microdot 2.6.0__tar.gz → 2.6.2__tar.gz

{microdot-2.6.0/src/microdot.egg-info → microdot-2.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: microdot
-Version: 2.6.0
+Version: 2.6.2
 Summary: The impossibly small web framework for MicroPython
 Author-email: Miguel Grinberg <miguel.grinberg@gmail.com>
 Project-URL: Homepage, https://github.com/miguelgrinberg/microdot

{microdot-2.6.0 → microdot-2.6.2}/docs/index.rst

@@ -9,8 +9,8 @@ Microdot
 *"The impossibly small web framework for Python and MicroPython"*
 
 Microdot is a minimalistic Python web framework inspired by
-`Flask <https://flask.palletsprojects.com/>`_. Given its size, it can run on
-systems with limited resources such as microcontrollers. Both standard Python
+`Flask <https://flask.palletsprojects.com/>`_. Given its small size, it can run
+on systems with limited resources such as microcontrollers. Both standard Python
 (CPython) and `MicroPython <https://micropython.org>`_ are supported.
 
 .. toctree::

{microdot-2.6.0 → microdot-2.6.2}/docs/users-guide/concurrency.rst

@@ -8,7 +8,7 @@ that applications must be careful to prevent blocking in their handlers.
 ^^^^^^^^^^^^^^^^^^^^
 
 The recommendation for route handlers in Microdot is to use asynchronous
-functions, declared as ``async def``. Microdot executes these handler
+functions, declared with ``async def``. Microdot executes these handler
 functions as native asynchronous tasks. The standard considerations for writing
 asynchronous code apply, and in particular blocking calls should be avoided to
 ensure the application runs smoothly and is always responsive.
@@ -24,9 +24,9 @@ When running on CPython, Microdot executes synchronous handlers in a
 `thread executor <https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.run_in_executor>`_,
 which uses a thread pool. The use of blocking or CPU intensive code in these
 handlers does not have such a negative effect on the application, because
-handlers do not run on the same thread as the asynchronous loop. On the other
-hand, the application will be affected by threading issues such as those caused
-by the Global Interpreter Lock.
+the handlers run on a different threads than the one running the asynchronous
+loop. On the other hand, the application will be affected by threading issues
+such as those caused by the Global Interpreter Lock.
 
 Under MicroPython the situation is different. Most microcontroller boards
 do not have or have very limited threading support, so Microdot executes

{microdot-2.6.0 → microdot-2.6.2}/docs/users-guide/responses.rst

@@ -196,5 +196,5 @@ Another option is to create a response object directly in the route function::
    Standard cookies do not offer sufficient privacy and security controls, so
    never store sensitive information in them unless you are adding additional
    protection mechanisms such as encryption or cryptographic signing. The
-   :ref:`session <Maintaining Secure User Sessions>` extension implements signed
+   :ref:`session <Secure User Sessions>` extension implements signed
    cookies that prevent tampering by malicious actors.

{microdot-2.6.0 → microdot-2.6.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "microdot"
-version = "2.6.0"
+version = "2.6.2"
 authors = [
     { name = "Miguel Grinberg", email = "miguel.grinberg@gmail.com" },
 ]

{microdot-2.6.0 → microdot-2.6.2}/src/microdot/__init__.py

@@ -1,4 +1,4 @@
 from microdot.microdot import Microdot, Request, Response, abort, redirect, \
     send_file, URLPattern, AsyncBytesIO, iscoroutine  # noqa: F401
 
-__version__ = '2.6.0'
+__version__ = '2.6.2'

{microdot-2.6.0 → microdot-2.6.2}/src/microdot/microdot.py

@@ -611,6 +611,8 @@ class Response:
         :param http_only: The cookie's ``HttpOnly`` flag.
         :param partitioned: Whether the cookie is partitioned.
         """
+        if ';' in value:
+            raise ValueError('invalid cookie value')
         http_cookie = '{cookie}={value}'.format(cookie=cookie, value=value)
         if path:
             http_cookie += '; Path=' + path
@@ -630,6 +632,8 @@ class Response:
             http_cookie += '; HttpOnly'
         if partitioned:
             http_cookie += '; Partitioned'
+        if '\r' in http_cookie or '\n' in http_cookie:
+            raise ValueError('invalid cookie')
         if 'Set-Cookie' in self.headers:
             self.headers['Set-Cookie'].append(http_cookie)
         else:
@@ -762,7 +766,7 @@ class Response:
         :param status_code: The 3xx status code to use for the redirect. The
                             default is 302.
         """
-        if '\x0d' in location or '\x0a' in location:
+        if '\r' in location or '\n' in location:
             raise ValueError('invalid redirect URL')
         return cls(status_code=status_code, headers={'Location': location})
 

{microdot-2.6.0 → microdot-2.6.2}/src/microdot/multipart.py

@@ -40,8 +40,9 @@ class FormDataIter:
     def __init__(self, request):
         self.request = request
         self.buffer = None
+        content_type = request.content_type or ''
         try:
-            mimetype, boundary = request.content_type.rsplit('; boundary=', 1)
+            mimetype, boundary = content_type.rsplit('; boundary=', 1)
         except ValueError:
             return  # not a multipart request
         if mimetype.split(';', 1)[0] == \

{microdot-2.6.0 → microdot-2.6.2/src/microdot.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: microdot
-Version: 2.6.0
+Version: 2.6.2
 Summary: The impossibly small web framework for MicroPython
 Author-email: Miguel Grinberg <miguel.grinberg@gmail.com>
 Project-URL: Homepage, https://github.com/miguelgrinberg/microdot

{microdot-2.6.0 → microdot-2.6.2}/tests/test_multipart.py

@@ -172,6 +172,20 @@ class TestMultipart(unittest.TestCase):
         self.assertEqual(res.status_code, 200)
         self.assertEqual(res.text, 'None')
 
+    def test_no_content_type(self):
+        app = Microdot()
+
+        @app.route('/async', methods=['GET', 'POST'])
+        @with_form_data
+        async def async_route(req):
+            return str(req.form)
+
+        client = TestClient(app)
+
+        res = self._run(client.get('/async'))
+        self.assertEqual(res.status_code, 200)
+        self.assertEqual(res.text, 'None')
+
     def test_upload_iterator(self):
         app = Microdot()
 

{microdot-2.6.0 → microdot-2.6.2}/tests/test_response.py

@@ -194,6 +194,15 @@ class TestResponse(unittest.TestCase):
                        secure=True, http_only=True)
         res.delete_cookie('foo8', http_only=True)
         res.delete_cookie('foo9', path='/s')
+        with self.assertRaises(ValueError):
+            res.set_cookie('foo1', 'bar1\r\nSet-Cookie: foo2=bar2')
+        with self.assertRaises(ValueError):
+            res.set_cookie('foo1', 'bar1',
+                           domain='example.com\r\nSet-Cookie: foo2=bar2')
+        with self.assertRaises(ValueError):
+            res.set_cookie('foo1', 'bar1', path='/\r\nSet-Cookie: foo2=bar2')
+        with self.assertRaises(ValueError):
+            res.set_cookie('foo10', 'x;y', path='/')
         self.assertEqual(res.headers, {'Set-Cookie': [
             'foo1=bar1',
             'foo2=bar2; Path=/; Partitioned',