1 | n/a | """HTTP server classes. |
---|
2 | n/a | |
---|
3 | n/a | Note: BaseHTTPRequestHandler doesn't implement any HTTP request; see |
---|
4 | n/a | SimpleHTTPRequestHandler for simple implementations of GET, HEAD and POST, |
---|
5 | n/a | and CGIHTTPRequestHandler for CGI scripts. |
---|
6 | n/a | |
---|
7 | n/a | It does, however, optionally implement HTTP/1.1 persistent connections, |
---|
8 | n/a | as of version 0.3. |
---|
9 | n/a | |
---|
10 | n/a | Notes on CGIHTTPRequestHandler |
---|
11 | n/a | ------------------------------ |
---|
12 | n/a | |
---|
13 | n/a | This class implements GET and POST requests to cgi-bin scripts. |
---|
14 | n/a | |
---|
15 | n/a | If the os.fork() function is not present (e.g. on Windows), |
---|
16 | n/a | subprocess.Popen() is used as a fallback, with slightly altered semantics. |
---|
17 | n/a | |
---|
18 | n/a | In all cases, the implementation is intentionally naive -- all |
---|
19 | n/a | requests are executed synchronously. |
---|
20 | n/a | |
---|
21 | n/a | SECURITY WARNING: DON'T USE THIS CODE UNLESS YOU ARE INSIDE A FIREWALL |
---|
22 | n/a | -- it may execute arbitrary Python code or external programs. |
---|
23 | n/a | |
---|
24 | n/a | Note that status code 200 is sent prior to execution of a CGI script, so |
---|
25 | n/a | scripts cannot send other status codes such as 302 (redirect). |
---|
26 | n/a | |
---|
27 | n/a | XXX To do: |
---|
28 | n/a | |
---|
29 | n/a | - log requests even later (to capture byte count) |
---|
30 | n/a | - log user-agent header and other interesting goodies |
---|
31 | n/a | - send error log to separate file |
---|
32 | n/a | """ |
---|
33 | n/a | |
---|
34 | n/a | |
---|
35 | n/a | # See also: |
---|
36 | n/a | # |
---|
37 | n/a | # HTTP Working Group T. Berners-Lee |
---|
38 | n/a | # INTERNET-DRAFT R. T. Fielding |
---|
39 | n/a | # <draft-ietf-http-v10-spec-00.txt> H. Frystyk Nielsen |
---|
40 | n/a | # Expires September 8, 1995 March 8, 1995 |
---|
41 | n/a | # |
---|
42 | n/a | # URL: http://www.ics.uci.edu/pub/ietf/http/draft-ietf-http-v10-spec-00.txt |
---|
43 | n/a | # |
---|
44 | n/a | # and |
---|
45 | n/a | # |
---|
46 | n/a | # Network Working Group R. Fielding |
---|
47 | n/a | # Request for Comments: 2616 et al |
---|
48 | n/a | # Obsoletes: 2068 June 1999 |
---|
49 | n/a | # Category: Standards Track |
---|
50 | n/a | # |
---|
51 | n/a | # URL: http://www.faqs.org/rfcs/rfc2616.html |
---|
52 | n/a | |
---|
53 | n/a | # Log files |
---|
54 | n/a | # --------- |
---|
55 | n/a | # |
---|
56 | n/a | # Here's a quote from the NCSA httpd docs about log file format. |
---|
57 | n/a | # |
---|
58 | n/a | # | The logfile format is as follows. Each line consists of: |
---|
59 | n/a | # | |
---|
60 | n/a | # | host rfc931 authuser [DD/Mon/YYYY:hh:mm:ss] "request" ddd bbbb |
---|
61 | n/a | # | |
---|
62 | n/a | # | host: Either the DNS name or the IP number of the remote client |
---|
63 | n/a | # | rfc931: Any information returned by identd for this person, |
---|
64 | n/a | # | - otherwise. |
---|
65 | n/a | # | authuser: If user sent a userid for authentication, the user name, |
---|
66 | n/a | # | - otherwise. |
---|
67 | n/a | # | DD: Day |
---|
68 | n/a | # | Mon: Month (calendar name) |
---|
69 | n/a | # | YYYY: Year |
---|
70 | n/a | # | hh: hour (24-hour format, the machine's timezone) |
---|
71 | n/a | # | mm: minutes |
---|
72 | n/a | # | ss: seconds |
---|
73 | n/a | # | request: The first line of the HTTP request as sent by the client. |
---|
74 | n/a | # | ddd: the status code returned by the server, - if not available. |
---|
75 | n/a | # | bbbb: the total number of bytes sent, |
---|
76 | n/a | # | *not including the HTTP/1.0 header*, - if not available |
---|
77 | n/a | # | |
---|
78 | n/a | # | You can determine the name of the file accessed through request. |
---|
79 | n/a | # |
---|
80 | n/a | # (Actually, the latter is only true if you know the server configuration |
---|
81 | n/a | # at the time the request was made!) |
---|
82 | n/a | |
---|
83 | n/a | __version__ = "0.6" |
---|
84 | n/a | |
---|
85 | n/a | __all__ = [ |
---|
86 | n/a | "HTTPServer", "BaseHTTPRequestHandler", |
---|
87 | n/a | "SimpleHTTPRequestHandler", "CGIHTTPRequestHandler", |
---|
88 | n/a | ] |
---|
89 | n/a | |
---|
90 | n/a | import email.utils |
---|
91 | n/a | import html |
---|
92 | n/a | import http.client |
---|
93 | n/a | import io |
---|
94 | n/a | import mimetypes |
---|
95 | n/a | import os |
---|
96 | n/a | import posixpath |
---|
97 | n/a | import select |
---|
98 | n/a | import shutil |
---|
99 | n/a | import socket # For gethostbyaddr() |
---|
100 | n/a | import socketserver |
---|
101 | n/a | import sys |
---|
102 | n/a | import time |
---|
103 | n/a | import urllib.parse |
---|
104 | n/a | import copy |
---|
105 | n/a | import argparse |
---|
106 | n/a | |
---|
107 | n/a | from http import HTTPStatus |
---|
108 | n/a | |
---|
109 | n/a | |
---|
110 | n/a | # Default error message template |
---|
111 | n/a | DEFAULT_ERROR_MESSAGE = """\ |
---|
112 | n/a | <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" |
---|
113 | n/a | "http://www.w3.org/TR/html4/strict.dtd"> |
---|
114 | n/a | <html> |
---|
115 | n/a | <head> |
---|
116 | n/a | <meta http-equiv="Content-Type" content="text/html;charset=utf-8"> |
---|
117 | n/a | <title>Error response</title> |
---|
118 | n/a | </head> |
---|
119 | n/a | <body> |
---|
120 | n/a | <h1>Error response</h1> |
---|
121 | n/a | <p>Error code: %(code)d</p> |
---|
122 | n/a | <p>Message: %(message)s.</p> |
---|
123 | n/a | <p>Error code explanation: %(code)s - %(explain)s.</p> |
---|
124 | n/a | </body> |
---|
125 | n/a | </html> |
---|
126 | n/a | """ |
---|
127 | n/a | |
---|
128 | n/a | DEFAULT_ERROR_CONTENT_TYPE = "text/html;charset=utf-8" |
---|
129 | n/a | |
---|
130 | n/a | class HTTPServer(socketserver.TCPServer): |
---|
131 | n/a | |
---|
132 | n/a | allow_reuse_address = 1 # Seems to make sense in testing environment |
---|
133 | n/a | |
---|
134 | n/a | def server_bind(self): |
---|
135 | n/a | """Override server_bind to store the server name.""" |
---|
136 | n/a | socketserver.TCPServer.server_bind(self) |
---|
137 | n/a | host, port = self.server_address[:2] |
---|
138 | n/a | self.server_name = socket.getfqdn(host) |
---|
139 | n/a | self.server_port = port |
---|
140 | n/a | |
---|
141 | n/a | |
---|
142 | n/a | class BaseHTTPRequestHandler(socketserver.StreamRequestHandler): |
---|
143 | n/a | |
---|
144 | n/a | """HTTP request handler base class. |
---|
145 | n/a | |
---|
146 | n/a | The following explanation of HTTP serves to guide you through the |
---|
147 | n/a | code as well as to expose any misunderstandings I may have about |
---|
148 | n/a | HTTP (so you don't need to read the code to figure out I'm wrong |
---|
149 | n/a | :-). |
---|
150 | n/a | |
---|
151 | n/a | HTTP (HyperText Transfer Protocol) is an extensible protocol on |
---|
152 | n/a | top of a reliable stream transport (e.g. TCP/IP). The protocol |
---|
153 | n/a | recognizes three parts to a request: |
---|
154 | n/a | |
---|
155 | n/a | 1. One line identifying the request type and path |
---|
156 | n/a | 2. An optional set of RFC-822-style headers |
---|
157 | n/a | 3. An optional data part |
---|
158 | n/a | |
---|
159 | n/a | The headers and data are separated by a blank line. |
---|
160 | n/a | |
---|
161 | n/a | The first line of the request has the form |
---|
162 | n/a | |
---|
163 | n/a | <command> <path> <version> |
---|
164 | n/a | |
---|
165 | n/a | where <command> is a (case-sensitive) keyword such as GET or POST, |
---|
166 | n/a | <path> is a string containing path information for the request, |
---|
167 | n/a | and <version> should be the string "HTTP/1.0" or "HTTP/1.1". |
---|
168 | n/a | <path> is encoded using the URL encoding scheme (using %xx to signify |
---|
169 | n/a | the ASCII character with hex code xx). |
---|
170 | n/a | |
---|
171 | n/a | The specification specifies that lines are separated by CRLF but |
---|
172 | n/a | for compatibility with the widest range of clients recommends |
---|
173 | n/a | servers also handle LF. Similarly, whitespace in the request line |
---|
174 | n/a | is treated sensibly (allowing multiple spaces between components |
---|
175 | n/a | and allowing trailing whitespace). |
---|
176 | n/a | |
---|
177 | n/a | Similarly, for output, lines ought to be separated by CRLF pairs |
---|
178 | n/a | but most clients grok LF characters just fine. |
---|
179 | n/a | |
---|
180 | n/a | If the first line of the request has the form |
---|
181 | n/a | |
---|
182 | n/a | <command> <path> |
---|
183 | n/a | |
---|
184 | n/a | (i.e. <version> is left out) then this is assumed to be an HTTP |
---|
185 | n/a | 0.9 request; this form has no optional headers and data part and |
---|
186 | n/a | the reply consists of just the data. |
---|
187 | n/a | |
---|
188 | n/a | The reply form of the HTTP 1.x protocol again has three parts: |
---|
189 | n/a | |
---|
190 | n/a | 1. One line giving the response code |
---|
191 | n/a | 2. An optional set of RFC-822-style headers |
---|
192 | n/a | 3. The data |
---|
193 | n/a | |
---|
194 | n/a | Again, the headers and data are separated by a blank line. |
---|
195 | n/a | |
---|
196 | n/a | The response code line has the form |
---|
197 | n/a | |
---|
198 | n/a | <version> <responsecode> <responsestring> |
---|
199 | n/a | |
---|
200 | n/a | where <version> is the protocol version ("HTTP/1.0" or "HTTP/1.1"), |
---|
201 | n/a | <responsecode> is a 3-digit response code indicating success or |
---|
202 | n/a | failure of the request, and <responsestring> is an optional |
---|
203 | n/a | human-readable string explaining what the response code means. |
---|
204 | n/a | |
---|
205 | n/a | This server parses the request and the headers, and then calls a |
---|
206 | n/a | function specific to the request type (<command>). Specifically, |
---|
207 | n/a | a request SPAM will be handled by a method do_SPAM(). If no |
---|
208 | n/a | such method exists the server sends an error response to the |
---|
209 | n/a | client. If it exists, it is called with no arguments: |
---|
210 | n/a | |
---|
211 | n/a | do_SPAM() |
---|
212 | n/a | |
---|
213 | n/a | Note that the request name is case sensitive (i.e. SPAM and spam |
---|
214 | n/a | are different requests). |
---|
215 | n/a | |
---|
216 | n/a | The various request details are stored in instance variables: |
---|
217 | n/a | |
---|
218 | n/a | - client_address is the client IP address in the form (host, |
---|
219 | n/a | port); |
---|
220 | n/a | |
---|
221 | n/a | - command, path and version are the broken-down request line; |
---|
222 | n/a | |
---|
223 | n/a | - headers is an instance of email.message.Message (or a derived |
---|
224 | n/a | class) containing the header information; |
---|
225 | n/a | |
---|
226 | n/a | - rfile is a file object open for reading positioned at the |
---|
227 | n/a | start of the optional input data part; |
---|
228 | n/a | |
---|
229 | n/a | - wfile is a file object open for writing. |
---|
230 | n/a | |
---|
231 | n/a | IT IS IMPORTANT TO ADHERE TO THE PROTOCOL FOR WRITING! |
---|
232 | n/a | |
---|
233 | n/a | The first thing to be written must be the response line. Then |
---|
234 | n/a | follow 0 or more header lines, then a blank line, and then the |
---|
235 | n/a | actual data (if any). The meaning of the header lines depends on |
---|
236 | n/a | the command executed by the server; in most cases, when data is |
---|
237 | n/a | returned, there should be at least one header line of the form |
---|
238 | n/a | |
---|
239 | n/a | Content-type: <type>/<subtype> |
---|
240 | n/a | |
---|
241 | n/a | where <type> and <subtype> should be registered MIME types, |
---|
242 | n/a | e.g. "text/html" or "text/plain". |
---|
243 | n/a | |
---|
244 | n/a | """ |
---|
245 | n/a | |
---|
246 | n/a | # The Python system version, truncated to its first component. |
---|
247 | n/a | sys_version = "Python/" + sys.version.split()[0] |
---|
248 | n/a | |
---|
249 | n/a | # The server software version. You may want to override this. |
---|
250 | n/a | # The format is multiple whitespace-separated strings, |
---|
251 | n/a | # where each string is of the form name[/version]. |
---|
252 | n/a | server_version = "BaseHTTP/" + __version__ |
---|
253 | n/a | |
---|
254 | n/a | error_message_format = DEFAULT_ERROR_MESSAGE |
---|
255 | n/a | error_content_type = DEFAULT_ERROR_CONTENT_TYPE |
---|
256 | n/a | |
---|
257 | n/a | # The default request version. This only affects responses up until |
---|
258 | n/a | # the point where the request line is parsed, so it mainly decides what |
---|
259 | n/a | # the client gets back when sending a malformed request line. |
---|
260 | n/a | # Most web servers default to HTTP 0.9, i.e. don't send a status line. |
---|
261 | n/a | default_request_version = "HTTP/0.9" |
---|
262 | n/a | |
---|
263 | n/a | def parse_request(self): |
---|
264 | n/a | """Parse a request (internal). |
---|
265 | n/a | |
---|
266 | n/a | The request should be stored in self.raw_requestline; the results |
---|
267 | n/a | are in self.command, self.path, self.request_version and |
---|
268 | n/a | self.headers. |
---|
269 | n/a | |
---|
270 | n/a | Return True for success, False for failure; on failure, any relevant |
---|
271 | n/a | error response has already been sent back. |
---|
272 | n/a | |
---|
273 | n/a | """ |
---|
274 | n/a | self.command = None # set in case of error on the first line |
---|
275 | n/a | self.request_version = version = self.default_request_version |
---|
276 | n/a | self.close_connection = True |
---|
277 | n/a | requestline = str(self.raw_requestline, 'iso-8859-1') |
---|
278 | n/a | requestline = requestline.rstrip('\r\n') |
---|
279 | n/a | self.requestline = requestline |
---|
280 | n/a | words = requestline.split() |
---|
281 | n/a | if len(words) == 0: |
---|
282 | n/a | return False |
---|
283 | n/a | |
---|
284 | n/a | if len(words) >= 3: # Enough to determine protocol version |
---|
285 | n/a | version = words[-1] |
---|
286 | n/a | try: |
---|
287 | n/a | if not version.startswith('HTTP/'): |
---|
288 | n/a | raise ValueError |
---|
289 | n/a | base_version_number = version.split('/', 1)[1] |
---|
290 | n/a | version_number = base_version_number.split(".") |
---|
291 | n/a | # RFC 2145 section 3.1 says there can be only one "." and |
---|
292 | n/a | # - major and minor numbers MUST be treated as |
---|
293 | n/a | # separate integers; |
---|
294 | n/a | # - HTTP/2.4 is a lower version than HTTP/2.13, which in |
---|
295 | n/a | # turn is lower than HTTP/12.3; |
---|
296 | n/a | # - Leading zeros MUST be ignored by recipients. |
---|
297 | n/a | if len(version_number) != 2: |
---|
298 | n/a | raise ValueError |
---|
299 | n/a | version_number = int(version_number[0]), int(version_number[1]) |
---|
300 | n/a | except (ValueError, IndexError): |
---|
301 | n/a | self.send_error( |
---|
302 | n/a | HTTPStatus.BAD_REQUEST, |
---|
303 | n/a | "Bad request version (%r)" % version) |
---|
304 | n/a | return False |
---|
305 | n/a | if version_number >= (1, 1) and self.protocol_version >= "HTTP/1.1": |
---|
306 | n/a | self.close_connection = False |
---|
307 | n/a | if version_number >= (2, 0): |
---|
308 | n/a | self.send_error( |
---|
309 | n/a | HTTPStatus.HTTP_VERSION_NOT_SUPPORTED, |
---|
310 | n/a | "Invalid HTTP version (%s)" % base_version_number) |
---|
311 | n/a | return False |
---|
312 | n/a | self.request_version = version |
---|
313 | n/a | |
---|
314 | n/a | if not 2 <= len(words) <= 3: |
---|
315 | n/a | self.send_error( |
---|
316 | n/a | HTTPStatus.BAD_REQUEST, |
---|
317 | n/a | "Bad request syntax (%r)" % requestline) |
---|
318 | n/a | return False |
---|
319 | n/a | command, path = words[:2] |
---|
320 | n/a | if len(words) == 2: |
---|
321 | n/a | self.close_connection = True |
---|
322 | n/a | if command != 'GET': |
---|
323 | n/a | self.send_error( |
---|
324 | n/a | HTTPStatus.BAD_REQUEST, |
---|
325 | n/a | "Bad HTTP/0.9 request type (%r)" % command) |
---|
326 | n/a | return False |
---|
327 | n/a | self.command, self.path = command, path |
---|
328 | n/a | |
---|
329 | n/a | # Examine the headers and look for a Connection directive. |
---|
330 | n/a | try: |
---|
331 | n/a | self.headers = http.client.parse_headers(self.rfile, |
---|
332 | n/a | _class=self.MessageClass) |
---|
333 | n/a | except http.client.LineTooLong as err: |
---|
334 | n/a | self.send_error( |
---|
335 | n/a | HTTPStatus.REQUEST_HEADER_FIELDS_TOO_LARGE, |
---|
336 | n/a | "Line too long", |
---|
337 | n/a | str(err)) |
---|
338 | n/a | return False |
---|
339 | n/a | except http.client.HTTPException as err: |
---|
340 | n/a | self.send_error( |
---|
341 | n/a | HTTPStatus.REQUEST_HEADER_FIELDS_TOO_LARGE, |
---|
342 | n/a | "Too many headers", |
---|
343 | n/a | str(err) |
---|
344 | n/a | ) |
---|
345 | n/a | return False |
---|
346 | n/a | |
---|
347 | n/a | conntype = self.headers.get('Connection', "") |
---|
348 | n/a | if conntype.lower() == 'close': |
---|
349 | n/a | self.close_connection = True |
---|
350 | n/a | elif (conntype.lower() == 'keep-alive' and |
---|
351 | n/a | self.protocol_version >= "HTTP/1.1"): |
---|
352 | n/a | self.close_connection = False |
---|
353 | n/a | # Examine the headers and look for an Expect directive |
---|
354 | n/a | expect = self.headers.get('Expect', "") |
---|
355 | n/a | if (expect.lower() == "100-continue" and |
---|
356 | n/a | self.protocol_version >= "HTTP/1.1" and |
---|
357 | n/a | self.request_version >= "HTTP/1.1"): |
---|
358 | n/a | if not self.handle_expect_100(): |
---|
359 | n/a | return False |
---|
360 | n/a | return True |
---|
361 | n/a | |
---|
362 | n/a | def handle_expect_100(self): |
---|
363 | n/a | """Decide what to do with an "Expect: 100-continue" header. |
---|
364 | n/a | |
---|
365 | n/a | If the client is expecting a 100 Continue response, we must |
---|
366 | n/a | respond with either a 100 Continue or a final response before |
---|
367 | n/a | waiting for the request body. The default is to always respond |
---|
368 | n/a | with a 100 Continue. You can behave differently (for example, |
---|
369 | n/a | reject unauthorized requests) by overriding this method. |
---|
370 | n/a | |
---|
371 | n/a | This method should either return True (possibly after sending |
---|
372 | n/a | a 100 Continue response) or send an error response and return |
---|
373 | n/a | False. |
---|
374 | n/a | |
---|
375 | n/a | """ |
---|
376 | n/a | self.send_response_only(HTTPStatus.CONTINUE) |
---|
377 | n/a | self.end_headers() |
---|
378 | n/a | return True |
---|
379 | n/a | |
---|
380 | n/a | def handle_one_request(self): |
---|
381 | n/a | """Handle a single HTTP request. |
---|
382 | n/a | |
---|
383 | n/a | You normally don't need to override this method; see the class |
---|
384 | n/a | __doc__ string for information on how to handle specific HTTP |
---|
385 | n/a | commands such as GET and POST. |
---|
386 | n/a | |
---|
387 | n/a | """ |
---|
388 | n/a | try: |
---|
389 | n/a | self.raw_requestline = self.rfile.readline(65537) |
---|
390 | n/a | if len(self.raw_requestline) > 65536: |
---|
391 | n/a | self.requestline = '' |
---|
392 | n/a | self.request_version = '' |
---|
393 | n/a | self.command = '' |
---|
394 | n/a | self.send_error(HTTPStatus.REQUEST_URI_TOO_LONG) |
---|
395 | n/a | return |
---|
396 | n/a | if not self.raw_requestline: |
---|
397 | n/a | self.close_connection = True |
---|
398 | n/a | return |
---|
399 | n/a | if not self.parse_request(): |
---|
400 | n/a | # An error code has been sent, just exit |
---|
401 | n/a | return |
---|
402 | n/a | mname = 'do_' + self.command |
---|
403 | n/a | if not hasattr(self, mname): |
---|
404 | n/a | self.send_error( |
---|
405 | n/a | HTTPStatus.NOT_IMPLEMENTED, |
---|
406 | n/a | "Unsupported method (%r)" % self.command) |
---|
407 | n/a | return |
---|
408 | n/a | method = getattr(self, mname) |
---|
409 | n/a | method() |
---|
410 | n/a | self.wfile.flush() #actually send the response if not already done. |
---|
411 | n/a | except socket.timeout as e: |
---|
412 | n/a | #a read or a write timed out. Discard this connection |
---|
413 | n/a | self.log_error("Request timed out: %r", e) |
---|
414 | n/a | self.close_connection = True |
---|
415 | n/a | return |
---|
416 | n/a | |
---|
417 | n/a | def handle(self): |
---|
418 | n/a | """Handle multiple requests if necessary.""" |
---|
419 | n/a | self.close_connection = True |
---|
420 | n/a | |
---|
421 | n/a | self.handle_one_request() |
---|
422 | n/a | while not self.close_connection: |
---|
423 | n/a | self.handle_one_request() |
---|
424 | n/a | |
---|
425 | n/a | def send_error(self, code, message=None, explain=None): |
---|
426 | n/a | """Send and log an error reply. |
---|
427 | n/a | |
---|
428 | n/a | Arguments are |
---|
429 | n/a | * code: an HTTP error code |
---|
430 | n/a | 3 digits |
---|
431 | n/a | * message: a simple optional 1 line reason phrase. |
---|
432 | n/a | *( HTAB / SP / VCHAR / %x80-FF ) |
---|
433 | n/a | defaults to short entry matching the response code |
---|
434 | n/a | * explain: a detailed message defaults to the long entry |
---|
435 | n/a | matching the response code. |
---|
436 | n/a | |
---|
437 | n/a | This sends an error response (so it must be called before any |
---|
438 | n/a | output has been generated), logs the error, and finally sends |
---|
439 | n/a | a piece of HTML explaining the error to the user. |
---|
440 | n/a | |
---|
441 | n/a | """ |
---|
442 | n/a | |
---|
443 | n/a | try: |
---|
444 | n/a | shortmsg, longmsg = self.responses[code] |
---|
445 | n/a | except KeyError: |
---|
446 | n/a | shortmsg, longmsg = '???', '???' |
---|
447 | n/a | if message is None: |
---|
448 | n/a | message = shortmsg |
---|
449 | n/a | if explain is None: |
---|
450 | n/a | explain = longmsg |
---|
451 | n/a | self.log_error("code %d, message %s", code, message) |
---|
452 | n/a | self.send_response(code, message) |
---|
453 | n/a | self.send_header('Connection', 'close') |
---|
454 | n/a | |
---|
455 | n/a | # Message body is omitted for cases described in: |
---|
456 | n/a | # - RFC7230: 3.3. 1xx, 204(No Content), 304(Not Modified) |
---|
457 | n/a | # - RFC7231: 6.3.6. 205(Reset Content) |
---|
458 | n/a | body = None |
---|
459 | n/a | if (code >= 200 and |
---|
460 | n/a | code not in (HTTPStatus.NO_CONTENT, |
---|
461 | n/a | HTTPStatus.RESET_CONTENT, |
---|
462 | n/a | HTTPStatus.NOT_MODIFIED)): |
---|
463 | n/a | # HTML encode to prevent Cross Site Scripting attacks |
---|
464 | n/a | # (see bug #1100201) |
---|
465 | n/a | content = (self.error_message_format % { |
---|
466 | n/a | 'code': code, |
---|
467 | n/a | 'message': html.escape(message, quote=False), |
---|
468 | n/a | 'explain': html.escape(explain, quote=False) |
---|
469 | n/a | }) |
---|
470 | n/a | body = content.encode('UTF-8', 'replace') |
---|
471 | n/a | self.send_header("Content-Type", self.error_content_type) |
---|
472 | n/a | self.send_header('Content-Length', int(len(body))) |
---|
473 | n/a | self.end_headers() |
---|
474 | n/a | |
---|
475 | n/a | if self.command != 'HEAD' and body: |
---|
476 | n/a | self.wfile.write(body) |
---|
477 | n/a | |
---|
478 | n/a | def send_response(self, code, message=None): |
---|
479 | n/a | """Add the response header to the headers buffer and log the |
---|
480 | n/a | response code. |
---|
481 | n/a | |
---|
482 | n/a | Also send two standard headers with the server software |
---|
483 | n/a | version and the current date. |
---|
484 | n/a | |
---|
485 | n/a | """ |
---|
486 | n/a | self.log_request(code) |
---|
487 | n/a | self.send_response_only(code, message) |
---|
488 | n/a | self.send_header('Server', self.version_string()) |
---|
489 | n/a | self.send_header('Date', self.date_time_string()) |
---|
490 | n/a | |
---|
491 | n/a | def send_response_only(self, code, message=None): |
---|
492 | n/a | """Send the response header only.""" |
---|
493 | n/a | if self.request_version != 'HTTP/0.9': |
---|
494 | n/a | if message is None: |
---|
495 | n/a | if code in self.responses: |
---|
496 | n/a | message = self.responses[code][0] |
---|
497 | n/a | else: |
---|
498 | n/a | message = '' |
---|
499 | n/a | if not hasattr(self, '_headers_buffer'): |
---|
500 | n/a | self._headers_buffer = [] |
---|
501 | n/a | self._headers_buffer.append(("%s %d %s\r\n" % |
---|
502 | n/a | (self.protocol_version, code, message)).encode( |
---|
503 | n/a | 'latin-1', 'strict')) |
---|
504 | n/a | |
---|
505 | n/a | def send_header(self, keyword, value): |
---|
506 | n/a | """Send a MIME header to the headers buffer.""" |
---|
507 | n/a | if self.request_version != 'HTTP/0.9': |
---|
508 | n/a | if not hasattr(self, '_headers_buffer'): |
---|
509 | n/a | self._headers_buffer = [] |
---|
510 | n/a | self._headers_buffer.append( |
---|
511 | n/a | ("%s: %s\r\n" % (keyword, value)).encode('latin-1', 'strict')) |
---|
512 | n/a | |
---|
513 | n/a | if keyword.lower() == 'connection': |
---|
514 | n/a | if value.lower() == 'close': |
---|
515 | n/a | self.close_connection = True |
---|
516 | n/a | elif value.lower() == 'keep-alive': |
---|
517 | n/a | self.close_connection = False |
---|
518 | n/a | |
---|
519 | n/a | def end_headers(self): |
---|
520 | n/a | """Send the blank line ending the MIME headers.""" |
---|
521 | n/a | if self.request_version != 'HTTP/0.9': |
---|
522 | n/a | self._headers_buffer.append(b"\r\n") |
---|
523 | n/a | self.flush_headers() |
---|
524 | n/a | |
---|
525 | n/a | def flush_headers(self): |
---|
526 | n/a | if hasattr(self, '_headers_buffer'): |
---|
527 | n/a | self.wfile.write(b"".join(self._headers_buffer)) |
---|
528 | n/a | self._headers_buffer = [] |
---|
529 | n/a | |
---|
530 | n/a | def log_request(self, code='-', size='-'): |
---|
531 | n/a | """Log an accepted request. |
---|
532 | n/a | |
---|
533 | n/a | This is called by send_response(). |
---|
534 | n/a | |
---|
535 | n/a | """ |
---|
536 | n/a | if isinstance(code, HTTPStatus): |
---|
537 | n/a | code = code.value |
---|
538 | n/a | self.log_message('"%s" %s %s', |
---|
539 | n/a | self.requestline, str(code), str(size)) |
---|
540 | n/a | |
---|
541 | n/a | def log_error(self, format, *args): |
---|
542 | n/a | """Log an error. |
---|
543 | n/a | |
---|
544 | n/a | This is called when a request cannot be fulfilled. By |
---|
545 | n/a | default it passes the message on to log_message(). |
---|
546 | n/a | |
---|
547 | n/a | Arguments are the same as for log_message(). |
---|
548 | n/a | |
---|
549 | n/a | XXX This should go to the separate error log. |
---|
550 | n/a | |
---|
551 | n/a | """ |
---|
552 | n/a | |
---|
553 | n/a | self.log_message(format, *args) |
---|
554 | n/a | |
---|
555 | n/a | def log_message(self, format, *args): |
---|
556 | n/a | """Log an arbitrary message. |
---|
557 | n/a | |
---|
558 | n/a | This is used by all other logging functions. Override |
---|
559 | n/a | it if you have specific logging wishes. |
---|
560 | n/a | |
---|
561 | n/a | The first argument, FORMAT, is a format string for the |
---|
562 | n/a | message to be logged. If the format string contains |
---|
563 | n/a | any % escapes requiring parameters, they should be |
---|
564 | n/a | specified as subsequent arguments (it's just like |
---|
565 | n/a | printf!). |
---|
566 | n/a | |
---|
567 | n/a | The client ip and current date/time are prefixed to |
---|
568 | n/a | every message. |
---|
569 | n/a | |
---|
570 | n/a | """ |
---|
571 | n/a | |
---|
572 | n/a | sys.stderr.write("%s - - [%s] %s\n" % |
---|
573 | n/a | (self.address_string(), |
---|
574 | n/a | self.log_date_time_string(), |
---|
575 | n/a | format%args)) |
---|
576 | n/a | |
---|
577 | n/a | def version_string(self): |
---|
578 | n/a | """Return the server software version string.""" |
---|
579 | n/a | return self.server_version + ' ' + self.sys_version |
---|
580 | n/a | |
---|
581 | n/a | def date_time_string(self, timestamp=None): |
---|
582 | n/a | """Return the current date and time formatted for a message header.""" |
---|
583 | n/a | if timestamp is None: |
---|
584 | n/a | timestamp = time.time() |
---|
585 | n/a | return email.utils.formatdate(timestamp, usegmt=True) |
---|
586 | n/a | |
---|
587 | n/a | def log_date_time_string(self): |
---|
588 | n/a | """Return the current time formatted for logging.""" |
---|
589 | n/a | now = time.time() |
---|
590 | n/a | year, month, day, hh, mm, ss, x, y, z = time.localtime(now) |
---|
591 | n/a | s = "%02d/%3s/%04d %02d:%02d:%02d" % ( |
---|
592 | n/a | day, self.monthname[month], year, hh, mm, ss) |
---|
593 | n/a | return s |
---|
594 | n/a | |
---|
595 | n/a | weekdayname = ['Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat', 'Sun'] |
---|
596 | n/a | |
---|
597 | n/a | monthname = [None, |
---|
598 | n/a | 'Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', |
---|
599 | n/a | 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'] |
---|
600 | n/a | |
---|
601 | n/a | def address_string(self): |
---|
602 | n/a | """Return the client address.""" |
---|
603 | n/a | |
---|
604 | n/a | return self.client_address[0] |
---|
605 | n/a | |
---|
606 | n/a | # Essentially static class variables |
---|
607 | n/a | |
---|
608 | n/a | # The version of the HTTP protocol we support. |
---|
609 | n/a | # Set this to HTTP/1.1 to enable automatic keepalive |
---|
610 | n/a | protocol_version = "HTTP/1.0" |
---|
611 | n/a | |
---|
612 | n/a | # MessageClass used to parse headers |
---|
613 | n/a | MessageClass = http.client.HTTPMessage |
---|
614 | n/a | |
---|
615 | n/a | # hack to maintain backwards compatibility |
---|
616 | n/a | responses = { |
---|
617 | n/a | v: (v.phrase, v.description) |
---|
618 | n/a | for v in HTTPStatus.__members__.values() |
---|
619 | n/a | } |
---|
620 | n/a | |
---|
621 | n/a | |
---|
622 | n/a | class SimpleHTTPRequestHandler(BaseHTTPRequestHandler): |
---|
623 | n/a | |
---|
624 | n/a | """Simple HTTP request handler with GET and HEAD commands. |
---|
625 | n/a | |
---|
626 | n/a | This serves files from the current directory and any of its |
---|
627 | n/a | subdirectories. The MIME type for files is determined by |
---|
628 | n/a | calling the .guess_type() method. |
---|
629 | n/a | |
---|
630 | n/a | The GET and HEAD requests are identical except that the HEAD |
---|
631 | n/a | request omits the actual contents of the file. |
---|
632 | n/a | |
---|
633 | n/a | """ |
---|
634 | n/a | |
---|
635 | n/a | server_version = "SimpleHTTP/" + __version__ |
---|
636 | n/a | |
---|
637 | n/a | def do_GET(self): |
---|
638 | n/a | """Serve a GET request.""" |
---|
639 | n/a | f = self.send_head() |
---|
640 | n/a | if f: |
---|
641 | n/a | try: |
---|
642 | n/a | self.copyfile(f, self.wfile) |
---|
643 | n/a | finally: |
---|
644 | n/a | f.close() |
---|
645 | n/a | |
---|
646 | n/a | def do_HEAD(self): |
---|
647 | n/a | """Serve a HEAD request.""" |
---|
648 | n/a | f = self.send_head() |
---|
649 | n/a | if f: |
---|
650 | n/a | f.close() |
---|
651 | n/a | |
---|
652 | n/a | def send_head(self): |
---|
653 | n/a | """Common code for GET and HEAD commands. |
---|
654 | n/a | |
---|
655 | n/a | This sends the response code and MIME headers. |
---|
656 | n/a | |
---|
657 | n/a | Return value is either a file object (which has to be copied |
---|
658 | n/a | to the outputfile by the caller unless the command was HEAD, |
---|
659 | n/a | and must be closed by the caller under all circumstances), or |
---|
660 | n/a | None, in which case the caller has nothing further to do. |
---|
661 | n/a | |
---|
662 | n/a | """ |
---|
663 | n/a | path = self.translate_path(self.path) |
---|
664 | n/a | f = None |
---|
665 | n/a | if os.path.isdir(path): |
---|
666 | n/a | parts = urllib.parse.urlsplit(self.path) |
---|
667 | n/a | if not parts.path.endswith('/'): |
---|
668 | n/a | # redirect browser - doing basically what apache does |
---|
669 | n/a | self.send_response(HTTPStatus.MOVED_PERMANENTLY) |
---|
670 | n/a | new_parts = (parts[0], parts[1], parts[2] + '/', |
---|
671 | n/a | parts[3], parts[4]) |
---|
672 | n/a | new_url = urllib.parse.urlunsplit(new_parts) |
---|
673 | n/a | self.send_header("Location", new_url) |
---|
674 | n/a | self.end_headers() |
---|
675 | n/a | return None |
---|
676 | n/a | for index in "index.html", "index.htm": |
---|
677 | n/a | index = os.path.join(path, index) |
---|
678 | n/a | if os.path.exists(index): |
---|
679 | n/a | path = index |
---|
680 | n/a | break |
---|
681 | n/a | else: |
---|
682 | n/a | return self.list_directory(path) |
---|
683 | n/a | ctype = self.guess_type(path) |
---|
684 | n/a | try: |
---|
685 | n/a | f = open(path, 'rb') |
---|
686 | n/a | except OSError: |
---|
687 | n/a | self.send_error(HTTPStatus.NOT_FOUND, "File not found") |
---|
688 | n/a | return None |
---|
689 | n/a | try: |
---|
690 | n/a | self.send_response(HTTPStatus.OK) |
---|
691 | n/a | self.send_header("Content-type", ctype) |
---|
692 | n/a | fs = os.fstat(f.fileno()) |
---|
693 | n/a | self.send_header("Content-Length", str(fs[6])) |
---|
694 | n/a | self.send_header("Last-Modified", self.date_time_string(fs.st_mtime)) |
---|
695 | n/a | self.end_headers() |
---|
696 | n/a | return f |
---|
697 | n/a | except: |
---|
698 | n/a | f.close() |
---|
699 | n/a | raise |
---|
700 | n/a | |
---|
701 | n/a | def list_directory(self, path): |
---|
702 | n/a | """Helper to produce a directory listing (absent index.html). |
---|
703 | n/a | |
---|
704 | n/a | Return value is either a file object, or None (indicating an |
---|
705 | n/a | error). In either case, the headers are sent, making the |
---|
706 | n/a | interface the same as for send_head(). |
---|
707 | n/a | |
---|
708 | n/a | """ |
---|
709 | n/a | try: |
---|
710 | n/a | list = os.listdir(path) |
---|
711 | n/a | except OSError: |
---|
712 | n/a | self.send_error( |
---|
713 | n/a | HTTPStatus.NOT_FOUND, |
---|
714 | n/a | "No permission to list directory") |
---|
715 | n/a | return None |
---|
716 | n/a | list.sort(key=lambda a: a.lower()) |
---|
717 | n/a | r = [] |
---|
718 | n/a | try: |
---|
719 | n/a | displaypath = urllib.parse.unquote(self.path, |
---|
720 | n/a | errors='surrogatepass') |
---|
721 | n/a | except UnicodeDecodeError: |
---|
722 | n/a | displaypath = urllib.parse.unquote(path) |
---|
723 | n/a | displaypath = html.escape(displaypath, quote=False) |
---|
724 | n/a | enc = sys.getfilesystemencoding() |
---|
725 | n/a | title = 'Directory listing for %s' % displaypath |
---|
726 | n/a | r.append('<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" ' |
---|
727 | n/a | '"http://www.w3.org/TR/html4/strict.dtd">') |
---|
728 | n/a | r.append('<html>\n<head>') |
---|
729 | n/a | r.append('<meta http-equiv="Content-Type" ' |
---|
730 | n/a | 'content="text/html; charset=%s">' % enc) |
---|
731 | n/a | r.append('<title>%s</title>\n</head>' % title) |
---|
732 | n/a | r.append('<body>\n<h1>%s</h1>' % title) |
---|
733 | n/a | r.append('<hr>\n<ul>') |
---|
734 | n/a | for name in list: |
---|
735 | n/a | fullname = os.path.join(path, name) |
---|
736 | n/a | displayname = linkname = name |
---|
737 | n/a | # Append / for directories or @ for symbolic links |
---|
738 | n/a | if os.path.isdir(fullname): |
---|
739 | n/a | displayname = name + "/" |
---|
740 | n/a | linkname = name + "/" |
---|
741 | n/a | if os.path.islink(fullname): |
---|
742 | n/a | displayname = name + "@" |
---|
743 | n/a | # Note: a link to a directory displays with @ and links with / |
---|
744 | n/a | r.append('<li><a href="%s">%s</a></li>' |
---|
745 | n/a | % (urllib.parse.quote(linkname, |
---|
746 | n/a | errors='surrogatepass'), |
---|
747 | n/a | html.escape(displayname, quote=False))) |
---|
748 | n/a | r.append('</ul>\n<hr>\n</body>\n</html>\n') |
---|
749 | n/a | encoded = '\n'.join(r).encode(enc, 'surrogateescape') |
---|
750 | n/a | f = io.BytesIO() |
---|
751 | n/a | f.write(encoded) |
---|
752 | n/a | f.seek(0) |
---|
753 | n/a | self.send_response(HTTPStatus.OK) |
---|
754 | n/a | self.send_header("Content-type", "text/html; charset=%s" % enc) |
---|
755 | n/a | self.send_header("Content-Length", str(len(encoded))) |
---|
756 | n/a | self.end_headers() |
---|
757 | n/a | return f |
---|
758 | n/a | |
---|
759 | n/a | def translate_path(self, path): |
---|
760 | n/a | """Translate a /-separated PATH to the local filename syntax. |
---|
761 | n/a | |
---|
762 | n/a | Components that mean special things to the local file system |
---|
763 | n/a | (e.g. drive or directory names) are ignored. (XXX They should |
---|
764 | n/a | probably be diagnosed.) |
---|
765 | n/a | |
---|
766 | n/a | """ |
---|
767 | n/a | # abandon query parameters |
---|
768 | n/a | path = path.split('?',1)[0] |
---|
769 | n/a | path = path.split('#',1)[0] |
---|
770 | n/a | # Don't forget explicit trailing slash when normalizing. Issue17324 |
---|
771 | n/a | trailing_slash = path.rstrip().endswith('/') |
---|
772 | n/a | try: |
---|
773 | n/a | path = urllib.parse.unquote(path, errors='surrogatepass') |
---|
774 | n/a | except UnicodeDecodeError: |
---|
775 | n/a | path = urllib.parse.unquote(path) |
---|
776 | n/a | path = posixpath.normpath(path) |
---|
777 | n/a | words = path.split('/') |
---|
778 | n/a | words = filter(None, words) |
---|
779 | n/a | path = os.getcwd() |
---|
780 | n/a | for word in words: |
---|
781 | n/a | if os.path.dirname(word) or word in (os.curdir, os.pardir): |
---|
782 | n/a | # Ignore components that are not a simple file/directory name |
---|
783 | n/a | continue |
---|
784 | n/a | path = os.path.join(path, word) |
---|
785 | n/a | if trailing_slash: |
---|
786 | n/a | path += '/' |
---|
787 | n/a | return path |
---|
788 | n/a | |
---|
789 | n/a | def copyfile(self, source, outputfile): |
---|
790 | n/a | """Copy all data between two file objects. |
---|
791 | n/a | |
---|
792 | n/a | The SOURCE argument is a file object open for reading |
---|
793 | n/a | (or anything with a read() method) and the DESTINATION |
---|
794 | n/a | argument is a file object open for writing (or |
---|
795 | n/a | anything with a write() method). |
---|
796 | n/a | |
---|
797 | n/a | The only reason for overriding this would be to change |
---|
798 | n/a | the block size or perhaps to replace newlines by CRLF |
---|
799 | n/a | -- note however that this the default server uses this |
---|
800 | n/a | to copy binary data as well. |
---|
801 | n/a | |
---|
802 | n/a | """ |
---|
803 | n/a | shutil.copyfileobj(source, outputfile) |
---|
804 | n/a | |
---|
805 | n/a | def guess_type(self, path): |
---|
806 | n/a | """Guess the type of a file. |
---|
807 | n/a | |
---|
808 | n/a | Argument is a PATH (a filename). |
---|
809 | n/a | |
---|
810 | n/a | Return value is a string of the form type/subtype, |
---|
811 | n/a | usable for a MIME Content-type header. |
---|
812 | n/a | |
---|
813 | n/a | The default implementation looks the file's extension |
---|
814 | n/a | up in the table self.extensions_map, using application/octet-stream |
---|
815 | n/a | as a default; however it would be permissible (if |
---|
816 | n/a | slow) to look inside the data to make a better guess. |
---|
817 | n/a | |
---|
818 | n/a | """ |
---|
819 | n/a | |
---|
820 | n/a | base, ext = posixpath.splitext(path) |
---|
821 | n/a | if ext in self.extensions_map: |
---|
822 | n/a | return self.extensions_map[ext] |
---|
823 | n/a | ext = ext.lower() |
---|
824 | n/a | if ext in self.extensions_map: |
---|
825 | n/a | return self.extensions_map[ext] |
---|
826 | n/a | else: |
---|
827 | n/a | return self.extensions_map[''] |
---|
828 | n/a | |
---|
829 | n/a | if not mimetypes.inited: |
---|
830 | n/a | mimetypes.init() # try to read system mime.types |
---|
831 | n/a | extensions_map = mimetypes.types_map.copy() |
---|
832 | n/a | extensions_map.update({ |
---|
833 | n/a | '': 'application/octet-stream', # Default |
---|
834 | n/a | '.py': 'text/plain', |
---|
835 | n/a | '.c': 'text/plain', |
---|
836 | n/a | '.h': 'text/plain', |
---|
837 | n/a | }) |
---|
838 | n/a | |
---|
839 | n/a | |
---|
840 | n/a | # Utilities for CGIHTTPRequestHandler |
---|
841 | n/a | |
---|
842 | n/a | def _url_collapse_path(path): |
---|
843 | n/a | """ |
---|
844 | n/a | Given a URL path, remove extra '/'s and '.' path elements and collapse |
---|
845 | n/a | any '..' references and returns a collapsed path. |
---|
846 | n/a | |
---|
847 | n/a | Implements something akin to RFC-2396 5.2 step 6 to parse relative paths. |
---|
848 | n/a | The utility of this function is limited to is_cgi method and helps |
---|
849 | n/a | preventing some security attacks. |
---|
850 | n/a | |
---|
851 | n/a | Returns: The reconstituted URL, which will always start with a '/'. |
---|
852 | n/a | |
---|
853 | n/a | Raises: IndexError if too many '..' occur within the path. |
---|
854 | n/a | |
---|
855 | n/a | """ |
---|
856 | n/a | # Query component should not be involved. |
---|
857 | n/a | path, _, query = path.partition('?') |
---|
858 | n/a | path = urllib.parse.unquote(path) |
---|
859 | n/a | |
---|
860 | n/a | # Similar to os.path.split(os.path.normpath(path)) but specific to URL |
---|
861 | n/a | # path semantics rather than local operating system semantics. |
---|
862 | n/a | path_parts = path.split('/') |
---|
863 | n/a | head_parts = [] |
---|
864 | n/a | for part in path_parts[:-1]: |
---|
865 | n/a | if part == '..': |
---|
866 | n/a | head_parts.pop() # IndexError if more '..' than prior parts |
---|
867 | n/a | elif part and part != '.': |
---|
868 | n/a | head_parts.append( part ) |
---|
869 | n/a | if path_parts: |
---|
870 | n/a | tail_part = path_parts.pop() |
---|
871 | n/a | if tail_part: |
---|
872 | n/a | if tail_part == '..': |
---|
873 | n/a | head_parts.pop() |
---|
874 | n/a | tail_part = '' |
---|
875 | n/a | elif tail_part == '.': |
---|
876 | n/a | tail_part = '' |
---|
877 | n/a | else: |
---|
878 | n/a | tail_part = '' |
---|
879 | n/a | |
---|
880 | n/a | if query: |
---|
881 | n/a | tail_part = '?'.join((tail_part, query)) |
---|
882 | n/a | |
---|
883 | n/a | splitpath = ('/' + '/'.join(head_parts), tail_part) |
---|
884 | n/a | collapsed_path = "/".join(splitpath) |
---|
885 | n/a | |
---|
886 | n/a | return collapsed_path |
---|
887 | n/a | |
---|
888 | n/a | |
---|
889 | n/a | |
---|
890 | n/a | nobody = None |
---|
891 | n/a | |
---|
892 | n/a | def nobody_uid(): |
---|
893 | n/a | """Internal routine to get nobody's uid""" |
---|
894 | n/a | global nobody |
---|
895 | n/a | if nobody: |
---|
896 | n/a | return nobody |
---|
897 | n/a | try: |
---|
898 | n/a | import pwd |
---|
899 | n/a | except ImportError: |
---|
900 | n/a | return -1 |
---|
901 | n/a | try: |
---|
902 | n/a | nobody = pwd.getpwnam('nobody')[2] |
---|
903 | n/a | except KeyError: |
---|
904 | n/a | nobody = 1 + max(x[2] for x in pwd.getpwall()) |
---|
905 | n/a | return nobody |
---|
906 | n/a | |
---|
907 | n/a | |
---|
908 | n/a | def executable(path): |
---|
909 | n/a | """Test for executable file.""" |
---|
910 | n/a | return os.access(path, os.X_OK) |
---|
911 | n/a | |
---|
912 | n/a | |
---|
913 | n/a | class CGIHTTPRequestHandler(SimpleHTTPRequestHandler): |
---|
914 | n/a | |
---|
915 | n/a | """Complete HTTP server with GET, HEAD and POST commands. |
---|
916 | n/a | |
---|
917 | n/a | GET and HEAD also support running CGI scripts. |
---|
918 | n/a | |
---|
919 | n/a | The POST command is *only* implemented for CGI scripts. |
---|
920 | n/a | |
---|
921 | n/a | """ |
---|
922 | n/a | |
---|
923 | n/a | # Determine platform specifics |
---|
924 | n/a | have_fork = hasattr(os, 'fork') |
---|
925 | n/a | |
---|
926 | n/a | # Make rfile unbuffered -- we need to read one line and then pass |
---|
927 | n/a | # the rest to a subprocess, so we can't use buffered input. |
---|
928 | n/a | rbufsize = 0 |
---|
929 | n/a | |
---|
930 | n/a | def do_POST(self): |
---|
931 | n/a | """Serve a POST request. |
---|
932 | n/a | |
---|
933 | n/a | This is only implemented for CGI scripts. |
---|
934 | n/a | |
---|
935 | n/a | """ |
---|
936 | n/a | |
---|
937 | n/a | if self.is_cgi(): |
---|
938 | n/a | self.run_cgi() |
---|
939 | n/a | else: |
---|
940 | n/a | self.send_error( |
---|
941 | n/a | HTTPStatus.NOT_IMPLEMENTED, |
---|
942 | n/a | "Can only POST to CGI scripts") |
---|
943 | n/a | |
---|
944 | n/a | def send_head(self): |
---|
945 | n/a | """Version of send_head that support CGI scripts""" |
---|
946 | n/a | if self.is_cgi(): |
---|
947 | n/a | return self.run_cgi() |
---|
948 | n/a | else: |
---|
949 | n/a | return SimpleHTTPRequestHandler.send_head(self) |
---|
950 | n/a | |
---|
951 | n/a | def is_cgi(self): |
---|
952 | n/a | """Test whether self.path corresponds to a CGI script. |
---|
953 | n/a | |
---|
954 | n/a | Returns True and updates the cgi_info attribute to the tuple |
---|
955 | n/a | (dir, rest) if self.path requires running a CGI script. |
---|
956 | n/a | Returns False otherwise. |
---|
957 | n/a | |
---|
958 | n/a | If any exception is raised, the caller should assume that |
---|
959 | n/a | self.path was rejected as invalid and act accordingly. |
---|
960 | n/a | |
---|
961 | n/a | The default implementation tests whether the normalized url |
---|
962 | n/a | path begins with one of the strings in self.cgi_directories |
---|
963 | n/a | (and the next character is a '/' or the end of the string). |
---|
964 | n/a | |
---|
965 | n/a | """ |
---|
966 | n/a | collapsed_path = _url_collapse_path(self.path) |
---|
967 | n/a | dir_sep = collapsed_path.find('/', 1) |
---|
968 | n/a | head, tail = collapsed_path[:dir_sep], collapsed_path[dir_sep+1:] |
---|
969 | n/a | if head in self.cgi_directories: |
---|
970 | n/a | self.cgi_info = head, tail |
---|
971 | n/a | return True |
---|
972 | n/a | return False |
---|
973 | n/a | |
---|
974 | n/a | |
---|
975 | n/a | cgi_directories = ['/cgi-bin', '/htbin'] |
---|
976 | n/a | |
---|
977 | n/a | def is_executable(self, path): |
---|
978 | n/a | """Test whether argument path is an executable file.""" |
---|
979 | n/a | return executable(path) |
---|
980 | n/a | |
---|
981 | n/a | def is_python(self, path): |
---|
982 | n/a | """Test whether argument path is a Python script.""" |
---|
983 | n/a | head, tail = os.path.splitext(path) |
---|
984 | n/a | return tail.lower() in (".py", ".pyw") |
---|
985 | n/a | |
---|
986 | n/a | def run_cgi(self): |
---|
987 | n/a | """Execute a CGI script.""" |
---|
988 | n/a | dir, rest = self.cgi_info |
---|
989 | n/a | path = dir + '/' + rest |
---|
990 | n/a | i = path.find('/', len(dir)+1) |
---|
991 | n/a | while i >= 0: |
---|
992 | n/a | nextdir = path[:i] |
---|
993 | n/a | nextrest = path[i+1:] |
---|
994 | n/a | |
---|
995 | n/a | scriptdir = self.translate_path(nextdir) |
---|
996 | n/a | if os.path.isdir(scriptdir): |
---|
997 | n/a | dir, rest = nextdir, nextrest |
---|
998 | n/a | i = path.find('/', len(dir)+1) |
---|
999 | n/a | else: |
---|
1000 | n/a | break |
---|
1001 | n/a | |
---|
1002 | n/a | # find an explicit query string, if present. |
---|
1003 | n/a | rest, _, query = rest.partition('?') |
---|
1004 | n/a | |
---|
1005 | n/a | # dissect the part after the directory name into a script name & |
---|
1006 | n/a | # a possible additional path, to be stored in PATH_INFO. |
---|
1007 | n/a | i = rest.find('/') |
---|
1008 | n/a | if i >= 0: |
---|
1009 | n/a | script, rest = rest[:i], rest[i:] |
---|
1010 | n/a | else: |
---|
1011 | n/a | script, rest = rest, '' |
---|
1012 | n/a | |
---|
1013 | n/a | scriptname = dir + '/' + script |
---|
1014 | n/a | scriptfile = self.translate_path(scriptname) |
---|
1015 | n/a | if not os.path.exists(scriptfile): |
---|
1016 | n/a | self.send_error( |
---|
1017 | n/a | HTTPStatus.NOT_FOUND, |
---|
1018 | n/a | "No such CGI script (%r)" % scriptname) |
---|
1019 | n/a | return |
---|
1020 | n/a | if not os.path.isfile(scriptfile): |
---|
1021 | n/a | self.send_error( |
---|
1022 | n/a | HTTPStatus.FORBIDDEN, |
---|
1023 | n/a | "CGI script is not a plain file (%r)" % scriptname) |
---|
1024 | n/a | return |
---|
1025 | n/a | ispy = self.is_python(scriptname) |
---|
1026 | n/a | if self.have_fork or not ispy: |
---|
1027 | n/a | if not self.is_executable(scriptfile): |
---|
1028 | n/a | self.send_error( |
---|
1029 | n/a | HTTPStatus.FORBIDDEN, |
---|
1030 | n/a | "CGI script is not executable (%r)" % scriptname) |
---|
1031 | n/a | return |
---|
1032 | n/a | |
---|
1033 | n/a | # Reference: http://hoohoo.ncsa.uiuc.edu/cgi/env.html |
---|
1034 | n/a | # XXX Much of the following could be prepared ahead of time! |
---|
1035 | n/a | env = copy.deepcopy(os.environ) |
---|
1036 | n/a | env['SERVER_SOFTWARE'] = self.version_string() |
---|
1037 | n/a | env['SERVER_NAME'] = self.server.server_name |
---|
1038 | n/a | env['GATEWAY_INTERFACE'] = 'CGI/1.1' |
---|
1039 | n/a | env['SERVER_PROTOCOL'] = self.protocol_version |
---|
1040 | n/a | env['SERVER_PORT'] = str(self.server.server_port) |
---|
1041 | n/a | env['REQUEST_METHOD'] = self.command |
---|
1042 | n/a | uqrest = urllib.parse.unquote(rest) |
---|
1043 | n/a | env['PATH_INFO'] = uqrest |
---|
1044 | n/a | env['PATH_TRANSLATED'] = self.translate_path(uqrest) |
---|
1045 | n/a | env['SCRIPT_NAME'] = scriptname |
---|
1046 | n/a | if query: |
---|
1047 | n/a | env['QUERY_STRING'] = query |
---|
1048 | n/a | env['REMOTE_ADDR'] = self.client_address[0] |
---|
1049 | n/a | authorization = self.headers.get("authorization") |
---|
1050 | n/a | if authorization: |
---|
1051 | n/a | authorization = authorization.split() |
---|
1052 | n/a | if len(authorization) == 2: |
---|
1053 | n/a | import base64, binascii |
---|
1054 | n/a | env['AUTH_TYPE'] = authorization[0] |
---|
1055 | n/a | if authorization[0].lower() == "basic": |
---|
1056 | n/a | try: |
---|
1057 | n/a | authorization = authorization[1].encode('ascii') |
---|
1058 | n/a | authorization = base64.decodebytes(authorization).\ |
---|
1059 | n/a | decode('ascii') |
---|
1060 | n/a | except (binascii.Error, UnicodeError): |
---|
1061 | n/a | pass |
---|
1062 | n/a | else: |
---|
1063 | n/a | authorization = authorization.split(':') |
---|
1064 | n/a | if len(authorization) == 2: |
---|
1065 | n/a | env['REMOTE_USER'] = authorization[0] |
---|
1066 | n/a | # XXX REMOTE_IDENT |
---|
1067 | n/a | if self.headers.get('content-type') is None: |
---|
1068 | n/a | env['CONTENT_TYPE'] = self.headers.get_content_type() |
---|
1069 | n/a | else: |
---|
1070 | n/a | env['CONTENT_TYPE'] = self.headers['content-type'] |
---|
1071 | n/a | length = self.headers.get('content-length') |
---|
1072 | n/a | if length: |
---|
1073 | n/a | env['CONTENT_LENGTH'] = length |
---|
1074 | n/a | referer = self.headers.get('referer') |
---|
1075 | n/a | if referer: |
---|
1076 | n/a | env['HTTP_REFERER'] = referer |
---|
1077 | n/a | accept = [] |
---|
1078 | n/a | for line in self.headers.getallmatchingheaders('accept'): |
---|
1079 | n/a | if line[:1] in "\t\n\r ": |
---|
1080 | n/a | accept.append(line.strip()) |
---|
1081 | n/a | else: |
---|
1082 | n/a | accept = accept + line[7:].split(',') |
---|
1083 | n/a | env['HTTP_ACCEPT'] = ','.join(accept) |
---|
1084 | n/a | ua = self.headers.get('user-agent') |
---|
1085 | n/a | if ua: |
---|
1086 | n/a | env['HTTP_USER_AGENT'] = ua |
---|
1087 | n/a | co = filter(None, self.headers.get_all('cookie', [])) |
---|
1088 | n/a | cookie_str = ', '.join(co) |
---|
1089 | n/a | if cookie_str: |
---|
1090 | n/a | env['HTTP_COOKIE'] = cookie_str |
---|
1091 | n/a | # XXX Other HTTP_* headers |
---|
1092 | n/a | # Since we're setting the env in the parent, provide empty |
---|
1093 | n/a | # values to override previously set values |
---|
1094 | n/a | for k in ('QUERY_STRING', 'REMOTE_HOST', 'CONTENT_LENGTH', |
---|
1095 | n/a | 'HTTP_USER_AGENT', 'HTTP_COOKIE', 'HTTP_REFERER'): |
---|
1096 | n/a | env.setdefault(k, "") |
---|
1097 | n/a | |
---|
1098 | n/a | self.send_response(HTTPStatus.OK, "Script output follows") |
---|
1099 | n/a | self.flush_headers() |
---|
1100 | n/a | |
---|
1101 | n/a | decoded_query = query.replace('+', ' ') |
---|
1102 | n/a | |
---|
1103 | n/a | if self.have_fork: |
---|
1104 | n/a | # Unix -- fork as we should |
---|
1105 | n/a | args = [script] |
---|
1106 | n/a | if '=' not in decoded_query: |
---|
1107 | n/a | args.append(decoded_query) |
---|
1108 | n/a | nobody = nobody_uid() |
---|
1109 | n/a | self.wfile.flush() # Always flush before forking |
---|
1110 | n/a | pid = os.fork() |
---|
1111 | n/a | if pid != 0: |
---|
1112 | n/a | # Parent |
---|
1113 | n/a | pid, sts = os.waitpid(pid, 0) |
---|
1114 | n/a | # throw away additional data [see bug #427345] |
---|
1115 | n/a | while select.select([self.rfile], [], [], 0)[0]: |
---|
1116 | n/a | if not self.rfile.read(1): |
---|
1117 | n/a | break |
---|
1118 | n/a | if sts: |
---|
1119 | n/a | self.log_error("CGI script exit status %#x", sts) |
---|
1120 | n/a | return |
---|
1121 | n/a | # Child |
---|
1122 | n/a | try: |
---|
1123 | n/a | try: |
---|
1124 | n/a | os.setuid(nobody) |
---|
1125 | n/a | except OSError: |
---|
1126 | n/a | pass |
---|
1127 | n/a | os.dup2(self.rfile.fileno(), 0) |
---|
1128 | n/a | os.dup2(self.wfile.fileno(), 1) |
---|
1129 | n/a | os.execve(scriptfile, args, env) |
---|
1130 | n/a | except: |
---|
1131 | n/a | self.server.handle_error(self.request, self.client_address) |
---|
1132 | n/a | os._exit(127) |
---|
1133 | n/a | |
---|
1134 | n/a | else: |
---|
1135 | n/a | # Non-Unix -- use subprocess |
---|
1136 | n/a | import subprocess |
---|
1137 | n/a | cmdline = [scriptfile] |
---|
1138 | n/a | if self.is_python(scriptfile): |
---|
1139 | n/a | interp = sys.executable |
---|
1140 | n/a | if interp.lower().endswith("w.exe"): |
---|
1141 | n/a | # On Windows, use python.exe, not pythonw.exe |
---|
1142 | n/a | interp = interp[:-5] + interp[-4:] |
---|
1143 | n/a | cmdline = [interp, '-u'] + cmdline |
---|
1144 | n/a | if '=' not in query: |
---|
1145 | n/a | cmdline.append(query) |
---|
1146 | n/a | self.log_message("command: %s", subprocess.list2cmdline(cmdline)) |
---|
1147 | n/a | try: |
---|
1148 | n/a | nbytes = int(length) |
---|
1149 | n/a | except (TypeError, ValueError): |
---|
1150 | n/a | nbytes = 0 |
---|
1151 | n/a | p = subprocess.Popen(cmdline, |
---|
1152 | n/a | stdin=subprocess.PIPE, |
---|
1153 | n/a | stdout=subprocess.PIPE, |
---|
1154 | n/a | stderr=subprocess.PIPE, |
---|
1155 | n/a | env = env |
---|
1156 | n/a | ) |
---|
1157 | n/a | if self.command.lower() == "post" and nbytes > 0: |
---|
1158 | n/a | data = self.rfile.read(nbytes) |
---|
1159 | n/a | else: |
---|
1160 | n/a | data = None |
---|
1161 | n/a | # throw away additional data [see bug #427345] |
---|
1162 | n/a | while select.select([self.rfile._sock], [], [], 0)[0]: |
---|
1163 | n/a | if not self.rfile._sock.recv(1): |
---|
1164 | n/a | break |
---|
1165 | n/a | stdout, stderr = p.communicate(data) |
---|
1166 | n/a | self.wfile.write(stdout) |
---|
1167 | n/a | if stderr: |
---|
1168 | n/a | self.log_error('%s', stderr) |
---|
1169 | n/a | p.stderr.close() |
---|
1170 | n/a | p.stdout.close() |
---|
1171 | n/a | status = p.returncode |
---|
1172 | n/a | if status: |
---|
1173 | n/a | self.log_error("CGI script exit status %#x", status) |
---|
1174 | n/a | else: |
---|
1175 | n/a | self.log_message("CGI script exited OK") |
---|
1176 | n/a | |
---|
1177 | n/a | |
---|
1178 | n/a | def test(HandlerClass=BaseHTTPRequestHandler, |
---|
1179 | n/a | ServerClass=HTTPServer, protocol="HTTP/1.0", port=8000, bind=""): |
---|
1180 | n/a | """Test the HTTP request handler class. |
---|
1181 | n/a | |
---|
1182 | n/a | This runs an HTTP server on port 8000 (or the port argument). |
---|
1183 | n/a | |
---|
1184 | n/a | """ |
---|
1185 | n/a | server_address = (bind, port) |
---|
1186 | n/a | |
---|
1187 | n/a | HandlerClass.protocol_version = protocol |
---|
1188 | n/a | with ServerClass(server_address, HandlerClass) as httpd: |
---|
1189 | n/a | sa = httpd.socket.getsockname() |
---|
1190 | n/a | serve_message = "Serving HTTP on {host} port {port} (http://{host}:{port}/) ..." |
---|
1191 | n/a | print(serve_message.format(host=sa[0], port=sa[1])) |
---|
1192 | n/a | try: |
---|
1193 | n/a | httpd.serve_forever() |
---|
1194 | n/a | except KeyboardInterrupt: |
---|
1195 | n/a | print("\nKeyboard interrupt received, exiting.") |
---|
1196 | n/a | sys.exit(0) |
---|
1197 | n/a | |
---|
1198 | n/a | if __name__ == '__main__': |
---|
1199 | n/a | parser = argparse.ArgumentParser() |
---|
1200 | n/a | parser.add_argument('--cgi', action='store_true', |
---|
1201 | n/a | help='Run as CGI Server') |
---|
1202 | n/a | parser.add_argument('--bind', '-b', default='', metavar='ADDRESS', |
---|
1203 | n/a | help='Specify alternate bind address ' |
---|
1204 | n/a | '[default: all interfaces]') |
---|
1205 | n/a | parser.add_argument('port', action='store', |
---|
1206 | n/a | default=8000, type=int, |
---|
1207 | n/a | nargs='?', |
---|
1208 | n/a | help='Specify alternate port [default: 8000]') |
---|
1209 | n/a | args = parser.parse_args() |
---|
1210 | n/a | if args.cgi: |
---|
1211 | n/a | handler_class = CGIHTTPRequestHandler |
---|
1212 | n/a | else: |
---|
1213 | n/a | handler_class = SimpleHTTPRequestHandler |
---|
1214 | n/a | test(HandlerClass=handler_class, port=args.port, bind=args.bind) |
---|