Python code coverage for Lib/cgi.py

#	count	content
1	n/a	#! /usr/local/bin/python
2	n/a
3	n/a	# NOTE: the above "/usr/local/bin/python" is NOT a mistake. It is
4	n/a	# intentionally NOT "/usr/bin/env python". On many systems
5	n/a	# (e.g. Solaris), /usr/local/bin is not in $PATH as passed to CGI
6	n/a	# scripts, and /usr/local/bin is the default directory where Python is
7	n/a	# installed, so /usr/bin/env would be unable to find python. Granted,
8	n/a	# binary installations by Linux vendors often install Python in
9	n/a	# /usr/bin. So let those vendors patch cgi.py to match their choice
10	n/a	# of installation.
11	n/a
12	n/a	"""Support module for CGI (Common Gateway Interface) scripts.
13	n/a
14	n/a	This module defines a number of utilities for use by CGI scripts
15	n/a	written in Python.
16	n/a	"""
17	n/a
18	n/a	# History
19	n/a	# -------
20	n/a	#
21	n/a	# Michael McLay started this module. Steve Majewski changed the
22	n/a	# interface to SvFormContentDict and FormContentDict. The multipart
23	n/a	# parsing was inspired by code submitted by Andreas Paepcke. Guido van
24	n/a	# Rossum rewrote, reformatted and documented the module and is currently
25	n/a	# responsible for its maintenance.
26	n/a	#
27	n/a
28	n/a	__version__ = "2.6"
29	n/a
30	n/a
31	n/a	# Imports
32	n/a	# =======
33	n/a
34	n/a	from io import StringIO, BytesIO, TextIOWrapper
35	n/a	from collections import Mapping
36	n/a	import sys
37	n/a	import os
38	n/a	import urllib.parse
39	n/a	from email.parser import FeedParser
40	n/a	from email.message import Message
41	n/a	from warnings import warn
42	n/a	import html
43	n/a	import locale
44	n/a	import tempfile
45	n/a
46	n/a	__all__ = ["MiniFieldStorage", "FieldStorage",
47	n/a	"parse", "parse_qs", "parse_qsl", "parse_multipart",
48	n/a	"parse_header", "test", "print_exception", "print_environ",
49	n/a	"print_form", "print_directory", "print_arguments",
50	n/a	"print_environ_usage", "escape"]
51	n/a
52	n/a	# Logging support
53	n/a	# ===============
54	n/a
55	n/a	logfile = "" # Filename to log to, if not empty
56	n/a	logfp = None # File object to log to, if not None
57	n/a
58	n/a	def initlog(*allargs):
59	n/a	"""Write a log message, if there is a log file.
60	n/a
61	n/a	Even though this function is called initlog(), you should always
62	n/a	use log(); log is a variable that is set either to initlog
63	n/a	(initially), to dolog (once the log file has been opened), or to
64	n/a	nolog (when logging is disabled).
65	n/a
66	n/a	The first argument is a format string; the remaining arguments (if
67	n/a	any) are arguments to the % operator, so e.g.
68	n/a	log("%s: %s", "a", "b")
69	n/a	will write "a: b" to the log file, followed by a newline.
70	n/a
71	n/a	If the global logfp is not None, it should be a file object to
72	n/a	which log data is written.
73	n/a
74	n/a	If the global logfp is None, the global logfile may be a string
75	n/a	giving a filename to open, in append mode. This file should be
76	n/a	world writable!!! If the file can't be opened, logging is
77	n/a	silently disabled (since there is no safe place where we could
78	n/a	send an error message).
79	n/a
80	n/a	"""
81	n/a	global log, logfile, logfp
82	n/a	if logfile and not logfp:
83	n/a	try:
84	n/a	logfp = open(logfile, "a")
85	n/a	except OSError:
86	n/a	pass
87	n/a	if not logfp:
88	n/a	log = nolog
89	n/a	else:
90	n/a	log = dolog
91	n/a	log(*allargs)
92	n/a
93	n/a	def dolog(fmt, *args):
94	n/a	"""Write a log message to the log file. See initlog() for docs."""
95	n/a	logfp.write(fmt%args + "\n")
96	n/a
97	n/a	def nolog(*allargs):
98	n/a	"""Dummy function, assigned to log when logging is disabled."""
99	n/a	pass
100	n/a
101	n/a	def closelog():
102	n/a	"""Close the log file."""
103	n/a	global log, logfile, logfp
104	n/a	logfile = ''
105	n/a	if logfp:
106	n/a	logfp.close()
107	n/a	logfp = None
108	n/a	log = initlog
109	n/a
110	n/a	log = initlog # The current logging function
111	n/a
112	n/a
113	n/a	# Parsing functions
114	n/a	# =================
115	n/a
116	n/a	# Maximum input we will accept when REQUEST_METHOD is POST
117	n/a	# 0 ==> unlimited input
118	n/a	maxlen = 0
119	n/a
120	n/a	def parse(fp=None, environ=os.environ, keep_blank_values=0, strict_parsing=0):
121	n/a	"""Parse a query in the environment or from a file (default stdin)
122	n/a
123	n/a	Arguments, all optional:
124	n/a
125	n/a	fp : file pointer; default: sys.stdin.buffer
126	n/a
127	n/a	environ : environment dictionary; default: os.environ
128	n/a
129	n/a	keep_blank_values: flag indicating whether blank values in
130	n/a	percent-encoded forms should be treated as blank strings.
131	n/a	A true value indicates that blanks should be retained as
132	n/a	blank strings. The default false value indicates that
133	n/a	blank values are to be ignored and treated as if they were
134	n/a	not included.
135	n/a
136	n/a	strict_parsing: flag indicating what to do with parsing errors.
137	n/a	If false (the default), errors are silently ignored.
138	n/a	If true, errors raise a ValueError exception.
139	n/a	"""
140	n/a	if fp is None:
141	n/a	fp = sys.stdin
142	n/a
143	n/a	# field keys and values (except for files) are returned as strings
144	n/a	# an encoding is required to decode the bytes read from self.fp
145	n/a	if hasattr(fp,'encoding'):
146	n/a	encoding = fp.encoding
147	n/a	else:
148	n/a	encoding = 'latin-1'
149	n/a
150	n/a	# fp.read() must return bytes
151	n/a	if isinstance(fp, TextIOWrapper):
152	n/a	fp = fp.buffer
153	n/a
154	n/a	if not 'REQUEST_METHOD' in environ:
155	n/a	environ['REQUEST_METHOD'] = 'GET' # For testing stand-alone
156	n/a	if environ['REQUEST_METHOD'] == 'POST':
157	n/a	ctype, pdict = parse_header(environ['CONTENT_TYPE'])
158	n/a	if ctype == 'multipart/form-data':
159	n/a	return parse_multipart(fp, pdict)
160	n/a	elif ctype == 'application/x-www-form-urlencoded':
161	n/a	clength = int(environ['CONTENT_LENGTH'])
162	n/a	if maxlen and clength > maxlen:
163	n/a	raise ValueError('Maximum content length exceeded')
164	n/a	qs = fp.read(clength).decode(encoding)
165	n/a	else:
166	n/a	qs = '' # Unknown content-type
167	n/a	if 'QUERY_STRING' in environ:
168	n/a	if qs: qs = qs + '&'
169	n/a	qs = qs + environ['QUERY_STRING']
170	n/a	elif sys.argv[1:]:
171	n/a	if qs: qs = qs + '&'
172	n/a	qs = qs + sys.argv[1]
173	n/a	environ['QUERY_STRING'] = qs # XXX Shouldn't, really
174	n/a	elif 'QUERY_STRING' in environ:
175	n/a	qs = environ['QUERY_STRING']
176	n/a	else:
177	n/a	if sys.argv[1:]:
178	n/a	qs = sys.argv[1]
179	n/a	else:
180	n/a	qs = ""
181	n/a	environ['QUERY_STRING'] = qs # XXX Shouldn't, really
182	n/a	return urllib.parse.parse_qs(qs, keep_blank_values, strict_parsing,
183	n/a	encoding=encoding)
184	n/a
185	n/a
186	n/a	# parse query string function called from urlparse,
187	n/a	# this is done in order to maintain backward compatibility.
188	n/a
189	n/a	def parse_qs(qs, keep_blank_values=0, strict_parsing=0):
190	n/a	"""Parse a query given as a string argument."""
191	n/a	warn("cgi.parse_qs is deprecated, use urllib.parse.parse_qs instead",
192	n/a	DeprecationWarning, 2)
193	n/a	return urllib.parse.parse_qs(qs, keep_blank_values, strict_parsing)
194	n/a
195	n/a	def parse_qsl(qs, keep_blank_values=0, strict_parsing=0):
196	n/a	"""Parse a query given as a string argument."""
197	n/a	warn("cgi.parse_qsl is deprecated, use urllib.parse.parse_qsl instead",
198	n/a	DeprecationWarning, 2)
199	n/a	return urllib.parse.parse_qsl(qs, keep_blank_values, strict_parsing)
200	n/a
201	n/a	def parse_multipart(fp, pdict):
202	n/a	"""Parse multipart input.
203	n/a
204	n/a	Arguments:
205	n/a	fp : input file
206	n/a	pdict: dictionary containing other parameters of content-type header
207	n/a
208	n/a	Returns a dictionary just like parse_qs(): keys are the field names, each
209	n/a	value is a list of values for that field. This is easy to use but not
210	n/a	much good if you are expecting megabytes to be uploaded -- in that case,
211	n/a	use the FieldStorage class instead which is much more flexible. Note
212	n/a	that content-type is the raw, unparsed contents of the content-type
213	n/a	header.
214	n/a
215	n/a	XXX This does not parse nested multipart parts -- use FieldStorage for
216	n/a	that.
217	n/a
218	n/a	XXX This should really be subsumed by FieldStorage altogether -- no
219	n/a	point in having two implementations of the same parsing algorithm.
220	n/a	Also, FieldStorage protects itself better against certain DoS attacks
221	n/a	by limiting the size of the data read in one chunk. The API here
222	n/a	does not support that kind of protection. This also affects parse()
223	n/a	since it can call parse_multipart().
224	n/a
225	n/a	"""
226	n/a	import http.client
227	n/a
228	n/a	boundary = b""
229	n/a	if 'boundary' in pdict:
230	n/a	boundary = pdict['boundary']
231	n/a	if not valid_boundary(boundary):
232	n/a	raise ValueError('Invalid boundary in multipart form: %r'
233	n/a	% (boundary,))
234	n/a
235	n/a	nextpart = b"--" + boundary
236	n/a	lastpart = b"--" + boundary + b"--"
237	n/a	partdict = {}
238	n/a	terminator = b""
239	n/a
240	n/a	while terminator != lastpart:
241	n/a	bytes = -1
242	n/a	data = None
243	n/a	if terminator:
244	n/a	# At start of next part. Read headers first.
245	n/a	headers = http.client.parse_headers(fp)
246	n/a	clength = headers.get('content-length')
247	n/a	if clength:
248	n/a	try:
249	n/a	bytes = int(clength)
250	n/a	except ValueError:
251	n/a	pass
252	n/a	if bytes > 0:
253	n/a	if maxlen and bytes > maxlen:
254	n/a	raise ValueError('Maximum content length exceeded')
255	n/a	data = fp.read(bytes)
256	n/a	else:
257	n/a	data = b""
258	n/a	# Read lines until end of part.
259	n/a	lines = []
260	n/a	while 1:
261	n/a	line = fp.readline()
262	n/a	if not line:
263	n/a	terminator = lastpart # End outer loop
264	n/a	break
265	n/a	if line.startswith(b"--"):
266	n/a	terminator = line.rstrip()
267	n/a	if terminator in (nextpart, lastpart):
268	n/a	break
269	n/a	lines.append(line)
270	n/a	# Done with part.
271	n/a	if data is None:
272	n/a	continue
273	n/a	if bytes < 0:
274	n/a	if lines:
275	n/a	# Strip final line terminator
276	n/a	line = lines[-1]
277	n/a	if line[-2:] == b"\r\n":
278	n/a	line = line[:-2]
279	n/a	elif line[-1:] == b"\n":
280	n/a	line = line[:-1]
281	n/a	lines[-1] = line
282	n/a	data = b"".join(lines)
283	n/a	line = headers['content-disposition']
284	n/a	if not line:
285	n/a	continue
286	n/a	key, params = parse_header(line)
287	n/a	if key != 'form-data':
288	n/a	continue
289	n/a	if 'name' in params:
290	n/a	name = params['name']
291	n/a	else:
292	n/a	continue
293	n/a	if name in partdict:
294	n/a	partdict[name].append(data)
295	n/a	else:
296	n/a	partdict[name] = [data]
297	n/a
298	n/a	return partdict
299	n/a
300	n/a
301	n/a	def _parseparam(s):
302	n/a	while s[:1] == ';':
303	n/a	s = s[1:]
304	n/a	end = s.find(';')
305	n/a	while end > 0 and (s.count('"', 0, end) - s.count('\\"', 0, end)) % 2:
306	n/a	end = s.find(';', end + 1)
307	n/a	if end < 0:
308	n/a	end = len(s)
309	n/a	f = s[:end]
310	n/a	yield f.strip()
311	n/a	s = s[end:]
312	n/a
313	n/a	def parse_header(line):
314	n/a	"""Parse a Content-type like header.
315	n/a
316	n/a	Return the main content-type and a dictionary of options.
317	n/a
318	n/a	"""
319	n/a	parts = _parseparam(';' + line)
320	n/a	key = parts.__next__()
321	n/a	pdict = {}
322	n/a	for p in parts:
323	n/a	i = p.find('=')
324	n/a	if i >= 0:
325	n/a	name = p[:i].strip().lower()
326	n/a	value = p[i+1:].strip()
327	n/a	if len(value) >= 2 and value[0] == value[-1] == '"':
328	n/a	value = value[1:-1]
329	n/a	value = value.replace('\\\\', '\\').replace('\\"', '"')
330	n/a	pdict[name] = value
331	n/a	return key, pdict
332	n/a
333	n/a
334	n/a	# Classes for field storage
335	n/a	# =========================
336	n/a
337	n/a	class MiniFieldStorage:
338	n/a
339	n/a	"""Like FieldStorage, for use when no file uploads are possible."""
340	n/a
341	n/a	# Dummy attributes
342	n/a	filename = None
343	n/a	list = None
344	n/a	type = None
345	n/a	file = None
346	n/a	type_options = {}
347	n/a	disposition = None
348	n/a	disposition_options = {}
349	n/a	headers = {}
350	n/a
351	n/a	def __init__(self, name, value):
352	n/a	"""Constructor from field name and value."""
353	n/a	self.name = name
354	n/a	self.value = value
355	n/a	# self.file = StringIO(value)
356	n/a
357	n/a	def __repr__(self):
358	n/a	"""Return printable representation."""
359	n/a	return "MiniFieldStorage(%r, %r)" % (self.name, self.value)
360	n/a
361	n/a
362	n/a	class FieldStorage:
363	n/a
364	n/a	"""Store a sequence of fields, reading multipart/form-data.
365	n/a
366	n/a	This class provides naming, typing, files stored on disk, and
367	n/a	more. At the top level, it is accessible like a dictionary, whose
368	n/a	keys are the field names. (Note: None can occur as a field name.)
369	n/a	The items are either a Python list (if there's multiple values) or
370	n/a	another FieldStorage or MiniFieldStorage object. If it's a single
371	n/a	object, it has the following attributes:
372	n/a
373	n/a	name: the field name, if specified; otherwise None
374	n/a
375	n/a	filename: the filename, if specified; otherwise None; this is the
376	n/a	client side filename, not the file name on which it is
377	n/a	stored (that's a temporary file you don't deal with)
378	n/a
379	n/a	value: the value as a string; for file uploads, this
380	n/a	transparently reads the file every time you request the value
381	n/a	and returns bytes
382	n/a
383	n/a	file: the file(-like) object from which you can read the data *as
384	n/a	bytes* ; None if the data is stored a simple string
385	n/a
386	n/a	type: the content-type, or None if not specified
387	n/a
388	n/a	type_options: dictionary of options specified on the content-type
389	n/a	line
390	n/a
391	n/a	disposition: content-disposition, or None if not specified
392	n/a
393	n/a	disposition_options: dictionary of corresponding options
394	n/a
395	n/a	headers: a dictionary(-like) object (sometimes email.message.Message or a
396	n/a	subclass thereof) containing all headers
397	n/a
398	n/a	The class is subclassable, mostly for the purpose of overriding
399	n/a	the make_file() method, which is called internally to come up with
400	n/a	a file open for reading and writing. This makes it possible to
401	n/a	override the default choice of storing all files in a temporary
402	n/a	directory and unlinking them as soon as they have been opened.
403	n/a
404	n/a	"""
405	n/a	def __init__(self, fp=None, headers=None, outerboundary=b'',
406	n/a	environ=os.environ, keep_blank_values=0, strict_parsing=0,
407	n/a	limit=None, encoding='utf-8', errors='replace'):
408	n/a	"""Constructor. Read multipart/* until last part.
409	n/a
410	n/a	Arguments, all optional:
411	n/a
412	n/a	fp : file pointer; default: sys.stdin.buffer
413	n/a	(not used when the request method is GET)
414	n/a	Can be :
415	n/a	1. a TextIOWrapper object
416	n/a	2. an object whose read() and readline() methods return bytes
417	n/a
418	n/a	headers : header dictionary-like object; default:
419	n/a	taken from environ as per CGI spec
420	n/a
421	n/a	outerboundary : terminating multipart boundary
422	n/a	(for internal use only)
423	n/a
424	n/a	environ : environment dictionary; default: os.environ
425	n/a
426	n/a	keep_blank_values: flag indicating whether blank values in
427	n/a	percent-encoded forms should be treated as blank strings.
428	n/a	A true value indicates that blanks should be retained as
429	n/a	blank strings. The default false value indicates that
430	n/a	blank values are to be ignored and treated as if they were
431	n/a	not included.
432	n/a
433	n/a	strict_parsing: flag indicating what to do with parsing errors.
434	n/a	If false (the default), errors are silently ignored.
435	n/a	If true, errors raise a ValueError exception.
436	n/a
437	n/a	limit : used internally to read parts of multipart/form-data forms,
438	n/a	to exit from the reading loop when reached. It is the difference
439	n/a	between the form content-length and the number of bytes already
440	n/a	read
441	n/a
442	n/a	encoding, errors : the encoding and error handler used to decode the
443	n/a	binary stream to strings. Must be the same as the charset defined
444	n/a	for the page sending the form (content-type : meta http-equiv or
445	n/a	header)
446	n/a
447	n/a	"""
448	n/a	method = 'GET'
449	n/a	self.keep_blank_values = keep_blank_values
450	n/a	self.strict_parsing = strict_parsing
451	n/a	if 'REQUEST_METHOD' in environ:
452	n/a	method = environ['REQUEST_METHOD'].upper()
453	n/a	self.qs_on_post = None
454	n/a	if method == 'GET' or method == 'HEAD':
455	n/a	if 'QUERY_STRING' in environ:
456	n/a	qs = environ['QUERY_STRING']
457	n/a	elif sys.argv[1:]:
458	n/a	qs = sys.argv[1]
459	n/a	else:
460	n/a	qs = ""
461	n/a	qs = qs.encode(locale.getpreferredencoding(), 'surrogateescape')
462	n/a	fp = BytesIO(qs)
463	n/a	if headers is None:
464	n/a	headers = {'content-type':
465	n/a	"application/x-www-form-urlencoded"}
466	n/a	if headers is None:
467	n/a	headers = {}
468	n/a	if method == 'POST':
469	n/a	# Set default content-type for POST to what's traditional
470	n/a	headers['content-type'] = "application/x-www-form-urlencoded"
471	n/a	if 'CONTENT_TYPE' in environ:
472	n/a	headers['content-type'] = environ['CONTENT_TYPE']
473	n/a	if 'QUERY_STRING' in environ:
474	n/a	self.qs_on_post = environ['QUERY_STRING']
475	n/a	if 'CONTENT_LENGTH' in environ:
476	n/a	headers['content-length'] = environ['CONTENT_LENGTH']
477	n/a	else:
478	n/a	if not (isinstance(headers, (Mapping, Message))):
479	n/a	raise TypeError("headers must be mapping or an instance of "
480	n/a	"email.message.Message")
481	n/a	self.headers = headers
482	n/a	if fp is None:
483	n/a	self.fp = sys.stdin.buffer
484	n/a	# self.fp.read() must return bytes
485	n/a	elif isinstance(fp, TextIOWrapper):
486	n/a	self.fp = fp.buffer
487	n/a	else:
488	n/a	if not (hasattr(fp, 'read') and hasattr(fp, 'readline')):
489	n/a	raise TypeError("fp must be file pointer")
490	n/a	self.fp = fp
491	n/a
492	n/a	self.encoding = encoding
493	n/a	self.errors = errors
494	n/a
495	n/a	if not isinstance(outerboundary, bytes):
496	n/a	raise TypeError('outerboundary must be bytes, not %s'
497	n/a	% type(outerboundary).__name__)
498	n/a	self.outerboundary = outerboundary
499	n/a
500	n/a	self.bytes_read = 0
501	n/a	self.limit = limit
502	n/a
503	n/a	# Process content-disposition header
504	n/a	cdisp, pdict = "", {}
505	n/a	if 'content-disposition' in self.headers:
506	n/a	cdisp, pdict = parse_header(self.headers['content-disposition'])
507	n/a	self.disposition = cdisp
508	n/a	self.disposition_options = pdict
509	n/a	self.name = None
510	n/a	if 'name' in pdict:
511	n/a	self.name = pdict['name']
512	n/a	self.filename = None
513	n/a	if 'filename' in pdict:
514	n/a	self.filename = pdict['filename']
515	n/a	self._binary_file = self.filename is not None
516	n/a
517	n/a	# Process content-type header
518	n/a	#
519	n/a	# Honor any existing content-type header. But if there is no
520	n/a	# content-type header, use some sensible defaults. Assume
521	n/a	# outerboundary is "" at the outer level, but something non-false
522	n/a	# inside a multi-part. The default for an inner part is text/plain,
523	n/a	# but for an outer part it should be urlencoded. This should catch
524	n/a	# bogus clients which erroneously forget to include a content-type
525	n/a	# header.
526	n/a	#
527	n/a	# See below for what we do if there does exist a content-type header,
528	n/a	# but it happens to be something we don't understand.
529	n/a	if 'content-type' in self.headers:
530	n/a	ctype, pdict = parse_header(self.headers['content-type'])
531	n/a	elif self.outerboundary or method != 'POST':
532	n/a	ctype, pdict = "text/plain", {}
533	n/a	else:
534	n/a	ctype, pdict = 'application/x-www-form-urlencoded', {}
535	n/a	self.type = ctype
536	n/a	self.type_options = pdict
537	n/a	if 'boundary' in pdict:
538	n/a	self.innerboundary = pdict['boundary'].encode(self.encoding)
539	n/a	else:
540	n/a	self.innerboundary = b""
541	n/a
542	n/a	clen = -1
543	n/a	if 'content-length' in self.headers:
544	n/a	try:
545	n/a	clen = int(self.headers['content-length'])
546	n/a	except ValueError:
547	n/a	pass
548	n/a	if maxlen and clen > maxlen:
549	n/a	raise ValueError('Maximum content length exceeded')
550	n/a	self.length = clen
551	n/a	if self.limit is None and clen:
552	n/a	self.limit = clen
553	n/a
554	n/a	self.list = self.file = None
555	n/a	self.done = 0
556	n/a	if ctype == 'application/x-www-form-urlencoded':
557	n/a	self.read_urlencoded()
558	n/a	elif ctype[:10] == 'multipart/':
559	n/a	self.read_multi(environ, keep_blank_values, strict_parsing)
560	n/a	else:
561	n/a	self.read_single()
562	n/a
563	n/a	def __del__(self):
564	n/a	try:
565	n/a	self.file.close()
566	n/a	except AttributeError:
567	n/a	pass
568	n/a
569	n/a	def __enter__(self):
570	n/a	return self
571	n/a
572	n/a	def __exit__(self, *args):
573	n/a	self.file.close()
574	n/a
575	n/a	def __repr__(self):
576	n/a	"""Return a printable representation."""
577	n/a	return "FieldStorage(%r, %r, %r)" % (
578	n/a	self.name, self.filename, self.value)
579	n/a
580	n/a	def __iter__(self):
581	n/a	return iter(self.keys())
582	n/a
583	n/a	def __getattr__(self, name):
584	n/a	if name != 'value':
585	n/a	raise AttributeError(name)
586	n/a	if self.file:
587	n/a	self.file.seek(0)
588	n/a	value = self.file.read()
589	n/a	self.file.seek(0)
590	n/a	elif self.list is not None:
591	n/a	value = self.list
592	n/a	else:
593	n/a	value = None
594	n/a	return value
595	n/a
596	n/a	def __getitem__(self, key):
597	n/a	"""Dictionary style indexing."""
598	n/a	if self.list is None:
599	n/a	raise TypeError("not indexable")
600	n/a	found = []
601	n/a	for item in self.list:
602	n/a	if item.name == key: found.append(item)
603	n/a	if not found:
604	n/a	raise KeyError(key)
605	n/a	if len(found) == 1:
606	n/a	return found[0]
607	n/a	else:
608	n/a	return found
609	n/a
610	n/a	def getvalue(self, key, default=None):
611	n/a	"""Dictionary style get() method, including 'value' lookup."""
612	n/a	if key in self:
613	n/a	value = self[key]
614	n/a	if isinstance(value, list):
615	n/a	return [x.value for x in value]
616	n/a	else:
617	n/a	return value.value
618	n/a	else:
619	n/a	return default
620	n/a
621	n/a	def getfirst(self, key, default=None):
622	n/a	""" Return the first value received."""
623	n/a	if key in self:
624	n/a	value = self[key]
625	n/a	if isinstance(value, list):
626	n/a	return value[0].value
627	n/a	else:
628	n/a	return value.value
629	n/a	else:
630	n/a	return default
631	n/a
632	n/a	def getlist(self, key):
633	n/a	""" Return list of received values."""
634	n/a	if key in self:
635	n/a	value = self[key]
636	n/a	if isinstance(value, list):
637	n/a	return [x.value for x in value]
638	n/a	else:
639	n/a	return [value.value]
640	n/a	else:
641	n/a	return []
642	n/a
643	n/a	def keys(self):
644	n/a	"""Dictionary style keys() method."""
645	n/a	if self.list is None:
646	n/a	raise TypeError("not indexable")
647	n/a	return list(set(item.name for item in self.list))
648	n/a
649	n/a	def __contains__(self, key):
650	n/a	"""Dictionary style __contains__ method."""
651	n/a	if self.list is None:
652	n/a	raise TypeError("not indexable")
653	n/a	return any(item.name == key for item in self.list)
654	n/a
655	n/a	def __len__(self):
656	n/a	"""Dictionary style len(x) support."""
657	n/a	return len(self.keys())
658	n/a
659	n/a	def __bool__(self):
660	n/a	if self.list is None:
661	n/a	raise TypeError("Cannot be converted to bool.")
662	n/a	return bool(self.list)
663	n/a
664	n/a	def read_urlencoded(self):
665	n/a	"""Internal: read data in query string format."""
666	n/a	qs = self.fp.read(self.length)
667	n/a	if not isinstance(qs, bytes):
668	n/a	raise ValueError("%s should return bytes, got %s" \
669	n/a	% (self.fp, type(qs).__name__))
670	n/a	qs = qs.decode(self.encoding, self.errors)
671	n/a	if self.qs_on_post:
672	n/a	qs += '&' + self.qs_on_post
673	n/a	self.list = []
674	n/a	query = urllib.parse.parse_qsl(
675	n/a	qs, self.keep_blank_values, self.strict_parsing,
676	n/a	encoding=self.encoding, errors=self.errors)
677	n/a	for key, value in query:
678	n/a	self.list.append(MiniFieldStorage(key, value))
679	n/a	self.skip_lines()
680	n/a
681	n/a	FieldStorageClass = None
682	n/a
683	n/a	def read_multi(self, environ, keep_blank_values, strict_parsing):
684	n/a	"""Internal: read a part that is itself multipart."""
685	n/a	ib = self.innerboundary
686	n/a	if not valid_boundary(ib):
687	n/a	raise ValueError('Invalid boundary in multipart form: %r' % (ib,))
688	n/a	self.list = []
689	n/a	if self.qs_on_post:
690	n/a	query = urllib.parse.parse_qsl(
691	n/a	self.qs_on_post, self.keep_blank_values, self.strict_parsing,
692	n/a	encoding=self.encoding, errors=self.errors)
693	n/a	for key, value in query:
694	n/a	self.list.append(MiniFieldStorage(key, value))
695	n/a
696	n/a	klass = self.FieldStorageClass or self.__class__
697	n/a	first_line = self.fp.readline() # bytes
698	n/a	if not isinstance(first_line, bytes):
699	n/a	raise ValueError("%s should return bytes, got %s" \
700	n/a	% (self.fp, type(first_line).__name__))
701	n/a	self.bytes_read += len(first_line)
702	n/a
703	n/a	# Ensure that we consume the file until we've hit our inner boundary
704	n/a	while (first_line.strip() != (b"--" + self.innerboundary) and
705	n/a	first_line):
706	n/a	first_line = self.fp.readline()
707	n/a	self.bytes_read += len(first_line)
708	n/a
709	n/a	while True:
710	n/a	parser = FeedParser()
711	n/a	hdr_text = b""
712	n/a	while True:
713	n/a	data = self.fp.readline()
714	n/a	hdr_text += data
715	n/a	if not data.strip():
716	n/a	break
717	n/a	if not hdr_text:
718	n/a	break
719	n/a	# parser takes strings, not bytes
720	n/a	self.bytes_read += len(hdr_text)
721	n/a	parser.feed(hdr_text.decode(self.encoding, self.errors))
722	n/a	headers = parser.close()
723	n/a
724	n/a	# Some clients add Content-Length for part headers, ignore them
725	n/a	if 'content-length' in headers:
726	n/a	del headers['content-length']
727	n/a
728	n/a	part = klass(self.fp, headers, ib, environ, keep_blank_values,
729	n/a	strict_parsing,self.limit-self.bytes_read,
730	n/a	self.encoding, self.errors)
731	n/a	self.bytes_read += part.bytes_read
732	n/a	self.list.append(part)
733	n/a	if part.done or self.bytes_read >= self.length > 0:
734	n/a	break
735	n/a	self.skip_lines()
736	n/a
737	n/a	def read_single(self):
738	n/a	"""Internal: read an atomic part."""
739	n/a	if self.length >= 0:
740	n/a	self.read_binary()
741	n/a	self.skip_lines()
742	n/a	else:
743	n/a	self.read_lines()
744	n/a	self.file.seek(0)
745	n/a
746	n/a	bufsize = 8*1024 # I/O buffering size for copy to file
747	n/a
748	n/a	def read_binary(self):
749	n/a	"""Internal: read binary data."""
750	n/a	self.file = self.make_file()
751	n/a	todo = self.length
752	n/a	if todo >= 0:
753	n/a	while todo > 0:
754	n/a	data = self.fp.read(min(todo, self.bufsize)) # bytes
755	n/a	if not isinstance(data, bytes):
756	n/a	raise ValueError("%s should return bytes, got %s"
757	n/a	% (self.fp, type(data).__name__))
758	n/a	self.bytes_read += len(data)
759	n/a	if not data:
760	n/a	self.done = -1
761	n/a	break
762	n/a	self.file.write(data)
763	n/a	todo = todo - len(data)
764	n/a
765	n/a	def read_lines(self):
766	n/a	"""Internal: read lines until EOF or outerboundary."""
767	n/a	if self._binary_file:
768	n/a	self.file = self.__file = BytesIO() # store data as bytes for files
769	n/a	else:
770	n/a	self.file = self.__file = StringIO() # as strings for other fields
771	n/a	if self.outerboundary:
772	n/a	self.read_lines_to_outerboundary()
773	n/a	else:
774	n/a	self.read_lines_to_eof()
775	n/a
776	n/a	def __write(self, line):
777	n/a	"""line is always bytes, not string"""
778	n/a	if self.__file is not None:
779	n/a	if self.__file.tell() + len(line) > 1000:
780	n/a	self.file = self.make_file()
781	n/a	data = self.__file.getvalue()
782	n/a	self.file.write(data)
783	n/a	self.__file = None
784	n/a	if self._binary_file:
785	n/a	# keep bytes
786	n/a	self.file.write(line)
787	n/a	else:
788	n/a	# decode to string
789	n/a	self.file.write(line.decode(self.encoding, self.errors))
790	n/a
791	n/a	def read_lines_to_eof(self):
792	n/a	"""Internal: read lines until EOF."""
793	n/a	while 1:
794	n/a	line = self.fp.readline(1<<16) # bytes
795	n/a	self.bytes_read += len(line)
796	n/a	if not line:
797	n/a	self.done = -1
798	n/a	break
799	n/a	self.__write(line)
800	n/a
801	n/a	def read_lines_to_outerboundary(self):
802	n/a	"""Internal: read lines until outerboundary.
803	n/a	Data is read as bytes: boundaries and line ends must be converted
804	n/a	to bytes for comparisons.
805	n/a	"""
806	n/a	next_boundary = b"--" + self.outerboundary
807	n/a	last_boundary = next_boundary + b"--"
808	n/a	delim = b""
809	n/a	last_line_lfend = True
810	n/a	_read = 0
811	n/a	while 1:
812	n/a	if _read >= self.limit:
813	n/a	break
814	n/a	line = self.fp.readline(1<<16) # bytes
815	n/a	self.bytes_read += len(line)
816	n/a	_read += len(line)
817	n/a	if not line:
818	n/a	self.done = -1
819	n/a	break
820	n/a	if delim == b"\r":
821	n/a	line = delim + line
822	n/a	delim = b""
823	n/a	if line.startswith(b"--") and last_line_lfend:
824	n/a	strippedline = line.rstrip()
825	n/a	if strippedline == next_boundary:
826	n/a	break
827	n/a	if strippedline == last_boundary:
828	n/a	self.done = 1
829	n/a	break
830	n/a	odelim = delim
831	n/a	if line.endswith(b"\r\n"):
832	n/a	delim = b"\r\n"
833	n/a	line = line[:-2]
834	n/a	last_line_lfend = True
835	n/a	elif line.endswith(b"\n"):
836	n/a	delim = b"\n"
837	n/a	line = line[:-1]
838	n/a	last_line_lfend = True
839	n/a	elif line.endswith(b"\r"):
840	n/a	# We may interrupt \r\n sequences if they span the 2**16
841	n/a	# byte boundary
842	n/a	delim = b"\r"
843	n/a	line = line[:-1]
844	n/a	last_line_lfend = False
845	n/a	else:
846	n/a	delim = b""
847	n/a	last_line_lfend = False
848	n/a	self.__write(odelim + line)
849	n/a
850	n/a	def skip_lines(self):
851	n/a	"""Internal: skip lines until outer boundary if defined."""
852	n/a	if not self.outerboundary or self.done:
853	n/a	return
854	n/a	next_boundary = b"--" + self.outerboundary
855	n/a	last_boundary = next_boundary + b"--"
856	n/a	last_line_lfend = True
857	n/a	while True:
858	n/a	line = self.fp.readline(1<<16)
859	n/a	self.bytes_read += len(line)
860	n/a	if not line:
861	n/a	self.done = -1
862	n/a	break
863	n/a	if line.endswith(b"--") and last_line_lfend:
864	n/a	strippedline = line.strip()
865	n/a	if strippedline == next_boundary:
866	n/a	break
867	n/a	if strippedline == last_boundary:
868	n/a	self.done = 1
869	n/a	break
870	n/a	last_line_lfend = line.endswith(b'\n')
871	n/a
872	n/a	def make_file(self):
873	n/a	"""Overridable: return a readable & writable file.
874	n/a
875	n/a	The file will be used as follows:
876	n/a	- data is written to it
877	n/a	- seek(0)
878	n/a	- data is read from it
879	n/a
880	n/a	The file is opened in binary mode for files, in text mode
881	n/a	for other fields
882	n/a
883	n/a	This version opens a temporary file for reading and writing,
884	n/a	and immediately deletes (unlinks) it. The trick (on Unix!) is
885	n/a	that the file can still be used, but it can't be opened by
886	n/a	another process, and it will automatically be deleted when it
887	n/a	is closed or when the current process terminates.
888	n/a
889	n/a	If you want a more permanent file, you derive a class which
890	n/a	overrides this method. If you want a visible temporary file
891	n/a	that is nevertheless automatically deleted when the script
892	n/a	terminates, try defining a __del__ method in a derived class
893	n/a	which unlinks the temporary files you have created.
894	n/a
895	n/a	"""
896	n/a	if self._binary_file:
897	n/a	return tempfile.TemporaryFile("wb+")
898	n/a	else:
899	n/a	return tempfile.TemporaryFile("w+",
900	n/a	encoding=self.encoding, newline = '\n')
901	n/a
902	n/a
903	n/a	# Test/debug code
904	n/a	# ===============
905	n/a
906	n/a	def test(environ=os.environ):
907	n/a	"""Robust test CGI script, usable as main program.
908	n/a
909	n/a	Write minimal HTTP headers and dump all information provided to
910	n/a	the script in HTML form.
911	n/a
912	n/a	"""
913	n/a	print("Content-type: text/html")
914	n/a	print()
915	n/a	sys.stderr = sys.stdout
916	n/a	try:
917	n/a	form = FieldStorage() # Replace with other classes to test those
918	n/a	print_directory()
919	n/a	print_arguments()
920	n/a	print_form(form)
921	n/a	print_environ(environ)
922	n/a	print_environ_usage()
923	n/a	def f():
924	n/a	exec("testing print_exception() -- <I>italics?</I>")
925	n/a	def g(f=f):
926	n/a	f()
927	n/a	print("<H3>What follows is a test, not an actual exception:</H3>")
928	n/a	g()
929	n/a	except:
930	n/a	print_exception()
931	n/a
932	n/a	print("<H1>Second try with a small maxlen...</H1>")
933	n/a
934	n/a	global maxlen
935	n/a	maxlen = 50
936	n/a	try:
937	n/a	form = FieldStorage() # Replace with other classes to test those
938	n/a	print_directory()
939	n/a	print_arguments()
940	n/a	print_form(form)
941	n/a	print_environ(environ)
942	n/a	except:
943	n/a	print_exception()
944	n/a
945	n/a	def print_exception(type=None, value=None, tb=None, limit=None):
946	n/a	if type is None:
947	n/a	type, value, tb = sys.exc_info()
948	n/a	import traceback
949	n/a	print()
950	n/a	print("<H3>Traceback (most recent call last):</H3>")
951	n/a	list = traceback.format_tb(tb, limit) + \
952	n/a	traceback.format_exception_only(type, value)
953	n/a	print("<PRE>%s<B>%s</B></PRE>" % (
954	n/a	html.escape("".join(list[:-1])),
955	n/a	html.escape(list[-1]),
956	n/a	))
957	n/a	del tb
958	n/a
959	n/a	def print_environ(environ=os.environ):
960	n/a	"""Dump the shell environment as HTML."""
961	n/a	keys = sorted(environ.keys())
962	n/a	print()
963	n/a	print("<H3>Shell Environment:</H3>")
964	n/a	print("<DL>")
965	n/a	for key in keys:
966	n/a	print("<DT>", html.escape(key), "<DD>", html.escape(environ[key]))
967	n/a	print("</DL>")
968	n/a	print()
969	n/a
970	n/a	def print_form(form):
971	n/a	"""Dump the contents of a form as HTML."""
972	n/a	keys = sorted(form.keys())
973	n/a	print()
974	n/a	print("<H3>Form Contents:</H3>")
975	n/a	if not keys:
976	n/a	print("<P>No form fields.")
977	n/a	print("<DL>")
978	n/a	for key in keys:
979	n/a	print("<DT>" + html.escape(key) + ":", end=' ')
980	n/a	value = form[key]
981	n/a	print("<i>" + html.escape(repr(type(value))) + "</i>")
982	n/a	print("<DD>" + html.escape(repr(value)))
983	n/a	print("</DL>")
984	n/a	print()
985	n/a
986	n/a	def print_directory():
987	n/a	"""Dump the current directory as HTML."""
988	n/a	print()
989	n/a	print("<H3>Current Working Directory:</H3>")
990	n/a	try:
991	n/a	pwd = os.getcwd()
992	n/a	except OSError as msg:
993	n/a	print("OSError:", html.escape(str(msg)))
994	n/a	else:
995	n/a	print(html.escape(pwd))
996	n/a	print()
997	n/a
998	n/a	def print_arguments():
999	n/a	print()
1000	n/a	print("<H3>Command Line Arguments:</H3>")
1001	n/a	print()
1002	n/a	print(sys.argv)
1003	n/a	print()
1004	n/a
1005	n/a	def print_environ_usage():
1006	n/a	"""Dump a list of environment variables used by CGI as HTML."""
1007	n/a	print("""
1008	n/a	<H3>These environment variables could have been set:</H3>
1009	n/a	<UL>
1010	n/a	<LI>AUTH_TYPE
1011	n/a	<LI>CONTENT_LENGTH
1012	n/a	<LI>CONTENT_TYPE
1013	n/a	<LI>DATE_GMT
1014	n/a	<LI>DATE_LOCAL
1015	n/a	<LI>DOCUMENT_NAME
1016	n/a	<LI>DOCUMENT_ROOT
1017	n/a	<LI>DOCUMENT_URI
1018	n/a	<LI>GATEWAY_INTERFACE
1019	n/a	<LI>LAST_MODIFIED
1020	n/a	<LI>PATH
1021	n/a	<LI>PATH_INFO
1022	n/a	<LI>PATH_TRANSLATED
1023	n/a	<LI>QUERY_STRING
1024	n/a	<LI>REMOTE_ADDR
1025	n/a	<LI>REMOTE_HOST
1026	n/a	<LI>REMOTE_IDENT
1027	n/a	<LI>REMOTE_USER
1028	n/a	<LI>REQUEST_METHOD
1029	n/a	<LI>SCRIPT_NAME
1030	n/a	<LI>SERVER_NAME
1031	n/a	<LI>SERVER_PORT
1032	n/a	<LI>SERVER_PROTOCOL
1033	n/a	<LI>SERVER_ROOT
1034	n/a	<LI>SERVER_SOFTWARE
1035	n/a	</UL>
1036	n/a	In addition, HTTP headers sent by the server may be passed in the
1037	n/a	environment as well. Here are some common variable names:
1038	n/a	<UL>
1039	n/a	<LI>HTTP_ACCEPT
1040	n/a	<LI>HTTP_CONNECTION
1041	n/a	<LI>HTTP_HOST
1042	n/a	<LI>HTTP_PRAGMA
1043	n/a	<LI>HTTP_REFERER
1044	n/a	<LI>HTTP_USER_AGENT
1045	n/a	</UL>
1046	n/a	""")
1047	n/a
1048	n/a
1049	n/a	# Utilities
1050	n/a	# =========
1051	n/a
1052	n/a	def escape(s, quote=None):
1053	n/a	"""Deprecated API."""
1054	n/a	warn("cgi.escape is deprecated, use html.escape instead",
1055	n/a	DeprecationWarning, stacklevel=2)
1056	n/a	s = s.replace("&", "&") # Must be done first!
1057	n/a	s = s.replace("<", "<")
1058	n/a	s = s.replace(">", ">")
1059	n/a	if quote:
1060	n/a	s = s.replace('"', """)
1061	n/a	return s
1062	n/a
1063	n/a
1064	n/a	def valid_boundary(s):
1065	n/a	import re
1066	n/a	if isinstance(s, bytes):
1067	n/a	_vb_pattern = b"^[ -~]{0,200}[!-~]$"
1068	n/a	else:
1069	n/a	_vb_pattern = "^[ -~]{0,200}[!-~]$"
1070	n/a	return re.match(_vb_pattern, s)
1071	n/a
1072	n/a	# Invoke mainline
1073	n/a	# ===============
1074	n/a
1075	n/a	# Call test() when this file is run as a script (not imported as a module)
1076	n/a	if __name__ == '__main__':
1077	n/a	test()