httpserver_test.py 52 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535
  1. from tornado import gen, netutil
  2. from tornado.escape import (
  3. json_decode,
  4. json_encode,
  5. utf8,
  6. _unicode,
  7. recursive_unicode,
  8. native_str,
  9. )
  10. from tornado.http1connection import HTTP1Connection
  11. from tornado.httpclient import HTTPError
  12. from tornado.httpserver import HTTPServer
  13. from tornado.httputil import (
  14. HTTPHeaders,
  15. HTTPMessageDelegate,
  16. HTTPServerConnectionDelegate,
  17. ResponseStartLine,
  18. )
  19. from tornado.iostream import IOStream
  20. from tornado.locks import Event
  21. from tornado.log import gen_log, app_log
  22. from tornado.simple_httpclient import SimpleAsyncHTTPClient
  23. from tornado.testing import (
  24. AsyncHTTPTestCase,
  25. AsyncHTTPSTestCase,
  26. AsyncTestCase,
  27. ExpectLog,
  28. gen_test,
  29. )
  30. from tornado.test.util import abstract_base_test
  31. from tornado.web import Application, RequestHandler, stream_request_body
  32. from contextlib import closing, contextmanager
  33. import datetime
  34. import gzip
  35. import logging
  36. import os
  37. import shutil
  38. import socket
  39. import ssl
  40. import sys
  41. import tempfile
  42. import textwrap
  43. import unittest
  44. import urllib.parse
  45. import uuid
  46. from io import BytesIO
  47. import typing
  48. if typing.TYPE_CHECKING:
  49. from typing import Dict, List # noqa: F401
  50. async def read_stream_body(stream):
  51. """Reads an HTTP response from `stream` and returns a tuple of its
  52. start_line, headers and body."""
  53. chunks = []
  54. class Delegate(HTTPMessageDelegate):
  55. def headers_received(self, start_line, headers):
  56. self.headers = headers
  57. self.start_line = start_line
  58. def data_received(self, chunk):
  59. chunks.append(chunk)
  60. def finish(self):
  61. conn.detach() # type: ignore
  62. conn = HTTP1Connection(stream, True)
  63. delegate = Delegate()
  64. await conn.read_response(delegate)
  65. return delegate.start_line, delegate.headers, b"".join(chunks)
  66. class HandlerBaseTestCase(AsyncHTTPTestCase):
  67. Handler = None
  68. def get_app(self):
  69. return Application([("/", self.__class__.Handler)])
  70. def fetch_json(self, *args, **kwargs):
  71. response = self.fetch(*args, **kwargs)
  72. response.rethrow()
  73. return json_decode(response.body)
  74. class HelloWorldRequestHandler(RequestHandler):
  75. def initialize(self, protocol="http"):
  76. self.expected_protocol = protocol
  77. def get(self):
  78. if self.request.protocol != self.expected_protocol:
  79. raise Exception("unexpected protocol")
  80. self.finish("Hello world")
  81. def post(self):
  82. self.finish("Got %d bytes in POST" % len(self.request.body))
  83. class SSLTest(AsyncHTTPSTestCase):
  84. def get_app(self):
  85. return Application([("/", HelloWorldRequestHandler, dict(protocol="https"))])
  86. def get_ssl_options(self):
  87. return dict(
  88. ssl_version=ssl.PROTOCOL_TLS_SERVER,
  89. **AsyncHTTPSTestCase.default_ssl_options(),
  90. )
  91. def test_ssl(self):
  92. response = self.fetch("/")
  93. self.assertEqual(response.body, b"Hello world")
  94. def test_large_post(self):
  95. response = self.fetch("/", method="POST", body="A" * 5000)
  96. self.assertEqual(response.body, b"Got 5000 bytes in POST")
  97. def test_non_ssl_request(self):
  98. # Make sure the server closes the connection when it gets a non-ssl
  99. # connection, rather than waiting for a timeout or otherwise
  100. # misbehaving.
  101. with ExpectLog(gen_log, "(SSL Error|uncaught exception)"):
  102. with ExpectLog(gen_log, "Uncaught exception", required=False):
  103. with self.assertRaises((IOError, HTTPError)): # type: ignore
  104. self.fetch(
  105. self.get_url("/").replace("https:", "http:"),
  106. request_timeout=3600,
  107. connect_timeout=3600,
  108. raise_error=True,
  109. )
  110. def test_error_logging(self):
  111. # No stack traces are logged for SSL errors.
  112. with ExpectLog(gen_log, "SSL Error") as expect_log:
  113. with self.assertRaises((IOError, HTTPError)): # type: ignore
  114. self.fetch(
  115. self.get_url("/").replace("https:", "http:"), raise_error=True
  116. )
  117. self.assertFalse(expect_log.logged_stack)
  118. class BadSSLOptionsTest(unittest.TestCase):
  119. def test_missing_arguments(self):
  120. application = Application()
  121. self.assertRaises(
  122. KeyError,
  123. HTTPServer,
  124. application,
  125. ssl_options={"keyfile": "/__missing__.crt"},
  126. )
  127. def test_missing_key(self):
  128. """A missing SSL key should cause an immediate exception."""
  129. application = Application()
  130. module_dir = os.path.dirname(__file__)
  131. existing_certificate = os.path.join(module_dir, "test.crt")
  132. existing_key = os.path.join(module_dir, "test.key")
  133. self.assertRaises(
  134. (ValueError, IOError),
  135. HTTPServer,
  136. application,
  137. ssl_options={"certfile": "/__mising__.crt"},
  138. )
  139. self.assertRaises(
  140. (ValueError, IOError),
  141. HTTPServer,
  142. application,
  143. ssl_options={
  144. "certfile": existing_certificate,
  145. "keyfile": "/__missing__.key",
  146. },
  147. )
  148. # This actually works because both files exist
  149. HTTPServer(
  150. application,
  151. ssl_options={"certfile": existing_certificate, "keyfile": existing_key},
  152. )
  153. class MultipartTestHandler(RequestHandler):
  154. def post(self):
  155. self.finish(
  156. {
  157. "header": self.request.headers["X-Header-Encoding-Test"],
  158. "argument": self.get_argument("argument"),
  159. "filename": self.request.files["files"][0].filename,
  160. "filebody": _unicode(self.request.files["files"][0]["body"]),
  161. }
  162. )
  163. # This test is also called from wsgi_test
  164. class HTTPConnectionTest(AsyncHTTPTestCase):
  165. def get_handlers(self):
  166. return [
  167. ("/multipart", MultipartTestHandler),
  168. ("/hello", HelloWorldRequestHandler),
  169. ]
  170. def get_app(self):
  171. return Application(self.get_handlers())
  172. def raw_fetch(self, headers, body, newline=b"\r\n"):
  173. with closing(IOStream(socket.socket())) as stream:
  174. self.io_loop.run_sync(
  175. lambda: stream.connect(("127.0.0.1", self.get_http_port()))
  176. )
  177. stream.write(
  178. newline.join(headers + [utf8("Content-Length: %d" % len(body))])
  179. + newline
  180. + newline
  181. + body
  182. )
  183. start_line, headers, body = self.io_loop.run_sync(
  184. lambda: read_stream_body(stream)
  185. )
  186. return body
  187. def test_multipart_form(self):
  188. # Encodings here are tricky: Headers are latin1, bodies can be
  189. # anything (we use utf8 by default).
  190. response = self.raw_fetch(
  191. [
  192. b"POST /multipart HTTP/1.0",
  193. b"Content-Type: multipart/form-data; boundary=1234567890",
  194. b"X-Header-encoding-test: \xe9",
  195. ],
  196. b"\r\n".join(
  197. [
  198. b"Content-Disposition: form-data; name=argument",
  199. b"",
  200. "\u00e1".encode(),
  201. b"--1234567890",
  202. 'Content-Disposition: form-data; name="files"; filename="\u00f3"'.encode(),
  203. b"",
  204. "\u00fa".encode(),
  205. b"--1234567890--",
  206. b"",
  207. ]
  208. ),
  209. )
  210. data = json_decode(response)
  211. self.assertEqual("\u00e9", data["header"])
  212. self.assertEqual("\u00e1", data["argument"])
  213. self.assertEqual("\u00f3", data["filename"])
  214. self.assertEqual("\u00fa", data["filebody"])
  215. def test_newlines(self):
  216. # We support both CRLF and bare LF as line separators.
  217. for newline in (b"\r\n", b"\n"):
  218. response = self.raw_fetch([b"GET /hello HTTP/1.0"], b"", newline=newline)
  219. self.assertEqual(response, b"Hello world")
  220. @gen_test
  221. def test_100_continue(self):
  222. # Run through a 100-continue interaction by hand:
  223. # When given Expect: 100-continue, we get a 100 response after the
  224. # headers, and then the real response after the body.
  225. stream = IOStream(socket.socket())
  226. yield stream.connect(("127.0.0.1", self.get_http_port()))
  227. yield stream.write(
  228. b"\r\n".join(
  229. [
  230. b"POST /hello HTTP/1.1",
  231. b"Host: 127.0.0.1",
  232. b"Content-Length: 1024",
  233. b"Expect: 100-continue",
  234. b"Connection: close",
  235. b"\r\n",
  236. ]
  237. )
  238. )
  239. data = yield stream.read_until(b"\r\n\r\n")
  240. self.assertTrue(data.startswith(b"HTTP/1.1 100 "), data)
  241. stream.write(b"a" * 1024)
  242. first_line = yield stream.read_until(b"\r\n")
  243. self.assertTrue(first_line.startswith(b"HTTP/1.1 200"), first_line)
  244. header_data = yield stream.read_until(b"\r\n\r\n")
  245. headers = HTTPHeaders.parse(native_str(header_data.decode("latin1")))
  246. body = yield stream.read_bytes(int(headers["Content-Length"]))
  247. self.assertEqual(body, b"Got 1024 bytes in POST")
  248. stream.close()
  249. class EchoHandler(RequestHandler):
  250. def get(self):
  251. self.write(recursive_unicode(self.request.arguments))
  252. def post(self):
  253. self.write(recursive_unicode(self.request.arguments))
  254. class TypeCheckHandler(RequestHandler):
  255. def prepare(self):
  256. self.errors = {} # type: Dict[str, str]
  257. fields = [
  258. ("method", str),
  259. ("uri", str),
  260. ("version", str),
  261. ("remote_ip", str),
  262. ("protocol", str),
  263. ("host", str),
  264. ("path", str),
  265. ("query", str),
  266. ]
  267. for field, expected_type in fields:
  268. self.check_type(field, getattr(self.request, field), expected_type)
  269. self.check_type("header_key", list(self.request.headers.keys())[0], str)
  270. self.check_type("header_value", list(self.request.headers.values())[0], str)
  271. self.check_type("cookie_key", list(self.request.cookies.keys())[0], str)
  272. self.check_type(
  273. "cookie_value", list(self.request.cookies.values())[0].value, str
  274. )
  275. # secure cookies
  276. self.check_type("arg_key", list(self.request.arguments.keys())[0], str)
  277. self.check_type("arg_value", list(self.request.arguments.values())[0][0], bytes)
  278. def post(self):
  279. self.check_type("body", self.request.body, bytes)
  280. self.write(self.errors)
  281. def get(self):
  282. self.write(self.errors)
  283. def check_type(self, name, obj, expected_type):
  284. actual_type = type(obj)
  285. if expected_type != actual_type:
  286. self.errors[name] = f"expected {expected_type}, got {actual_type}"
  287. class PostEchoHandler(RequestHandler):
  288. def post(self, *path_args):
  289. self.write(dict(echo=self.get_argument("data")))
  290. class PostEchoGBKHandler(PostEchoHandler):
  291. def decode_argument(self, value, name=None):
  292. try:
  293. return value.decode("gbk")
  294. except Exception:
  295. raise HTTPError(400, "invalid gbk bytes: %r" % value)
  296. class HTTPServerTest(AsyncHTTPTestCase):
  297. def get_app(self):
  298. return Application(
  299. [
  300. ("/echo", EchoHandler),
  301. ("/typecheck", TypeCheckHandler),
  302. ("//doubleslash", EchoHandler),
  303. ("/post_utf8", PostEchoHandler),
  304. ("/post_gbk", PostEchoGBKHandler),
  305. ]
  306. )
  307. def test_query_string_encoding(self):
  308. response = self.fetch("/echo?foo=%C3%A9")
  309. data = json_decode(response.body)
  310. self.assertEqual(data, {"foo": ["\u00e9"]})
  311. def test_empty_query_string(self):
  312. response = self.fetch("/echo?foo=&foo=")
  313. data = json_decode(response.body)
  314. self.assertEqual(data, {"foo": ["", ""]})
  315. def test_empty_post_parameters(self):
  316. response = self.fetch("/echo", method="POST", body="foo=&bar=")
  317. data = json_decode(response.body)
  318. self.assertEqual(data, {"foo": [""], "bar": [""]})
  319. def test_types(self):
  320. headers = {"Cookie": "foo=bar"}
  321. response = self.fetch("/typecheck?foo=bar", headers=headers)
  322. data = json_decode(response.body)
  323. self.assertEqual(data, {})
  324. response = self.fetch(
  325. "/typecheck", method="POST", body="foo=bar", headers=headers
  326. )
  327. data = json_decode(response.body)
  328. self.assertEqual(data, {})
  329. def test_double_slash(self):
  330. # urlparse.urlsplit (which tornado.httpserver used to use
  331. # incorrectly) would parse paths beginning with "//" as
  332. # protocol-relative urls.
  333. response = self.fetch("//doubleslash")
  334. self.assertEqual(200, response.code)
  335. self.assertEqual(json_decode(response.body), {})
  336. def test_post_encodings(self):
  337. headers = {"Content-Type": "application/x-www-form-urlencoded"}
  338. uni_text = "chinese: \u5f20\u4e09"
  339. for enc in ("utf8", "gbk"):
  340. for quote in (True, False):
  341. with self.subTest(enc=enc, quote=quote):
  342. bin_text = uni_text.encode(enc)
  343. if quote:
  344. bin_text = urllib.parse.quote(bin_text).encode("ascii")
  345. response = self.fetch(
  346. "/post_" + enc,
  347. method="POST",
  348. headers=headers,
  349. body=(b"data=" + bin_text),
  350. )
  351. self.assertEqual(json_decode(response.body), {"echo": uni_text})
  352. class HTTPServerRawTest(AsyncHTTPTestCase):
  353. def get_app(self):
  354. return Application([("/echo", EchoHandler)])
  355. def setUp(self):
  356. super().setUp()
  357. self.stream = IOStream(socket.socket())
  358. self.io_loop.run_sync(
  359. lambda: self.stream.connect(("127.0.0.1", self.get_http_port()))
  360. )
  361. def tearDown(self):
  362. self.stream.close()
  363. super().tearDown()
  364. def test_empty_request(self):
  365. self.stream.close()
  366. self.io_loop.add_timeout(datetime.timedelta(seconds=0.001), self.stop)
  367. self.wait()
  368. def test_malformed_first_line_response(self):
  369. with ExpectLog(gen_log, ".*Malformed HTTP request line", level=logging.INFO):
  370. self.stream.write(b"asdf\r\n\r\n")
  371. start_line, headers, response = self.io_loop.run_sync(
  372. lambda: read_stream_body(self.stream)
  373. )
  374. self.assertEqual("HTTP/1.1", start_line.version)
  375. self.assertEqual(400, start_line.code)
  376. self.assertEqual("Bad Request", start_line.reason)
  377. def test_malformed_first_line_log(self):
  378. with ExpectLog(gen_log, ".*Malformed HTTP request line", level=logging.INFO):
  379. self.stream.write(b"asdf\r\n\r\n")
  380. # TODO: need an async version of ExpectLog so we don't need
  381. # hard-coded timeouts here.
  382. self.io_loop.add_timeout(datetime.timedelta(seconds=0.05), self.stop)
  383. self.wait()
  384. def test_malformed_headers(self):
  385. with ExpectLog(
  386. gen_log,
  387. ".*Malformed HTTP message.*no colon in header line",
  388. level=logging.INFO,
  389. ):
  390. self.stream.write(b"GET / HTTP/1.0\r\nasdf\r\n\r\n")
  391. self.io_loop.add_timeout(datetime.timedelta(seconds=0.05), self.stop)
  392. self.wait()
  393. def test_invalid_host_header_with_whitespace(self):
  394. with ExpectLog(
  395. gen_log, ".*Malformed HTTP message.*Invalid Host header", level=logging.INFO
  396. ):
  397. self.stream.write(b"GET / HTTP/1.0\r\nHost: foo bar\r\n\r\n")
  398. start_line, headers, response = self.io_loop.run_sync(
  399. lambda: read_stream_body(self.stream)
  400. )
  401. self.assertEqual("HTTP/1.1", start_line.version)
  402. self.assertEqual(400, start_line.code)
  403. self.assertEqual("Bad Request", start_line.reason)
  404. def test_chunked_request_body(self):
  405. # Chunked requests are not widely supported and we don't have a way
  406. # to generate them in AsyncHTTPClient, but HTTPServer will read them.
  407. self.stream.write(
  408. b"""\
  409. POST /echo HTTP/1.1
  410. Host: 127.0.0.1
  411. Transfer-Encoding: chunked
  412. Content-Type: application/x-www-form-urlencoded
  413. 4
  414. foo=
  415. 3
  416. bar
  417. 0
  418. """.replace(
  419. b"\n", b"\r\n"
  420. )
  421. )
  422. start_line, headers, response = self.io_loop.run_sync(
  423. lambda: read_stream_body(self.stream)
  424. )
  425. self.assertEqual(json_decode(response), {"foo": ["bar"]})
  426. def test_chunked_request_uppercase(self):
  427. # As per RFC 2616 section 3.6, "Transfer-Encoding" header's value is
  428. # case-insensitive.
  429. self.stream.write(
  430. b"""\
  431. POST /echo HTTP/1.1
  432. Host: 127.0.0.1
  433. Transfer-Encoding: Chunked
  434. Content-Type: application/x-www-form-urlencoded
  435. 4
  436. foo=
  437. 3
  438. bar
  439. 0
  440. """.replace(
  441. b"\n", b"\r\n"
  442. )
  443. )
  444. start_line, headers, response = self.io_loop.run_sync(
  445. lambda: read_stream_body(self.stream)
  446. )
  447. self.assertEqual(json_decode(response), {"foo": ["bar"]})
  448. def test_chunked_request_body_invalid_size(self):
  449. # Only hex digits are allowed in chunk sizes. Python's int() function
  450. # also accepts underscores, so make sure we reject them here.
  451. self.stream.write(
  452. b"""\
  453. POST /echo HTTP/1.1
  454. Host: 127.0.0.1
  455. Transfer-Encoding: chunked
  456. 1_a
  457. 1234567890abcdef1234567890
  458. 0
  459. """.replace(
  460. b"\n", b"\r\n"
  461. )
  462. )
  463. with ExpectLog(gen_log, ".*invalid chunk size", level=logging.INFO):
  464. start_line, headers, response = self.io_loop.run_sync(
  465. lambda: read_stream_body(self.stream)
  466. )
  467. self.assertEqual(400, start_line.code)
  468. def test_chunked_request_body_duplicate_header(self):
  469. # Repeated Transfer-Encoding headers should be an error (and not confuse
  470. # the chunked-encoding detection to mess up framing).
  471. self.stream.write(
  472. b"""\
  473. POST /echo HTTP/1.1
  474. Host: 127.0.0.1
  475. Transfer-Encoding: chunked
  476. Transfer-encoding: chunked
  477. 2
  478. ok
  479. 0
  480. """
  481. )
  482. with ExpectLog(
  483. gen_log,
  484. ".*Unsupported Transfer-Encoding chunked,chunked",
  485. level=logging.INFO,
  486. ):
  487. start_line, headers, response = self.io_loop.run_sync(
  488. lambda: read_stream_body(self.stream)
  489. )
  490. self.assertEqual(400, start_line.code)
  491. def test_chunked_request_body_unsupported_transfer_encoding(self):
  492. # We don't support transfer-encodings other than chunked.
  493. self.stream.write(
  494. b"""\
  495. POST /echo HTTP/1.1
  496. Host: 127.0.0.1
  497. Transfer-Encoding: gzip, chunked
  498. 2
  499. ok
  500. 0
  501. """
  502. )
  503. with ExpectLog(
  504. gen_log, ".*Unsupported Transfer-Encoding gzip, chunked", level=logging.INFO
  505. ):
  506. start_line, headers, response = self.io_loop.run_sync(
  507. lambda: read_stream_body(self.stream)
  508. )
  509. self.assertEqual(400, start_line.code)
  510. def test_chunked_request_body_transfer_encoding_and_content_length(self):
  511. # Transfer-encoding and content-length are mutually exclusive
  512. self.stream.write(
  513. b"""\
  514. POST /echo HTTP/1.1
  515. Host: 127.0.0.1
  516. Transfer-Encoding: chunked
  517. Content-Length: 2
  518. 2
  519. ok
  520. 0
  521. """
  522. )
  523. with ExpectLog(
  524. gen_log,
  525. ".*Message with both Transfer-Encoding and Content-Length",
  526. level=logging.INFO,
  527. ):
  528. start_line, headers, response = self.io_loop.run_sync(
  529. lambda: read_stream_body(self.stream)
  530. )
  531. self.assertEqual(400, start_line.code)
  532. @gen_test
  533. def test_invalid_content_length(self):
  534. # HTTP only allows decimal digits in content-length. Make sure we don't
  535. # accept anything else, with special attention to things accepted by the
  536. # python int() function (leading plus signs and internal underscores).
  537. test_cases = [
  538. ("alphabetic", "foo"),
  539. ("leading plus", "+10"),
  540. ("internal underscore", "1_0"),
  541. ]
  542. for name, value in test_cases:
  543. with self.subTest(name=name), closing(IOStream(socket.socket())) as stream:
  544. with ExpectLog(
  545. gen_log,
  546. ".*Only integer Content-Length is allowed",
  547. level=logging.INFO,
  548. ):
  549. yield stream.connect(("127.0.0.1", self.get_http_port()))
  550. stream.write(
  551. utf8(
  552. textwrap.dedent(
  553. f"""\
  554. POST /echo HTTP/1.1
  555. Host: 127.0.0.1
  556. Content-Length: {value}
  557. Connection: close
  558. 1234567890
  559. """
  560. ).replace("\n", "\r\n")
  561. )
  562. )
  563. yield stream.read_until_close()
  564. @gen_test
  565. def test_invalid_methods(self):
  566. # RFC 9110 distinguishes between syntactically invalid methods and those that are
  567. # valid but unknown. The former must give a 400 status code, while the latter should
  568. # give a 405.
  569. test_cases = [
  570. ("FOO", 405, None),
  571. ("FOO,BAR", 400, ".*Malformed HTTP request line"),
  572. ]
  573. for method, code, log_msg in test_cases:
  574. if log_msg is not None:
  575. expect_log = ExpectLog(gen_log, log_msg, level=logging.INFO)
  576. else:
  577. @contextmanager
  578. def noop_context():
  579. yield
  580. expect_log = noop_context() # type: ignore
  581. with (
  582. self.subTest(method=method),
  583. closing(IOStream(socket.socket())) as stream,
  584. expect_log,
  585. ):
  586. yield stream.connect(("127.0.0.1", self.get_http_port()))
  587. stream.write(utf8(f"{method} /echo HTTP/1.1\r\nHost:127.0.0.1\r\n\r\n"))
  588. resp = yield stream.read_until(b"\r\n\r\n")
  589. self.assertTrue(
  590. resp.startswith(b"HTTP/1.1 %d" % code),
  591. f"expected status code {code} in {resp!r}",
  592. )
  593. class XHeaderTest(HandlerBaseTestCase):
  594. class Handler(RequestHandler):
  595. def get(self):
  596. self.set_header("request-version", self.request.version)
  597. self.write(
  598. dict(
  599. remote_ip=self.request.remote_ip,
  600. remote_protocol=self.request.protocol,
  601. )
  602. )
  603. def get_httpserver_options(self):
  604. return dict(xheaders=True, trusted_downstream=["5.5.5.5"])
  605. def test_ip_headers(self):
  606. self.assertEqual(self.fetch_json("/")["remote_ip"], "127.0.0.1")
  607. valid_ipv4 = {"X-Real-IP": "4.4.4.4"}
  608. self.assertEqual(
  609. self.fetch_json("/", headers=valid_ipv4)["remote_ip"], "4.4.4.4"
  610. )
  611. valid_ipv4_list = {"X-Forwarded-For": "127.0.0.1, 4.4.4.4"}
  612. self.assertEqual(
  613. self.fetch_json("/", headers=valid_ipv4_list)["remote_ip"], "4.4.4.4"
  614. )
  615. valid_ipv6 = {"X-Real-IP": "2620:0:1cfe:face:b00c::3"}
  616. self.assertEqual(
  617. self.fetch_json("/", headers=valid_ipv6)["remote_ip"],
  618. "2620:0:1cfe:face:b00c::3",
  619. )
  620. valid_ipv6_list = {"X-Forwarded-For": "::1, 2620:0:1cfe:face:b00c::3"}
  621. self.assertEqual(
  622. self.fetch_json("/", headers=valid_ipv6_list)["remote_ip"],
  623. "2620:0:1cfe:face:b00c::3",
  624. )
  625. invalid_chars = {"X-Real-IP": "4.4.4.4<script>"}
  626. self.assertEqual(
  627. self.fetch_json("/", headers=invalid_chars)["remote_ip"], "127.0.0.1"
  628. )
  629. invalid_chars_list = {"X-Forwarded-For": "4.4.4.4, 5.5.5.5<script>"}
  630. self.assertEqual(
  631. self.fetch_json("/", headers=invalid_chars_list)["remote_ip"], "127.0.0.1"
  632. )
  633. invalid_host = {"X-Real-IP": "www.google.com"}
  634. self.assertEqual(
  635. self.fetch_json("/", headers=invalid_host)["remote_ip"], "127.0.0.1"
  636. )
  637. def test_trusted_downstream(self):
  638. valid_ipv4_list = {"X-Forwarded-For": "127.0.0.1, 4.4.4.4, 5.5.5.5"}
  639. resp = self.fetch("/", headers=valid_ipv4_list)
  640. if resp.headers["request-version"].startswith("HTTP/2"):
  641. # This is a hack - there's nothing that fundamentally requires http/1
  642. # here but tornado_http2 doesn't support it yet.
  643. self.skipTest("requires HTTP/1.x")
  644. result = json_decode(resp.body)
  645. self.assertEqual(result["remote_ip"], "4.4.4.4")
  646. def test_scheme_headers(self):
  647. self.assertEqual(self.fetch_json("/")["remote_protocol"], "http")
  648. https_scheme = {"X-Scheme": "https"}
  649. self.assertEqual(
  650. self.fetch_json("/", headers=https_scheme)["remote_protocol"], "https"
  651. )
  652. https_forwarded = {"X-Forwarded-Proto": "https"}
  653. self.assertEqual(
  654. self.fetch_json("/", headers=https_forwarded)["remote_protocol"], "https"
  655. )
  656. https_multi_forwarded = {"X-Forwarded-Proto": "https , http"}
  657. self.assertEqual(
  658. self.fetch_json("/", headers=https_multi_forwarded)["remote_protocol"],
  659. "http",
  660. )
  661. http_multi_forwarded = {"X-Forwarded-Proto": "http,https"}
  662. self.assertEqual(
  663. self.fetch_json("/", headers=http_multi_forwarded)["remote_protocol"],
  664. "https",
  665. )
  666. bad_forwarded = {"X-Forwarded-Proto": "unknown"}
  667. self.assertEqual(
  668. self.fetch_json("/", headers=bad_forwarded)["remote_protocol"], "http"
  669. )
  670. class SSLXHeaderTest(AsyncHTTPSTestCase, HandlerBaseTestCase):
  671. def get_app(self):
  672. return Application([("/", XHeaderTest.Handler)])
  673. def get_httpserver_options(self):
  674. output = super().get_httpserver_options()
  675. output["xheaders"] = True
  676. return output
  677. def test_request_without_xprotocol(self):
  678. self.assertEqual(self.fetch_json("/")["remote_protocol"], "https")
  679. http_scheme = {"X-Scheme": "http"}
  680. self.assertEqual(
  681. self.fetch_json("/", headers=http_scheme)["remote_protocol"], "http"
  682. )
  683. bad_scheme = {"X-Scheme": "unknown"}
  684. self.assertEqual(
  685. self.fetch_json("/", headers=bad_scheme)["remote_protocol"], "https"
  686. )
  687. class ManualProtocolTest(HandlerBaseTestCase):
  688. class Handler(RequestHandler):
  689. def get(self):
  690. self.write(dict(protocol=self.request.protocol))
  691. def get_httpserver_options(self):
  692. return dict(protocol="https")
  693. def test_manual_protocol(self):
  694. self.assertEqual(self.fetch_json("/")["protocol"], "https")
  695. @abstract_base_test
  696. class UnixSocketTest(AsyncTestCase):
  697. """HTTPServers can listen on Unix sockets too.
  698. Why would you want to do this? Nginx can proxy to backends listening
  699. on unix sockets, for one thing (and managing a namespace for unix
  700. sockets can be easier than managing a bunch of TCP port numbers).
  701. Unfortunately, there's no way to specify a unix socket in a url for
  702. an HTTP client, so we have to test this by hand.
  703. """
  704. address = ""
  705. def setUp(self):
  706. super().setUp()
  707. app = Application([("/hello", HelloWorldRequestHandler)])
  708. self.server = HTTPServer(app)
  709. self.server.add_socket(netutil.bind_unix_socket(self.address))
  710. def tearDown(self):
  711. self.io_loop.run_sync(self.server.close_all_connections)
  712. self.server.stop()
  713. super().tearDown()
  714. @gen_test
  715. def test_unix_socket(self):
  716. with closing(IOStream(socket.socket(socket.AF_UNIX))) as stream:
  717. stream.connect(self.address)
  718. stream.write(b"GET /hello HTTP/1.0\r\n\r\n")
  719. response = yield stream.read_until(b"\r\n")
  720. self.assertEqual(response, b"HTTP/1.1 200 OK\r\n")
  721. header_data = yield stream.read_until(b"\r\n\r\n")
  722. headers = HTTPHeaders.parse(header_data.decode("latin1"))
  723. body = yield stream.read_bytes(int(headers["Content-Length"]))
  724. self.assertEqual(body, b"Hello world")
  725. @gen_test
  726. def test_unix_socket_bad_request(self):
  727. # Unix sockets don't have remote addresses so they just return an
  728. # empty string.
  729. with ExpectLog(gen_log, "Malformed HTTP message from", level=logging.INFO):
  730. with closing(IOStream(socket.socket(socket.AF_UNIX))) as stream:
  731. stream.connect(self.address)
  732. stream.write(b"garbage\r\n\r\n")
  733. response = yield stream.read_until_close()
  734. self.assertEqual(response, b"HTTP/1.1 400 Bad Request\r\n\r\n")
  735. @unittest.skipIf(
  736. not hasattr(socket, "AF_UNIX") or sys.platform == "cygwin",
  737. "unix sockets not supported on this platform",
  738. )
  739. class UnixSocketTestFile(UnixSocketTest):
  740. def setUp(self):
  741. self.tmpdir = tempfile.mkdtemp()
  742. self.address = os.path.join(self.tmpdir, "test.sock")
  743. super().setUp()
  744. def tearDown(self):
  745. super().tearDown()
  746. shutil.rmtree(self.tmpdir)
  747. @unittest.skipIf(
  748. not (hasattr(socket, "AF_UNIX") and sys.platform.startswith("linux")),
  749. "abstract namespace unix sockets not supported on this platform",
  750. )
  751. class UnixSocketTestAbstract(UnixSocketTest):
  752. def setUp(self):
  753. self.address = "\0" + uuid.uuid4().hex
  754. super().setUp()
  755. class KeepAliveTest(AsyncHTTPTestCase):
  756. """Tests various scenarios for HTTP 1.1 keep-alive support.
  757. These tests don't use AsyncHTTPClient because we want to control
  758. connection reuse and closing.
  759. """
  760. def get_app(self):
  761. class HelloHandler(RequestHandler):
  762. def get(self):
  763. self.finish("Hello world")
  764. def post(self):
  765. self.finish("Hello world")
  766. class LargeHandler(RequestHandler):
  767. def get(self):
  768. # 512KB should be bigger than the socket buffers so it will
  769. # be written out in chunks.
  770. self.write("".join(chr(i % 256) * 1024 for i in range(512)))
  771. class TransferEncodingChunkedHandler(RequestHandler):
  772. @gen.coroutine
  773. def head(self):
  774. self.write("Hello world")
  775. yield self.flush()
  776. class FinishOnCloseHandler(RequestHandler):
  777. def initialize(self, cleanup_event):
  778. self.cleanup_event = cleanup_event
  779. @gen.coroutine
  780. def get(self):
  781. self.flush()
  782. yield self.cleanup_event.wait()
  783. def on_connection_close(self):
  784. # This is not very realistic, but finishing the request
  785. # from the close callback has the right timing to mimic
  786. # some errors seen in the wild.
  787. self.finish("closed")
  788. self.cleanup_event = Event()
  789. return Application(
  790. [
  791. ("/", HelloHandler),
  792. ("/large", LargeHandler),
  793. ("/chunked", TransferEncodingChunkedHandler),
  794. (
  795. "/finish_on_close",
  796. FinishOnCloseHandler,
  797. dict(cleanup_event=self.cleanup_event),
  798. ),
  799. ]
  800. )
  801. def setUp(self):
  802. super().setUp()
  803. self.http_version = b"HTTP/1.1"
  804. def tearDown(self):
  805. # We just closed the client side of the socket; let the IOLoop run
  806. # once to make sure the server side got the message.
  807. self.io_loop.add_timeout(datetime.timedelta(seconds=0.001), self.stop)
  808. self.wait()
  809. if hasattr(self, "stream"):
  810. self.stream.close()
  811. super().tearDown()
  812. # The next few methods are a crude manual http client
  813. @gen.coroutine
  814. def connect(self):
  815. self.stream = IOStream(socket.socket())
  816. yield self.stream.connect(("127.0.0.1", self.get_http_port()))
  817. @gen.coroutine
  818. def read_headers(self):
  819. first_line = yield self.stream.read_until(b"\r\n")
  820. self.assertTrue(first_line.startswith(b"HTTP/1.1 200"), first_line)
  821. header_bytes = yield self.stream.read_until(b"\r\n\r\n")
  822. headers = HTTPHeaders.parse(header_bytes.decode("latin1"))
  823. raise gen.Return(headers)
  824. @gen.coroutine
  825. def read_response(self):
  826. self.headers = yield self.read_headers()
  827. body = yield self.stream.read_bytes(int(self.headers["Content-Length"]))
  828. self.assertEqual(b"Hello world", body)
  829. def close(self):
  830. self.stream.close()
  831. del self.stream
  832. @gen_test
  833. def test_two_requests(self):
  834. yield self.connect()
  835. self.stream.write(b"GET / HTTP/1.1\r\nHost:127.0.0.1\r\n\r\n")
  836. yield self.read_response()
  837. self.stream.write(b"GET / HTTP/1.1\r\nHost:127.0.0.1\r\n\r\n")
  838. yield self.read_response()
  839. self.close()
  840. @gen_test
  841. def test_request_close(self):
  842. yield self.connect()
  843. self.stream.write(
  844. b"GET / HTTP/1.1\r\nHost:127.0.0.1\r\nConnection: close\r\n\r\n"
  845. )
  846. yield self.read_response()
  847. data = yield self.stream.read_until_close()
  848. self.assertTrue(not data)
  849. self.assertEqual(self.headers["Connection"], "close")
  850. self.close()
  851. # keepalive is supported for http 1.0 too, but it's opt-in
  852. @gen_test
  853. def test_http10(self):
  854. self.http_version = b"HTTP/1.0"
  855. yield self.connect()
  856. self.stream.write(b"GET / HTTP/1.0\r\n\r\n")
  857. yield self.read_response()
  858. data = yield self.stream.read_until_close()
  859. self.assertFalse(data)
  860. self.assertNotIn("Connection", self.headers)
  861. self.close()
  862. @gen_test
  863. def test_http10_keepalive(self):
  864. self.http_version = b"HTTP/1.0"
  865. yield self.connect()
  866. self.stream.write(b"GET / HTTP/1.0\r\nConnection: keep-alive\r\n\r\n")
  867. yield self.read_response()
  868. self.assertEqual(self.headers["Connection"], "Keep-Alive")
  869. self.stream.write(b"GET / HTTP/1.0\r\nConnection: keep-alive\r\n\r\n")
  870. yield self.read_response()
  871. self.assertEqual(self.headers["Connection"], "Keep-Alive")
  872. self.close()
  873. @gen_test
  874. def test_http10_keepalive_extra_crlf(self):
  875. self.http_version = b"HTTP/1.0"
  876. yield self.connect()
  877. self.stream.write(b"GET / HTTP/1.0\r\nConnection: keep-alive\r\n\r\n\r\n")
  878. yield self.read_response()
  879. self.assertEqual(self.headers["Connection"], "Keep-Alive")
  880. self.stream.write(b"GET / HTTP/1.0\r\nConnection: keep-alive\r\n\r\n")
  881. yield self.read_response()
  882. self.assertEqual(self.headers["Connection"], "Keep-Alive")
  883. self.close()
  884. @gen_test
  885. def test_pipelined_requests(self):
  886. yield self.connect()
  887. self.stream.write(
  888. b"GET / HTTP/1.1\r\nHost:127.0.0.1\r\n\r\nGET / HTTP/1.1\r\nHost:127.0.0.1\r\n\r\n"
  889. )
  890. yield self.read_response()
  891. yield self.read_response()
  892. self.close()
  893. @gen_test
  894. def test_pipelined_cancel(self):
  895. yield self.connect()
  896. self.stream.write(
  897. b"GET / HTTP/1.1\r\nHost:127.0.0.1\r\n\r\nGET / HTTP/1.1\r\nHost:127.0.0.1\r\n\r\n"
  898. )
  899. # only read once
  900. yield self.read_response()
  901. self.close()
  902. @gen_test
  903. def test_cancel_during_download(self):
  904. yield self.connect()
  905. self.stream.write(b"GET /large HTTP/1.1\r\nHost:127.0.0.1\r\n\r\n")
  906. yield self.read_headers()
  907. yield self.stream.read_bytes(1024)
  908. self.close()
  909. @gen_test
  910. def test_finish_while_closed(self):
  911. yield self.connect()
  912. self.stream.write(b"GET /finish_on_close HTTP/1.1\r\nHost:127.0.0.1\r\n\r\n")
  913. yield self.read_headers()
  914. self.close()
  915. # Let the hanging coroutine clean up after itself
  916. self.cleanup_event.set()
  917. @gen_test
  918. def test_keepalive_chunked(self):
  919. self.http_version = b"HTTP/1.0"
  920. yield self.connect()
  921. self.stream.write(
  922. b"POST / HTTP/1.0\r\n"
  923. b"Connection: keep-alive\r\n"
  924. b"Transfer-Encoding: chunked\r\n"
  925. b"\r\n"
  926. b"0\r\n"
  927. b"\r\n"
  928. )
  929. yield self.read_response()
  930. self.assertEqual(self.headers["Connection"], "Keep-Alive")
  931. self.stream.write(b"GET / HTTP/1.0\r\nConnection: keep-alive\r\n\r\n")
  932. yield self.read_response()
  933. self.assertEqual(self.headers["Connection"], "Keep-Alive")
  934. self.close()
  935. @gen_test
  936. def test_keepalive_chunked_head_no_body(self):
  937. yield self.connect()
  938. self.stream.write(b"HEAD /chunked HTTP/1.1\r\nHost:127.0.0.1\r\n\r\n")
  939. yield self.read_headers()
  940. self.stream.write(b"HEAD /chunked HTTP/1.1\r\nHost:127.0.0.1\r\n\r\n")
  941. yield self.read_headers()
  942. self.close()
  943. class GzipBaseTest(AsyncHTTPTestCase):
  944. def get_app(self):
  945. return Application([("/", EchoHandler)])
  946. def post_gzip(self, body):
  947. bytesio = BytesIO()
  948. gzip_file = gzip.GzipFile(mode="w", fileobj=bytesio)
  949. gzip_file.write(utf8(body))
  950. gzip_file.close()
  951. compressed_body = bytesio.getvalue()
  952. return self.fetch(
  953. "/",
  954. method="POST",
  955. body=compressed_body,
  956. headers={"Content-Encoding": "gzip"},
  957. )
  958. def test_uncompressed(self):
  959. response = self.fetch("/", method="POST", body="foo=bar")
  960. self.assertEqual(json_decode(response.body), {"foo": ["bar"]})
  961. class GzipTest(GzipBaseTest, AsyncHTTPTestCase):
  962. def get_httpserver_options(self):
  963. return dict(decompress_request=True)
  964. def test_gzip(self):
  965. response = self.post_gzip("foo=bar")
  966. self.assertEqual(json_decode(response.body), {"foo": ["bar"]})
  967. def test_gzip_case_insensitive(self):
  968. # https://datatracker.ietf.org/doc/html/rfc7231#section-3.1.2.1
  969. bytesio = BytesIO()
  970. gzip_file = gzip.GzipFile(mode="w", fileobj=bytesio)
  971. gzip_file.write(utf8("foo=bar"))
  972. gzip_file.close()
  973. compressed_body = bytesio.getvalue()
  974. response = self.fetch(
  975. "/",
  976. method="POST",
  977. body=compressed_body,
  978. headers={"Content-Encoding": "GZIP"},
  979. )
  980. self.assertEqual(json_decode(response.body), {"foo": ["bar"]})
  981. class GzipUnsupportedTest(GzipBaseTest, AsyncHTTPTestCase):
  982. def test_gzip_unsupported(self):
  983. # Gzip support is opt-in; without it the server fails to parse
  984. # the body (but parsing form bodies is currently just a log message,
  985. # not a fatal error).
  986. with ExpectLog(gen_log, ".*Unsupported Content-Encoding"):
  987. response = self.post_gzip("foo=bar")
  988. self.assertEqual(response.code, 400)
  989. class StreamingChunkSizeTest(AsyncHTTPTestCase):
  990. # 50 characters long, and repetitive so it can be compressed.
  991. BODY = b"01234567890123456789012345678901234567890123456789"
  992. CHUNK_SIZE = 16
  993. def get_http_client(self):
  994. # body_producer doesn't work on curl_httpclient, so override the
  995. # configured AsyncHTTPClient implementation.
  996. return SimpleAsyncHTTPClient()
  997. def get_httpserver_options(self):
  998. return dict(chunk_size=self.CHUNK_SIZE, decompress_request=True)
  999. class MessageDelegate(HTTPMessageDelegate):
  1000. def __init__(self, connection):
  1001. self.connection = connection
  1002. def headers_received(self, start_line, headers):
  1003. self.chunk_lengths = [] # type: List[int]
  1004. def data_received(self, chunk):
  1005. self.chunk_lengths.append(len(chunk))
  1006. def finish(self):
  1007. response_body = utf8(json_encode(self.chunk_lengths))
  1008. self.connection.write_headers(
  1009. ResponseStartLine("HTTP/1.1", 200, "OK"),
  1010. HTTPHeaders({"Content-Length": str(len(response_body))}),
  1011. )
  1012. self.connection.write(response_body)
  1013. self.connection.finish()
  1014. def get_app(self):
  1015. class App(HTTPServerConnectionDelegate):
  1016. def start_request(self, server_conn, request_conn):
  1017. return StreamingChunkSizeTest.MessageDelegate(request_conn)
  1018. return App()
  1019. def fetch_chunk_sizes(self, **kwargs):
  1020. response = self.fetch("/", method="POST", **kwargs)
  1021. response.rethrow()
  1022. chunks = json_decode(response.body)
  1023. self.assertEqual(len(self.BODY), sum(chunks))
  1024. for chunk_size in chunks:
  1025. self.assertLessEqual(
  1026. chunk_size, self.CHUNK_SIZE, "oversized chunk: " + str(chunks)
  1027. )
  1028. self.assertGreater(chunk_size, 0, "empty chunk: " + str(chunks))
  1029. return chunks
  1030. def compress(self, body):
  1031. bytesio = BytesIO()
  1032. gzfile = gzip.GzipFile(mode="w", fileobj=bytesio)
  1033. gzfile.write(body)
  1034. gzfile.close()
  1035. compressed = bytesio.getvalue()
  1036. if len(compressed) >= len(body):
  1037. raise Exception("body did not shrink when compressed")
  1038. return compressed
  1039. def test_regular_body(self):
  1040. chunks = self.fetch_chunk_sizes(body=self.BODY)
  1041. # Without compression we know exactly what to expect.
  1042. self.assertEqual([16, 16, 16, 2], chunks)
  1043. def test_compressed_body(self):
  1044. self.fetch_chunk_sizes(
  1045. body=self.compress(self.BODY), headers={"Content-Encoding": "gzip"}
  1046. )
  1047. # Compression creates irregular boundaries so the assertions
  1048. # in fetch_chunk_sizes are as specific as we can get.
  1049. def test_chunked_body(self):
  1050. def body_producer(write):
  1051. write(self.BODY[:20])
  1052. write(self.BODY[20:])
  1053. chunks = self.fetch_chunk_sizes(body_producer=body_producer)
  1054. # HTTP chunk boundaries translate to application-visible breaks
  1055. self.assertEqual([16, 4, 16, 14], chunks)
  1056. def test_chunked_compressed(self):
  1057. compressed = self.compress(self.BODY)
  1058. self.assertGreater(len(compressed), 20)
  1059. def body_producer(write):
  1060. write(compressed[:20])
  1061. write(compressed[20:])
  1062. self.fetch_chunk_sizes(
  1063. body_producer=body_producer, headers={"Content-Encoding": "gzip"}
  1064. )
  1065. class InvalidOutputContentLengthTest(AsyncHTTPTestCase):
  1066. class MessageDelegate(HTTPMessageDelegate):
  1067. def __init__(self, connection):
  1068. self.connection = connection
  1069. def headers_received(self, start_line, headers):
  1070. content_lengths = {
  1071. "normal": "10",
  1072. "alphabetic": "foo",
  1073. "leading plus": "+10",
  1074. "underscore": "1_0",
  1075. }
  1076. self.connection.write_headers(
  1077. ResponseStartLine("HTTP/1.1", 200, "OK"),
  1078. HTTPHeaders({"Content-Length": content_lengths[headers["x-test"]]}),
  1079. )
  1080. self.connection.write(b"1234567890")
  1081. self.connection.finish()
  1082. def get_app(self):
  1083. class App(HTTPServerConnectionDelegate):
  1084. def start_request(self, server_conn, request_conn):
  1085. return InvalidOutputContentLengthTest.MessageDelegate(request_conn)
  1086. return App()
  1087. def test_invalid_output_content_length(self):
  1088. with self.subTest("normal"):
  1089. response = self.fetch("/", method="GET", headers={"x-test": "normal"})
  1090. response.rethrow()
  1091. self.assertEqual(response.body, b"1234567890")
  1092. for test in ["alphabetic", "leading plus", "underscore"]:
  1093. with self.subTest(test):
  1094. # This log matching could be tighter but I think I'm already
  1095. # over-testing here.
  1096. with ExpectLog(app_log, "Uncaught exception"):
  1097. with self.assertRaises(HTTPError):
  1098. self.fetch("/", method="GET", headers={"x-test": test})
  1099. class MaxHeaderSizeTest(AsyncHTTPTestCase):
  1100. def get_app(self):
  1101. return Application([("/", HelloWorldRequestHandler)])
  1102. def get_httpserver_options(self):
  1103. return dict(max_header_size=1024)
  1104. def test_small_headers(self):
  1105. response = self.fetch("/", headers={"X-Filler": "a" * 100})
  1106. response.rethrow()
  1107. self.assertEqual(response.body, b"Hello world")
  1108. def test_large_headers(self):
  1109. with ExpectLog(gen_log, "Unsatisfiable read", required=False):
  1110. try:
  1111. self.fetch("/", headers={"X-Filler": "a" * 1000}, raise_error=True)
  1112. self.fail("did not raise expected exception")
  1113. except HTTPError as e:
  1114. # 431 is "Request Header Fields Too Large", defined in RFC
  1115. # 6585. However, many implementations just close the
  1116. # connection in this case, resulting in a missing response.
  1117. if e.response is not None:
  1118. self.assertIn(e.response.code, (431, 599))
  1119. class IdleTimeoutTest(AsyncHTTPTestCase):
  1120. def get_app(self):
  1121. return Application([("/", HelloWorldRequestHandler)])
  1122. def get_httpserver_options(self):
  1123. return dict(idle_connection_timeout=0.1)
  1124. def setUp(self):
  1125. super().setUp()
  1126. self.streams = [] # type: List[IOStream]
  1127. def tearDown(self):
  1128. super().tearDown()
  1129. for stream in self.streams:
  1130. stream.close()
  1131. @gen.coroutine
  1132. def connect(self):
  1133. stream = IOStream(socket.socket())
  1134. yield stream.connect(("127.0.0.1", self.get_http_port()))
  1135. self.streams.append(stream)
  1136. raise gen.Return(stream)
  1137. @gen_test
  1138. def test_unused_connection(self):
  1139. stream = yield self.connect()
  1140. event = Event()
  1141. stream.set_close_callback(event.set)
  1142. yield event.wait()
  1143. @gen_test
  1144. def test_idle_after_use(self):
  1145. stream = yield self.connect()
  1146. event = Event()
  1147. stream.set_close_callback(event.set)
  1148. # Use the connection twice to make sure keep-alives are working
  1149. for i in range(2):
  1150. stream.write(b"GET / HTTP/1.1\r\nHost: 127.0.0.1\r\n\r\n")
  1151. yield stream.read_until(b"\r\n\r\n")
  1152. data = yield stream.read_bytes(11)
  1153. self.assertEqual(data, b"Hello world")
  1154. # Now let the timeout trigger and close the connection.
  1155. yield event.wait()
  1156. class BodyLimitsTest(AsyncHTTPTestCase):
  1157. def get_app(self):
  1158. class BufferedHandler(RequestHandler):
  1159. def put(self):
  1160. self.write(str(len(self.request.body)))
  1161. @stream_request_body
  1162. class StreamingHandler(RequestHandler):
  1163. def initialize(self):
  1164. self.bytes_read = 0
  1165. def prepare(self):
  1166. conn = typing.cast(HTTP1Connection, self.request.connection)
  1167. if "expected_size" in self.request.arguments:
  1168. conn.set_max_body_size(int(self.get_argument("expected_size")))
  1169. if "body_timeout" in self.request.arguments:
  1170. conn.set_body_timeout(float(self.get_argument("body_timeout")))
  1171. def data_received(self, data):
  1172. self.bytes_read += len(data)
  1173. def put(self):
  1174. self.write(str(self.bytes_read))
  1175. return Application(
  1176. [("/buffered", BufferedHandler), ("/streaming", StreamingHandler)]
  1177. )
  1178. def get_httpserver_options(self):
  1179. return dict(body_timeout=3600, max_body_size=4096)
  1180. def get_http_client(self):
  1181. # body_producer doesn't work on curl_httpclient, so override the
  1182. # configured AsyncHTTPClient implementation.
  1183. return SimpleAsyncHTTPClient()
  1184. def test_small_body(self):
  1185. response = self.fetch("/buffered", method="PUT", body=b"a" * 4096)
  1186. self.assertEqual(response.body, b"4096")
  1187. response = self.fetch("/streaming", method="PUT", body=b"a" * 4096)
  1188. self.assertEqual(response.body, b"4096")
  1189. def test_large_body_buffered(self):
  1190. with ExpectLog(gen_log, ".*Content-Length too long", level=logging.INFO):
  1191. response = self.fetch("/buffered", method="PUT", body=b"a" * 10240)
  1192. self.assertEqual(response.code, 400)
  1193. @unittest.skipIf(os.name == "nt", "flaky on windows")
  1194. def test_large_body_buffered_chunked(self):
  1195. # This test is flaky on windows for unknown reasons.
  1196. with ExpectLog(gen_log, ".*chunked body too large", level=logging.INFO):
  1197. response = self.fetch(
  1198. "/buffered",
  1199. method="PUT",
  1200. body_producer=lambda write: write(b"a" * 10240),
  1201. )
  1202. self.assertEqual(response.code, 400)
  1203. def test_large_body_streaming(self):
  1204. with ExpectLog(gen_log, ".*Content-Length too long", level=logging.INFO):
  1205. response = self.fetch("/streaming", method="PUT", body=b"a" * 10240)
  1206. self.assertEqual(response.code, 400)
  1207. @unittest.skipIf(os.name == "nt", "flaky on windows")
  1208. def test_large_body_streaming_chunked(self):
  1209. with ExpectLog(gen_log, ".*chunked body too large", level=logging.INFO):
  1210. response = self.fetch(
  1211. "/streaming",
  1212. method="PUT",
  1213. body_producer=lambda write: write(b"a" * 10240),
  1214. )
  1215. self.assertEqual(response.code, 400)
  1216. def test_large_body_streaming_override(self):
  1217. response = self.fetch(
  1218. "/streaming?expected_size=10240", method="PUT", body=b"a" * 10240
  1219. )
  1220. self.assertEqual(response.body, b"10240")
  1221. def test_large_body_streaming_chunked_override(self):
  1222. response = self.fetch(
  1223. "/streaming?expected_size=10240",
  1224. method="PUT",
  1225. body_producer=lambda write: write(b"a" * 10240),
  1226. )
  1227. self.assertEqual(response.body, b"10240")
  1228. @gen_test
  1229. def test_timeout(self):
  1230. stream = IOStream(socket.socket())
  1231. try:
  1232. yield stream.connect(("127.0.0.1", self.get_http_port()))
  1233. # Use a raw stream because AsyncHTTPClient won't let us read a
  1234. # response without finishing a body.
  1235. stream.write(
  1236. b"PUT /streaming?body_timeout=0.1 HTTP/1.0\r\n"
  1237. b"Content-Length: 42\r\n\r\n"
  1238. )
  1239. with ExpectLog(gen_log, "Timeout reading body", level=logging.INFO):
  1240. response = yield stream.read_until_close()
  1241. self.assertEqual(response, b"")
  1242. finally:
  1243. stream.close()
  1244. @gen_test
  1245. def test_body_size_override_reset(self):
  1246. # The max_body_size override is reset between requests.
  1247. stream = IOStream(socket.socket())
  1248. try:
  1249. yield stream.connect(("127.0.0.1", self.get_http_port()))
  1250. # Use a raw stream so we can make sure it's all on one connection.
  1251. stream.write(
  1252. b"PUT /streaming?expected_size=10240 HTTP/1.1\r\n"
  1253. b"Host: 127.0.0.1\r\n"
  1254. b"Content-Length: 10240\r\n\r\n"
  1255. )
  1256. stream.write(b"a" * 10240)
  1257. start_line, headers, response = yield read_stream_body(stream)
  1258. self.assertEqual(response, b"10240")
  1259. # Without the ?expected_size parameter, we get the old default value
  1260. stream.write(
  1261. b"PUT /streaming HTTP/1.1\r\n"
  1262. b"Host: 127.0.0.1\r\n"
  1263. b"Content-Length: 10240\r\n\r\n"
  1264. )
  1265. with ExpectLog(gen_log, ".*Content-Length too long", level=logging.INFO):
  1266. data = yield stream.read_until_close()
  1267. self.assertEqual(data, b"HTTP/1.1 400 Bad Request\r\n\r\n")
  1268. finally:
  1269. stream.close()
  1270. class LegacyInterfaceTest(AsyncHTTPTestCase):
  1271. def get_app(self):
  1272. # The old request_callback interface does not implement the
  1273. # delegate interface, and writes its response via request.write
  1274. # instead of request.connection.write_headers.
  1275. def handle_request(request):
  1276. self.http1 = request.version.startswith("HTTP/1.")
  1277. if not self.http1:
  1278. # This test will be skipped if we're using HTTP/2,
  1279. # so just close it out cleanly using the modern interface.
  1280. request.connection.write_headers(
  1281. ResponseStartLine("", 200, "OK"), HTTPHeaders()
  1282. )
  1283. request.connection.finish()
  1284. return
  1285. message = b"Hello world"
  1286. request.connection.write(
  1287. utf8("HTTP/1.1 200 OK\r\n" "Content-Length: %d\r\n\r\n" % len(message))
  1288. )
  1289. request.connection.write(message)
  1290. request.connection.finish()
  1291. return handle_request
  1292. def test_legacy_interface(self):
  1293. response = self.fetch("/")
  1294. if not self.http1:
  1295. self.skipTest("requires HTTP/1.x")
  1296. self.assertEqual(response.body, b"Hello world")