pathapi 0.1.0__py3-none-any.whl

pathapi/http/testing/suite/test_client_redirect_origin.py

@@ -0,0 +1,134 @@
+"""`Authorization` belongs to the origin a request was made for. A request
+asked again after a redirect (`HTTPClient.redirect()`) leaves it off when the
+target is another scheme, host or port and keeps it within the origin,
+whichever transport sends."""
+
+import errno
+
+import pytest
+
+from pathapi.http import HTTPClient, HTTPTransport
+from transport_wire import Wire, make_authority, response
+
+pytestmark = pytest.mark.usefixtures("http_transport_kind")
+
+TOKEN = "Bearer SECRET-TOKEN"
+
+
+def sees_no_credential(wire):
+    return [r.header("Authorization") for r in wire.requests] == [None] * len(
+        wire.requests
+    )
+
+
+def first_answer(client, method, url, **kwargs):
+    """The redirect that `url` answers, unfollowed."""
+    answer = client.request(method, url, allow_redirects=False, **kwargs)
+    assert answer.status in (301, 302)
+    answer.close()
+    return answer
+
+
+@pytest.fixture
+def origins():
+    """`home` redirects every HEAD and GET to `away`; both answer a file of
+    five bytes."""
+    with Wire(
+        lambda r: response(200, {"Content-Type": "text/plain"}, b"hello")
+    ) as away:
+
+        def home_script(request):
+            return response(302, {"Location": away.url + "/elsewhere"}, reason="Found")
+
+        with Wire(home_script) as home:
+            yield home, away
+
+
+@pytest.mark.parametrize("method", ["GET", "HEAD"])
+@pytest.mark.parametrize("how", ["header", "auth"])
+def test_a_request_asked_again_at_another_origin_does_not_carry_authorization(
+    origins, method, how
+):
+    home, away = origins
+    headers = {"X-Api-Key": "K"}
+    auth = None
+    if how == "header":
+        headers["Authorization"] = TOKEN
+    else:
+        auth = ("user", "s3cr3t")
+    with HTTPClient() as client:
+        url = home.url + "/f"
+        moved = first_answer(client, method, url, headers=headers, auth=auth)
+        again = client.redirect(method, url, moved, headers=headers, auth=auth)
+        assert again.status == 200
+        again.close()
+    # The credential reached the origin it was given for, and not the other.
+    assert home.requests[0].header("Authorization") is not None
+    assert away.requests and sees_no_credential(away)
+    # Only Authorization is left off.
+    assert away.requests[0].header("X-Api-Key") == "K"
+    assert away.requests[0].target == "/elsewhere"
+
+
+def test_a_request_asked_again_within_the_origin_keeps_authorization():
+    def script(request):
+        if request.target == "/d":
+            return response(301, {"Location": "/d/"}, reason="Moved")
+        return response(200, {"Content-Type": "text/html"}, b"<html></html>")
+
+    with Wire(script) as wire:
+        with HTTPClient(headers={"Authorization": TOKEN}) as client:
+            url = wire.url + "/d"
+            moved = first_answer(client, "HEAD", url)
+            client.redirect("HEAD", url, moved).close()
+    assert [r.target for r in wire.requests] == ["/d", "/d/"]
+    assert [r.header("Authorization") for r in wire.requests] == [TOKEN, TOKEN]
+
+
+def test_a_second_redirect_back_to_the_origin_does_not_bring_it_back():
+    with Wire() as wire:
+        with Wire(lambda r: response(302, {"Location": wire.url + "/home"})) as away:
+
+            def script(request):
+                if request.target == "/start":
+                    return response(302, {"Location": away.url + "/away"})
+                return response(200, {}, b"ok")
+
+            wire.script = script
+            with HTTPClient(headers={"Authorization": TOKEN}) as client:
+                url = wire.url + "/start"
+                moved = first_answer(client, "GET", url)
+                client.redirect("GET", url, moved).read()
+    assert [r.header("Authorization") for r in wire.requests] == [TOKEN, None]
+    assert sees_no_credential(away)
+
+
+def test_a_redirect_from_https_to_plain_http_does_not_carry_authorization(tmp_path):
+    authority = make_authority(tmp_path, "127.0.0.1", "localhost")
+    with Wire(lambda r: response(200, {}, b"plain")) as plain:
+        secure_script = lambda r: response(  # noqa: E731
+            302, {"Location": plain.url + "/downgraded"}, reason="Found"
+        )
+        with Wire(secure_script, tls=authority.server_context()) as secure:
+            transport = HTTPTransport(ssl_context=authority.client_context())
+            client = HTTPClient(transport, headers={"Authorization": TOKEN})
+            try:
+                assert client.request("GET", secure.url + "/f").read() == b"plain"
+            finally:
+                transport.close()
+    assert secure.requests[0].header("Authorization") == TOKEN
+    assert plain.requests and sees_no_credential(plain)
+
+
+def test_a_re_request_with_no_usable_location_is_a_refused_redirect():
+    with Wire(lambda r: response(302, {"Location": "ftp://127.0.0.1/x"})) as wire:
+        with HTTPClient() as client:
+            url = wire.url + "/f"
+            moved = first_answer(client, "GET", url)
+            with pytest.raises(OSError) as excinfo:
+                client.redirect("GET", url, moved)
+    assert excinfo.value.errno == errno.EIO
+    assert "HTTP 302" in str(excinfo.value) and "no usable Location" in str(
+        excinfo.value
+    )
+    assert len(wire.requests) == 1

pathapi/http/testing/suite/test_client_redirects.py

@@ -0,0 +1,231 @@
+"""Redirects and credentials above a transport: the client follows a `GET`,
+`HEAD` or `OPTIONS` redirect itself and takes `Authorization` off when the
+scheme, host or port changes, whichever transport sends the requests."""
+
+import errno
+
+import pytest
+
+from pathapi.http import HTTPClient
+from transport_fakes import FakeTransport, reply
+from transport_wire import Reply, Wire, response
+
+AUTH = {"Authorization": "Bearer TOKEN-1"}
+
+
+def redirect(location, status=302):
+    return response(status, {"Location": location}, reason="Found")
+
+
+def sent_authorization(request):
+    return request.header("Authorization")
+
+
+# --- across a real transport -------------------------------------------------
+
+
+def test_authorization_goes_with_a_redirect_that_stays_on_the_origin(http_transport):
+    def script(request):
+        return (
+            redirect("/final") if request.target == "/start" else response(body=b"ok")
+        )
+
+    with Wire(script) as wire:
+        client = HTTPClient(http_transport, headers=AUTH)
+        reply_ = client.request("GET", wire.url + "/start")
+        assert reply_.read() == b"ok"
+    assert [sent_authorization(r) for r in wire.requests] == ["Bearer TOKEN-1"] * 2
+
+
+def test_authorization_is_dropped_by_a_redirect_to_another_port(http_transport):
+    with Wire() as elsewhere:
+
+        def script(request):
+            return redirect(elsewhere.url + "/landing")
+
+        with Wire(script) as wire:
+            client = HTTPClient(http_transport, headers={**AUTH, "X-Api-Key": "K"})
+            client.request("GET", wire.url + "/start").read()
+    assert sent_authorization(wire.requests[0]) == "Bearer TOKEN-1"
+    (landing,) = elsewhere.requests
+    assert landing.target == "/landing"
+    assert sent_authorization(landing) is None
+    # Only Authorization is dropped.
+    assert landing.header("X-Api-Key") == "K"
+
+
+def test_basic_credentials_are_dropped_by_a_redirect_like_any_authorization(
+    http_transport,
+):
+    with Wire() as elsewhere:
+        with Wire(lambda r: redirect(elsewhere.url + "/landing")) as wire:
+            client = HTTPClient(http_transport)
+            client.request("GET", wire.url + "/s", auth=("alice", "s3cr3t")).read()
+    assert sent_authorization(wire.requests[0]).startswith("Basic ")
+    assert sent_authorization(elsewhere.requests[0]) is None
+
+
+def test_authorization_does_not_come_back_when_a_redirect_returns_to_the_origin(
+    http_transport,
+):
+    with Wire() as wire:
+        with Wire(lambda r: redirect(wire.url + "/back")) as away:
+
+            def script(request):
+                if request.target == "/start":
+                    return redirect(away.url + "/away")
+                return response(body=b"home")
+
+            wire.script = script
+            client = HTTPClient(http_transport, headers=AUTH)
+            client.request("GET", wire.url + "/start").read()
+    assert sent_authorization(wire.requests[0]) == "Bearer TOKEN-1"
+    assert sent_authorization(wire.requests[1]) is None
+
+
+def test_a_303_becomes_a_get_and_a_307_keeps_the_method(http_transport):
+    def script(request):
+        if request.target == "/see":
+            return redirect("/there", 303)
+        if request.target == "/again":
+            return redirect("/there", 307)
+        return response(body=b"there")
+
+    with Wire(script) as wire:
+        client = HTTPClient(http_transport)
+        client.request("OPTIONS", wire.url + "/see").read()
+        client.request("OPTIONS", wire.url + "/again").read()
+    assert [(r.method, r.target) for r in wire.requests] == [
+        ("OPTIONS", "/see"),
+        ("GET", "/there"),
+        ("OPTIONS", "/again"),
+        ("OPTIONS", "/there"),
+    ]
+
+
+def test_a_redirect_loop_stops_after_thirty_redirects(http_transport):
+    with Wire(lambda r: redirect("/loop")) as wire:
+        client = HTTPClient(http_transport)
+        with pytest.raises(OSError) as excinfo:
+            client.request("GET", wire.url + "/loop")
+    assert len(wire.requests) == 31
+    assert "30 redirects" in str(excinfo.value)
+
+
+@pytest.mark.parametrize(
+    "location",
+    [
+        "/a\x01b",
+        "ftp://127.0.0.1/x",
+        "file:///etc/hosts",
+        "javascript:alert(1)",
+    ],
+)
+def test_a_location_that_is_not_an_http_url_is_a_refused_redirect(
+    http_transport, location
+):
+    with Wire(lambda r: redirect(location)) as wire:
+        client = HTTPClient(http_transport)
+        with pytest.raises(OSError) as excinfo:
+            client.request("GET", wire.url + "/start")
+    assert excinfo.value.errno == errno.EIO
+    assert "HTTP 302" in str(excinfo.value) and "no usable Location" in str(
+        excinfo.value
+    )
+    assert len(wire.requests) == 1
+
+
+def test_userinfo_in_a_location_is_not_sent(http_transport):
+    with Wire() as elsewhere:
+        target = f"http://mallory:LEAKED@127.0.0.1:{elsewhere.port}/landing"
+        with Wire(lambda r: redirect(target)) as wire:
+            HTTPClient(http_transport).request("GET", wire.url + "/s").read()
+    assert elsewhere.requests[0].target == "/landing"
+    assert sent_authorization(elsewhere.requests[0]) is None
+
+
+def test_allow_redirects_false_returns_the_redirect(http_transport):
+    with Wire(lambda r: redirect("/there")) as wire:
+        reply_ = HTTPClient(http_transport).request(
+            "GET", wire.url + "/start", allow_redirects=False
+        )
+        assert (reply_.status, reply_.headers["Location"]) == (302, "/there")
+        reply_.close()
+    assert len(wire.requests) == 1
+
+
+# --- the scheme is part of the origin ----------------------------------------
+
+
+def fake_redirecting(location):
+    def answer(method, url, **kwargs):
+        if url == "http://h:443/x":
+            return reply(302, headers={"Location": location}, url=url)
+        return reply(200, b"final", url=url)
+
+    return FakeTransport(handler=answer)
+
+
+@pytest.mark.parametrize(
+    "location, kept",
+    [
+        ("https://h/x", False),  # same host and port number, another scheme
+        ("http://h:444/x", False),
+        ("http://other/x", False),
+        ("http://h:443/y", True),
+        ("//h:443/y", True),
+    ],
+)
+def test_authorization_follows_only_a_redirect_that_keeps_scheme_host_and_port(
+    location, kept
+):
+    transport = fake_redirecting(location)
+    HTTPClient(transport, headers=AUTH).request("GET", "http://h:443/x").read()
+    assert len(transport.sent) == 2
+    assert ("Authorization" in transport.sent[1].headers) is kept
+
+
+def test_a_header_with_a_line_break_is_refused_before_any_transport_call():
+    transport = FakeTransport(default=reply(200))
+    client = HTTPClient(transport, headers={"X-A": "1\r\nX-B: 2"})
+    with pytest.raises(ValueError):
+        client.request("GET", "http://h/x")
+    with pytest.raises(ValueError):
+        HTTPClient(transport).request("GET", "http://h/x", headers={"X-A": "1\n2"})
+    with pytest.raises(ValueError):
+        HTTPClient(transport).request("GET", "http://h/x\r\nX-A: 1")
+    assert transport.sent == []
+
+
+# --- a Location the URL check refuses ----------------------------------------------
+
+REFUSED_LOCATIONS = [
+    "http://127.0.0.1:99999/x",  # a port out of range
+    "http://127.0.0.1:port/x",  # a port that is not a number
+    "http://a\u3002\u3002b/x",  # a host name with an empty label
+    "http://" + "\u00e9" * 70 + "/x",  # a label too long to be a name
+    "http://[::1/x",  # an unclosed address
+]
+
+
+@pytest.mark.parametrize("location", REFUSED_LOCATIONS)
+def test_a_location_the_url_check_refuses_is_oserror_never_valueerror(
+    http_transport_kind, location
+):
+    raw = (
+        "HTTP/1.1 302 Found\r\nLocation: " + location + "\r\nContent-Length: 0\r\n\r\n"
+    ).encode("utf-8")
+    with Wire(lambda r: Reply(raw)) as wire:
+        with HTTPClient() as client:
+            try:
+                client.request("GET", wire.url + "/f").close()
+            except ValueError:
+                raise AssertionError("a ValueError escaped") from None
+            except OSError as error:
+                # The refused reply is named by its status; `requests` reads a
+                # Location it cannot parse before this library sees the reply.
+                assert error.errno == errno.EIO
+                assert "HTTP 302" in str(error) or "could not be read" in str(error)
+            else:
+                raise AssertionError("the redirect was followed")
+    assert len(wire.requests) == 1

pathapi/http/testing/suite/test_client_reply_limits.py

@@ -0,0 +1,201 @@
+"""How much of a reply the library reads. A reply read whole for its status or
+for a small document is held to `MAX_REPLY_BYTES`, counted in DECODED bytes,
+whichever transport sent it; one nobody looks at is read up to that limit and
+dropped; and a connection whose reply was longer is not kept."""
+
+import errno
+import gzip
+
+import pytest
+
+import pathapi.http as http
+from pathapi.http import (
+    HTTPClient,
+    drop_body,
+    json_body,
+    read_limited,
+)
+from transport_wire import Wire, response, wait_until
+
+pytestmark = pytest.mark.usefixtures("http_transport_kind")
+
+CAP = 64 * 1024
+INFLATED = bytes(1024 * 1024)  # 16 times the cap, a kilobyte on the wire
+BOMB = gzip.compress(INFLATED)
+CODED = {"Content-Encoding": "gzip"}
+
+
+@pytest.fixture(autouse=True)
+def small_cap(monkeypatch):
+    monkeypatch.setattr(http, "MAX_REPLY_BYTES", CAP)
+
+
+def long_reply(status=200, extra=None):
+    """A reply whose body is three times the limit on the wire as well."""
+    return response(status, extra or {}, b"x" * (3 * CAP))
+
+
+def bomb(status=200, extra=None):
+    return response(status, {**CODED, **(extra or {})}, BOMB)
+
+
+def test_the_setting_is_read_where_it_takes_effect():
+    from pathapi.http import _settings
+
+    assert _settings.MAX_REPLY_BYTES == CAP == http.MAX_REPLY_BYTES
+
+
+def test_the_default_limit_is_eight_mebibytes(monkeypatch):
+    monkeypatch.undo()
+    assert http.MAX_REPLY_BYTES == 8 * 1024 * 1024
+
+
+# --- replies nobody looks at ---------------------------------------------------------
+
+
+def test_a_dropped_reply_over_the_limit_does_not_keep_its_connection():
+    with Wire(lambda r: long_reply(201)) as wire:
+        with HTTPClient() as client:
+            drop_body(
+                client.request("PUT", wire.url + "/file", data=b"data", stream=True)
+            )
+            assert wait_until(lambda: wire.closed == [0])
+            drop_body(
+                client.request("PUT", wire.url + "/file", data=b"again", stream=True)
+            )
+    assert wire.connections == 2
+    assert [r.body for r in wire.requests] == [b"data", b"again"]
+
+
+def test_a_dropped_small_reply_is_read_so_the_connection_serves_the_next_one():
+    with Wire(lambda r: response(201, {}, b"x" * 1000)) as wire:
+        with HTTPClient() as client:
+            drop_body(
+                client.request("PUT", wire.url + "/file", data=b"one", stream=True)
+            )
+            drop_body(
+                client.request("PUT", wire.url + "/file", data=b"two", stream=True)
+            )
+    assert wire.connections == 1
+
+
+def test_a_coded_reply_is_dropped_without_inflating_it_whole():
+    with Wire(lambda r: bomb(201)) as wire:
+        with HTTPClient() as client:
+            for body in (b"data", b"again"):
+                reply = client.request(
+                    "PUT", wire.url + "/file", data=body, stream=True
+                )
+                drop_body(reply)
+    assert [r.body for r in wire.requests] == [b"data", b"again"]
+
+
+def test_the_limit_of_a_dropped_reply_can_be_given_in_the_call():
+    with Wire(lambda r: long_reply(200)) as wire:
+        with HTTPClient() as client:
+            for _ in range(2):
+                reply = client.request("GET", wire.url + "/file", stream=True)
+                drop_body(reply, 10 * CAP)
+    assert wire.connections == 1
+
+
+# --- replies read for what they say ----------------------------------------------------
+
+
+def test_a_reply_over_the_limit_is_efbig_counted_in_decoded_bytes():
+    with Wire(lambda r: bomb(207)) as wire:
+        with HTTPClient() as client:
+            reply = client.request("GET", wire.url + "/dir/", stream=True)
+            with pytest.raises(OSError) as excinfo:
+                read_limited(reply, "the directory")
+        # A kilobyte on the wire, so a check of the stated length would pass.
+        assert len(BOMB) < CAP
+    assert excinfo.value.errno == errno.EFBIG
+    assert "the directory" in str(excinfo.value)
+    assert str(CAP) in str(excinfo.value)
+    assert "MAX_REPLY_BYTES" in str(excinfo.value)
+
+
+def test_a_plain_reply_that_is_too_long_is_efbig_as_well_and_not_waited_for():
+    with Wire(lambda r: long_reply(207)) as wire:
+        with HTTPClient() as client:
+            reply = client.request("GET", wire.url + "/dir/", stream=True)
+            with pytest.raises(OSError) as excinfo:
+                read_limited(reply, "the directory")
+            # Past the limit, the rest of the body is not waited for.
+            assert wait_until(lambda: wire.closed == [0])
+    assert excinfo.value.errno == errno.EFBIG
+
+
+def test_a_reply_within_the_limit_is_read_and_the_connection_is_kept():
+    with Wire(lambda r: response(207, {}, b"<multistatus/>")) as wire:
+        with HTTPClient() as client:
+            for _ in range(2):
+                reply = client.request("GET", wire.url + "/dir/", stream=True)
+                assert read_limited(reply, "the directory") == b"<multistatus/>"
+    assert wire.connections == 1
+
+
+def test_the_limit_is_read_each_time_so_raising_it_lets_a_larger_reply_through(
+    monkeypatch,
+):
+    with Wire(lambda r: response(207, {}, b" " * (2 * CAP))) as wire:
+        with HTTPClient() as client:
+            with pytest.raises(OSError):
+                read_limited(client.request("GET", wire.url + "/x", stream=True), "x")
+            monkeypatch.setattr(http, "MAX_REPLY_BYTES", 4 * CAP)
+            reply = client.request("GET", wire.url + "/x", stream=True)
+            assert len(read_limited(reply, "x")) == 2 * CAP
+
+
+def test_the_limit_of_a_read_can_be_given_in_the_call():
+    with Wire(lambda r: response(200, {}, b"x" * (2 * CAP))) as wire:
+        with HTTPClient() as client:
+            reply = client.request("GET", wire.url + "/x", stream=True)
+            assert len(read_limited(reply, "x", 4 * CAP)) == 2 * CAP
+
+
+def test_a_json_reply_over_the_limit_is_efbig():
+    with Wire(lambda r: bomb(200, {"Content-Type": "application/json"})) as wire:
+        with HTTPClient() as client:
+            reply = client.request("GET", wire.url + "/api", stream=True)
+            with pytest.raises(OSError) as excinfo:
+                json_body(reply, "the API")
+    assert excinfo.value.errno == errno.EFBIG
+
+
+def test_a_json_reply_within_the_limit_is_the_document():
+    with Wire(lambda r: response(200, {}, b'{"name": "n", "size": [1, 2]}')) as wire:
+        with HTTPClient() as client:
+            reply = client.request("GET", wire.url + "/api", stream=True)
+            assert json_body(reply, "the API") == {"name": "n", "size": [1, 2]}
+
+
+def test_a_reply_that_is_not_json_is_a_value_error():
+    with Wire(lambda r: response(200, {}, b"<html>")) as wire:
+        with HTTPClient() as client:
+            reply = client.request("GET", wire.url + "/api", stream=True)
+            with pytest.raises(ValueError):
+                json_body(reply, "the API")
+
+
+# --- the client's own reads --------------------------------------------------------------
+
+
+def test_the_client_reads_a_reply_whole_only_up_to_the_limit(http_transport):
+    with Wire(lambda r: bomb(200)) as wire:
+        client = HTTPClient(http_transport)
+        with pytest.raises(OSError) as excinfo:
+            client.request("GET", wire.url + "/x")
+        assert excinfo.value.errno == errno.EFBIG
+        assert wire.url in str(excinfo.value)
+        # A caller that reads the body itself is not limited.
+        with client.request("GET", wire.url + "/x", stream=True) as streamed:
+            assert len(streamed.read()) == len(INFLATED)
+
+
+def test_a_reply_within_the_limit_is_returned_read_and_closed(http_transport):
+    with Wire(lambda r: response(200, {}, b"abc")) as wire:
+        reply = HTTPClient(http_transport).request("GET", wire.url + "/x")
+        assert reply.read() == b"abc"
+        assert reply.read() == b""