asgi-tools 1.3.1__tar.gz → 1.3.3__tar.gz

{asgi_tools-1.3.1/asgi_tools.egg-info → asgi_tools-1.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: asgi-tools
-Version: 1.3.1
+Version: 1.3.3
 Summary: ASGI Toolkit to build web applications
 Author-email: Kirill Klenov <horneds@gmail.com>
 License: MIT License
@@ -33,7 +33,7 @@ Requires-Dist: async-timeout; python_version < "3.11"
 Provides-Extra: tests
 Requires-Dist: aiofile; extra == "tests"
 Requires-Dist: pytest; extra == "tests"
-Requires-Dist: pytest-aio[curio,trio]>=1.3.1; extra == "tests"
+Requires-Dist: pytest-aio[curio,trio]>=1.3.3; extra == "tests"
 Requires-Dist: pytest-benchmark; extra == "tests"
 Requires-Dist: PyYAML; extra == "tests"
 Requires-Dist: ruff; extra == "tests"

{asgi_tools-1.3.1 → asgi_tools-1.3.3}/asgi_tools/middleware.py

@@ -392,7 +392,7 @@ class StaticFilesMiddleware(BaseMiddleware):
         super().__init__(app)
         self.url_prefix = url_prefix
         folders = folders or []
-        self.folders: list[Path] = [Path(folder) for folder in folders]
+        self.folders: list[Path] = [Path(folder).resolve() for folder in folders]
 
     async def __process__(self, scope: TASGIScope, receive: TASGIReceive, send: TASGISend) -> None:
         """Serve static files for self url prefix."""
@@ -403,7 +403,7 @@ class StaticFilesMiddleware(BaseMiddleware):
             filename = path[len(url_prefix) :].strip("/")
             for folder in self.folders:
                 filepath = folder.joinpath(filename).resolve()
-                if folder != filepath.parent:
+                if not filepath.is_file() or not filepath.is_relative_to(folder):
                     continue
                 with suppress(ASGIError):
                     response = ResponseFile(filepath, headers_only=scope["method"] == "HEAD")

{asgi_tools-1.3.1 → asgi_tools-1.3.3/asgi_tools.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: asgi-tools
-Version: 1.3.1
+Version: 1.3.3
 Summary: ASGI Toolkit to build web applications
 Author-email: Kirill Klenov <horneds@gmail.com>
 License: MIT License
@@ -33,7 +33,7 @@ Requires-Dist: async-timeout; python_version < "3.11"
 Provides-Extra: tests
 Requires-Dist: aiofile; extra == "tests"
 Requires-Dist: pytest; extra == "tests"
-Requires-Dist: pytest-aio[curio,trio]>=1.3.1; extra == "tests"
+Requires-Dist: pytest-aio[curio,trio]>=1.3.3; extra == "tests"
 Requires-Dist: pytest-benchmark; extra == "tests"
 Requires-Dist: PyYAML; extra == "tests"
 Requires-Dist: ruff; extra == "tests"

{asgi_tools-1.3.1 → asgi_tools-1.3.3}/asgi_tools.egg-info/requires.txt

@@ -25,7 +25,7 @@ orjson
 [tests]
 aiofile
 pytest
-pytest-aio[curio,trio]>=1.3.1
+pytest-aio[curio,trio]>=1.3.3
 pytest-benchmark
 PyYAML
 ruff

{asgi_tools-1.3.1 → asgi_tools-1.3.3}/pyproject.toml

@@ -3,7 +3,7 @@ requires = ["setuptools", "wheel", "Cython"]
 
 [project]
 name = "asgi-tools"
-version = "1.3.1"
+version = "1.3.3"
 description = "ASGI Toolkit to build web applications"
 readme = "README.rst"
 requires-python = ">=3.10"
@@ -43,7 +43,7 @@ documentation = "https://klen.github.io/asgi-tools"
 tests = [
   "aiofile",
   "pytest",
-  "pytest-aio[curio,trio] >= 1.3.1",
+  "pytest-aio[curio,trio] >= 1.3.3",
   "pytest-benchmark",
   "PyYAML",
   "ruff",

{asgi_tools-1.3.1 → asgi_tools-1.3.3}/tests/test_middlewares.py

@@ -192,7 +192,7 @@ async def test_staticfiles_middleware(client_cls, app):
 
     from asgi_tools import StaticFilesMiddleware
 
-    app = StaticFilesMiddleware(app, folders=["/", Path(__file__).parent])
+    app = StaticFilesMiddleware(app, folders=["tests"])
 
     client = client_cls(app)
     res = await client.get("/")
@@ -210,6 +210,14 @@ async def test_staticfiles_middleware(client_cls, app):
     text = await res.text()
     assert text.startswith('"""test middlewares"""')
 
+    res = await client.get("/static/fixtures/multipart/CR_in_header.http")
+    assert res.status_code == 200
+    text = await res.text()
+    assert text.startswith("------WebKitFormBoundaryT")
+
+    res = await client.get("/static/../asgi_tools/__init__.py")
+    assert res.status_code == 404
+
     res = await client.get("/static/unknown")
     assert res.status_code == 404