>r@rCr:rrrrr;fs r;c@s.eZdZddddddZdddd d Zd S) GuardedWritezt.Callable[[bytes], object] list[int]r)r>chunksrcCs||_||_dSr&)_write_chunks)r*r>rFrrrr+{szGuardedWrite.__init__r-r<cCs*td|t|||jt|dS)Nzwrite())r"r-rGrHappendr0r?rrr__call__s  zGuardedWrite.__call__N)rrrr+rJrrrrrDzsrDc@sXeZdZdddddddZddd d Zd dd d ZddddZddddZdS)GuardedIteratort.Iterable[bytes]tuple[int, Headers]rEr)iterator headers_setrFrcCs(||_t|j|_d|_||_||_dS)NF) _iteratorr6__next___nextclosedrOrF)r*rNrOrFrrrr+s  zGuardedIterator.__init__r5cCs|Sr&rr7rrrr8szGuardedIterator.__iter__r-cCsP|jrtdtdd|}|js0tdtddtd|t|jt ||S)Nz Iterated over closed 'app_iter'.rr z8The application returned before it started the response.zapplication iterator items) rSrr rRrOr"r-rFrIr0)r*rvrrrrQs zGuardedIterator.__next__cCsd|_t|jdr|j|jr|j\}}t|j}|jdtd}|dkr|D]6\}}| }|dkrRt |rRt d|dt d d qR|rt d t d d nvd |krd ksn|dkr|dkrt |dt d d |rt |dt d d n"|dk r||krt dt d d dS)NTr:zcontent-length)ri0)expireszcontent-locationzEntity header z found in 304 response.rr z#304 responses must not have a body.drz- responses must have an empty content length.z responses must not have a body.zGContent-Length and the number of bytes sent to the client do not match.)rShasattrrPr:rOsumrFgetintlowerrrrr )r* status_codeheadersZ bytes_sentcontent_lengthkey_valuerrrr:sV       zGuardedIterator.closecCs2|js.ztdtddWntk r,YnXdS)Nz4Iterator was garbage collected before it was closed.rr )rSrr Exceptionr7rrr__del__s zGuardedIterator.__del__N)rrrr+r8rQr:rdrrrrrKs  1rKc@sveZdZdZdddddZdddd d Zd d d ddddZdddddZdddddZddddddZ dS)LintMiddlewareaWarns about common errors in the WSGI and HTTP behavior of the server and wrapped application. Some of the issues it checks are: - invalid status codes - non-bytes sent to the WSGI server - strings returned from the WSGI application - non-empty conditional responses - unquoted etags - relative URLs in the Location header - unsafe calls to wsgi.input - unclosed iterators Error information is emitted using the :mod:`warnings` module. :param app: The WSGI application to wrap. .. code-block:: python from werkzeug.middleware.lint import LintMiddleware app = LintMiddleware(app) r r)apprcCs ||_dSr&)rf)r*rfrrrr+szLintMiddleware.__init__r )environrcCst|tk rtdtdddD]"}||krtd|dtddq|dd kr\td tdd|d d }|d d }|r|ddkrtd|tdd|r|ddkrtd|tdddS)Nz/WSGI environment is not a standard Python dict.r ) REQUEST_METHODZ SERVER_NAMEZ SERVER_PORT wsgi.version wsgi.input wsgi.errorszwsgi.multithreadzwsgi.multiprocessz wsgi.run_oncezRequired environment key z not foundrrj)r/rz"Environ is not a WSGI 1.0 environ.Z SCRIPT_NAMEZ PATH_INFOr/z+'SCRIPT_NAME' does not start with a slash: z)'PATH_INFO' does not start with a slash: )rdictrr r[)r*rgra script_nameZ path_inforrr check_environs:      zLintMiddleware.check_environrzlist[tuple[str, str]]z?None | tuple[type[BaseException], BaseException, TracebackType]rM)statusr_exc_inforc Cs\td|t|ddd}t|dks0|s>tdtddt|dksV|ddkrltd |d tddt|}|d krtd tddt|t k rtd tdd|D]t}t|t k st|dkrtdtdd|\}}t|tk st|tk rtdtdd| dkrtdtddq|dk rBt |t sBtdtddt |} || || fS)Nrrr/rrz!Status code must be three digits.r rh zInvalid value for status zJ. Valid status strings are three digits, a space and a status explanation.rVzStatus code < 100 detected.zHeader list is not a list.rz#Header items must be 2-item tuples.z'Header keys and values must be strings.zFThe status header is not supported due to conflicts with the CGI spec.zInvalid value for exc_info.)r"rsplitr0 isdecimalrr r\rlisttupler] isinstancer check_headers) r*rrr_rsZstatus_code_strr^itemnamevalueZ headers_objrrrcheck_start_response)sH     z#LintMiddleware.check_start_responser)r_rcCs|d}|dk rt|dr@|dr4tdtdd|dd}|dd|d dkrdd kstntd tdd|d }|dk rt|jstd tdddS)Netag)zW/w/rz)Weak etag indicator should be upper case.rhr rr/"zUnquoted etag emitted.locationz+Absolute URLs required for location header.)r[ startswithrrrnetloc)r*r_rrrrrrz]s(    &  zLintMiddleware.check_headersrL)app_iterrcCst|trtdtdddS)NzThe application returned a string. The response will send one character at a time to the client, which will kill performance. Return a list or iterable instead.rr )ryrrr )r*rrrrcheck_iteratorxs  zLintMiddleware.check_iteratorr,r.kwargsrcst|dkrtdtdd|r,tdtdd|d}|d|t|d|d<t|d|d<t|d <ggd d d d fd d }|t d|} |t |t tj t tfS)NrzA WSGI app takes two arguments.r z+A WSGI app does not take keyword arguments.rr/rkrlzwsgi.file_wrapperr,zt.Callable[[bytes], None]rcst|dkr&tdt|dtdd|r8tdtdd|d}|d}t|d kr\|dnd}|||dd<t|||S) N>rrzInvalid number of arguments: z, expected 2 or 3.rr z1'start_response' does not take keyword arguments.rr/r)r0rr r~rD)r.rrrr_rsrFrOr*Zstart_responserrchecking_start_responses$ z8LintMiddleware.__call__..checking_start_responser )r0rr rqr#r;r rftcastrrKTupler\r)r*r.rrgrrrrrrJs0   zLintMiddleware.__call__N) rrrrr+rqr~rzrrJrrrrres,4 re) r __future__rtypingrtypesr urllib.parserwarningsrZdatastructuresrhttprZwsgir TYPE_CHECKINGZ_typeshed.wsgir r r Warningr rrr"r#r;rDrKrerrrrs(           4 ^