import os
from paste.urlparser import *
from paste.fixture import *
from pkg_resources import get_distribution
def relative_path(name):
here = os.path.join(os.path.dirname(os.path.abspath(__file__)),
'urlparser_data')
f = os.path.join('urlparser_data', '..', 'urlparser_data', name)
return os.path.join(here, f)
def path(name):
return os.path.join(os.path.dirname(os.path.abspath(__file__)),
'urlparser_data', name)
def make_app(name):
app = URLParser({}, path(name), name, index_names=['index', 'Main'])
testapp = TestApp(app)
return testapp
def test_find_file():
app = make_app('find_file')
res = app.get('/')
assert 'index1' in res
assert res.header('content-type') == 'text/plain'
res = app.get('/index')
assert 'index1' in res
assert res.header('content-type') == 'text/plain'
res = app.get('/index.txt')
assert 'index1' in res
assert res.header('content-type') == 'text/plain'
res = app.get('/test2.html')
assert 'test2' in res
assert res.header('content-type') == 'text/html'
res = app.get('/test 3.html')
assert 'test 3' in res
assert res.header('content-type') == 'text/html'
res = app.get('/test%203.html')
assert 'test 3' in res
assert res.header('content-type') == 'text/html'
res = app.get('/dir with spaces/test 4.html')
assert 'test 4' in res
assert res.header('content-type') == 'text/html'
res = app.get('/dir%20with%20spaces/test%204.html')
assert 'test 4' in res
assert res.header('content-type') == 'text/html'
# Ensure only data under the app's root directory is accessible
res = app.get('/../secured.txt', status=404)
res = app.get('/dir with spaces/../../secured.txt', status=404)
res = app.get('/%2e%2e/secured.txt', status=404)
res = app.get('/%2e%2e%3fsecured.txt', status=404)
res = app.get('/..%3fsecured.txt', status=404)
res = app.get('/dir%20with%20spaces/%2e%2e/%2e%2e/secured.txt', status=404)
def test_deep():
app = make_app('deep')
res = app.get('/')
assert 'index2' in res
res = app.get('/sub')
assert res.status == 301
print(res)
assert res.header('location') == 'http://localhost/sub/'
assert 'http://localhost/sub/' in res
res = app.get('/sub/')
assert 'index3' in res
def test_python():
app = make_app('python')
res = app.get('/simpleapp')
assert 'test1' in res
assert res.header('test-header') == 'TEST!'
assert res.header('content-type') == 'text/html'
res = app.get('/stream')
assert 'test2' in res
res = app.get('/sub/simpleapp')
assert 'subsimple' in res
def test_hook():
app = make_app('hook')
res = app.get('/bob/app')
assert 'user: bob' in res
res = app.get('/tim/')
assert 'index: tim' in res
def test_not_found_hook():
app = make_app('not_found')
res = app.get('/simple/notfound')
assert res.status == 200
assert 'not found' in res
res = app.get('/simple/found')
assert 'is found' in res
res = app.get('/recur/__notfound', status=404)
# @@: It's unfortunate that the original path doesn't actually show up
assert '/recur/notfound' in res
res = app.get('/recur/__isfound')
assert res.status == 200
assert 'is found' in res
res = app.get('/user/list')
assert 'user: None' in res
res = app.get('/user/bob/list')
assert res.status == 200
assert 'user: bob' in res
def test_relative_path_in_static_parser():
x = relative_path('find_file')
app = StaticURLParser(relative_path('find_file'))
assert '..' not in app.root_directory
def test_xss():
app = TestApp(StaticURLParser(relative_path('find_file')),
extra_environ={'HTTP_ACCEPT': 'text/html'})
res = app.get("/-->%0D<script>alert('xss')</script>", status=404)
assert b'--><script>' not in res.body
def test_static_parser():
app = StaticURLParser(path('find_file'))
testapp = TestApp(app)
res = testapp.get('', status=301)
res = testapp.get('/', status=404)
res = testapp.get('/index.txt')
assert res.body.strip() == b'index1'
res = testapp.get('/index.txt/foo', status=404)
res = testapp.get('/test 3.html')
assert res.body.strip() == b'test 3'
res = testapp.get('/test%203.html')
assert res.body.strip() == b'test 3'
res = testapp.get('/dir with spaces/test 4.html')
assert res.body.strip() == b'test 4'
res = testapp.get('/dir%20with%20spaces/test%204.html')
assert res.body.strip() == b'test 4'
# Ensure only data under the app's root directory is accessible
res = testapp.get('/../secured.txt', status=404)
res = testapp.get('/dir with spaces/../../secured.txt', status=404)
res = testapp.get('/%2e%2e/secured.txt', status=404)
res = testapp.get('/dir%20with%20spaces/%2e%2e/%2e%2e/secured.txt', status=404)
res = testapp.get('/dir%20with%20spaces/', status=404)
def test_egg_parser():
app = PkgResourcesParser('Paste', 'paste')
testapp = TestApp(app)
res = testapp.get('', status=301)
res = testapp.get('/', status=404)
res = testapp.get('/flup_session', status=404)
res = testapp.get('/util/classinit.py')
assert 'ClassInitMeta' in res
res = testapp.get('/util/classinit', status=404)
res = testapp.get('/util', status=301)
res = testapp.get('/util/classinit.py/foo', status=404)
# Find a readable file in the Paste pkg's root directory (or upwards the
# directory tree). Ensure it's not accessible via the URLParser
unreachable_test_file = None
search_path = pkg_root_path = get_distribution('Paste').location
level = 0
# We might not find any readable files in the pkg's root directory (this
# is likely when Paste is installed as a .egg in site-packages). We
# (hopefully) can prevent this by traversing up the directory tree until
# a usable file is found
while unreachable_test_file is None and \
os.path.normpath(search_path) != os.path.sep:
for file in os.listdir(search_path):
full_path = os.path.join(search_path, file)
if os.path.isfile(full_path) and os.access(full_path, os.R_OK):
unreachable_test_file = file
break
search_path = os.path.dirname(search_path)
level += 1
assert unreachable_test_file is not None, \
'test_egg_parser requires a readable file in a parent dir of the\n' \
'Paste pkg\'s root dir:\n%s' % pkg_root_path
unreachable_path = '/' + '../'*level + unreachable_test_file
unreachable_path_quoted = '/' + '%2e%2e/'*level + unreachable_test_file
res = testapp.get(unreachable_path, status=404)
res = testapp.get('/util/..' + unreachable_path, status=404)
res = testapp.get(unreachable_path_quoted, status=404)
res = testapp.get('/util/%2e%2e' + unreachable_path_quoted, status=404)