plain 0.68.0__py3-none-any.whl → 0.103.0__py3-none-any.whl

plain/http/multipartparser.py

@@ -5,24 +5,35 @@ Exposes one class, ``MultiPartParser``, which feeds chunks of uploaded data to
 file upload handlers for processing.
 """
 
+from __future__ import annotations
+
 import base64
 import binascii
 import collections
 import html
+from collections.abc import Iterator
+from typing import TYPE_CHECKING, Any
 
-from plain.exceptions import (
-    RequestDataTooBig,
-    SuspiciousMultipartForm,
-    TooManyFieldsSent,
-    TooManyFilesSent,
-)
+from plain.internal import internalcode
 from plain.internal.files.uploadhandler import SkipFile, StopFutureHandlers, StopUpload
 from plain.runtime import settings
 from plain.utils.datastructures import MultiValueDict
 from plain.utils.encoding import force_str
 from plain.utils.http import parse_header_parameters
+from plain.utils.module_loading import import_string
 from plain.utils.regex_helper import _lazy_re_compile
 
+from .exceptions import (
+    RequestDataTooBigError400,
+    SuspiciousMultipartFormError400,
+    TooManyFieldsSentError400,
+    TooManyFilesSentError400,
+)
+
+if TYPE_CHECKING:
+    from plain.http.request import Request
+    from plain.internal.files.uploadhandler import FileUploadHandler
+
 __all__ = ("MultiPartParser", "MultiPartParserError", "InputStreamExhausted")
 
 
@@ -38,10 +49,10 @@ class InputStreamExhausted(Exception):
     pass
 
 
-RAW = "raw"
-FILE = "file"
-FIELD = "field"
-FIELD_TYPES = frozenset([FIELD, RAW])
+_RAW = "raw"
+_FILE = "file"
+_FIELD = "field"
+_FIELD_TYPES = frozenset([_FIELD, _RAW])
 
 
 class MultiPartParser:
@@ -54,22 +65,15 @@ class MultiPartParser:
 
     boundary_re = _lazy_re_compile(r"[ -~]{0,200}[!-~]")
 
-    def __init__(self, meta, input_data, upload_handlers, encoding=None):
+    def __init__(self, request: Request):
         """
         Initialize the MultiPartParser object.
 
-        :meta:
-            The standard ``meta`` dictionary in Plain request objects.
-        :input_data:
-            The raw post data, as a file-like object.
-        :upload_handlers:
-            A list of UploadHandler instances that perform operations on the
-            uploaded data.
-        :encoding:
-            The encoding with which to treat the incoming data.
+        :request:
+            The HTTP request object (used for headers and as the input stream).
         """
         # Content-Type should contain multipart and the boundary information.
-        content_type = meta.get("CONTENT_TYPE", "")
+        content_type = request.content_type or ""
         if not content_type.startswith("multipart/"):
             raise MultiPartParserError(f"Invalid Content-Type: {content_type}")
 
@@ -80,39 +84,36 @@ class MultiPartParser:
                 f"Invalid non-ASCII Content-Type in multipart: {force_str(content_type)}"
             )
 
-        # Parse the header to get the boundary to split the parts.
-        _, opts = parse_header_parameters(content_type)
-        boundary = opts.get("boundary")
+        # Get the boundary from parsed content type parameters.
+        content_params = request.content_params or {}
+        boundary = content_params.get("boundary")
         if not boundary or not self.boundary_re.fullmatch(boundary):
             raise MultiPartParserError(
                 f"Invalid boundary in multipart: {force_str(boundary)}"
             )
 
-        # Content-Length should contain the length of the body we are about
-        # to receive.
-        try:
-            content_length = int(meta.get("CONTENT_LENGTH", 0))
-        except (ValueError, TypeError):
-            content_length = 0
-
+        content_length = request.content_length
         if content_length < 0:
             # This means we shouldn't continue...raise an error.
             raise MultiPartParserError(f"Invalid content length: {content_length!r}")
 
         self._boundary = boundary.encode("ascii")
-        self._input_data = input_data
+        self._request = request
+
+        # Create upload handlers for this parsing session
+        self._upload_handlers: list[FileUploadHandler] = [
+            import_string(handler)(request) for handler in settings.FILE_UPLOAD_HANDLERS
+        ]
 
         # For compatibility with low-level network APIs (with 32-bit integers),
         # the chunk size should be < 2^31, but still divisible by 4.
-        possible_sizes = [x.chunk_size for x in upload_handlers if x.chunk_size]
+        possible_sizes = [x.chunk_size for x in self._upload_handlers if x.chunk_size]
         self._chunk_size = min([2**31 - 4] + possible_sizes)
 
-        self._meta = meta
-        self._encoding = encoding or settings.DEFAULT_CHARSET
+        self._encoding = request.encoding or settings.DEFAULT_CHARSET
         self._content_length = content_length
-        self._upload_handlers = upload_handlers
 
-    def parse(self):
+    def parse(self) -> tuple[Any, MultiValueDict]:
         # Call the actual parse routine and close all open files in case of
         # errors. This is needed because if exceptions are thrown the
         # MultiPartParser will not be garbage collected immediately and
@@ -128,7 +129,7 @@ class MultiPartParser:
                         fileobj.close()
             raise
 
-    def _parse(self):
+    def _parse(self) -> tuple[Any, MultiValueDict]:
         """
         Parse the POST data and break it into a FILES MultiValueDict and a POST
         MultiValueDict.
@@ -149,9 +150,7 @@ class MultiPartParser:
         # This allows overriding everything if need be.
         for handler in handlers:
             result = handler.handle_raw_input(
-                self._input_data,
-                self._meta,
-                self._content_length,
+                self._request,
                 self._boundary,
                 encoding,
             )
@@ -164,7 +163,7 @@ class MultiPartParser:
         self._files = MultiValueDict()
 
         # Instantiate the parser and stream:
-        stream = LazyStream(ChunkIter(self._input_data, self._chunk_size))
+        stream = LazyStream(ChunkIter(self._request, self._chunk_size))
 
         # Whether or not to signal a file-completion at the beginning of the loop.
         old_field_name = None
@@ -192,7 +191,7 @@ class MultiPartParser:
                     uploaded_file = True
 
                 if (
-                    item_type in FIELD_TYPES
+                    item_type in _FIELD_TYPES
                     and settings.DATA_UPLOAD_MAX_NUMBER_FIELDS is not None
                 ):
                     # Avoid storing more than DATA_UPLOAD_MAX_NUMBER_FIELDS.
@@ -200,7 +199,7 @@ class MultiPartParser:
                     # 2 accounts for empty raw fields before and after the
                     # last boundary.
                     if settings.DATA_UPLOAD_MAX_NUMBER_FIELDS + 2 < num_post_keys:
-                        raise TooManyFieldsSent(
+                        raise TooManyFieldsSentError400(
                             "The number of GET/POST parameters exceeded "
                             "settings.DATA_UPLOAD_MAX_NUMBER_FIELDS."
                         )
@@ -216,7 +215,7 @@ class MultiPartParser:
                     transfer_encoding = transfer_encoding[0].strip()
                 field_name = force_str(field_name, encoding, errors="replace")
 
-                if item_type == FIELD:
+                if item_type == _FIELD:
                     # Avoid reading more than DATA_UPLOAD_MAX_MEMORY_SIZE.
                     if settings.DATA_UPLOAD_MAX_MEMORY_SIZE is not None:
                         read_size = (
@@ -242,7 +241,7 @@ class MultiPartParser:
                         settings.DATA_UPLOAD_MAX_MEMORY_SIZE is not None
                         and num_bytes_read > settings.DATA_UPLOAD_MAX_MEMORY_SIZE
                     ):
-                        raise RequestDataTooBig(
+                        raise RequestDataTooBigError400(
                             "Request body exceeded "
                             "settings.DATA_UPLOAD_MAX_MEMORY_SIZE."
                         )
@@ -250,14 +249,14 @@ class MultiPartParser:
                     self._post.appendlist(
                         field_name, force_str(data, encoding, errors="replace")
                     )
-                elif item_type == FILE:
+                elif item_type == _FILE:
                     # Avoid storing more than DATA_UPLOAD_MAX_NUMBER_FILES.
                     num_files += 1
                     if (
                         settings.DATA_UPLOAD_MAX_NUMBER_FILES is not None
                         and num_files > settings.DATA_UPLOAD_MAX_NUMBER_FILES
                     ):
-                        raise TooManyFilesSent(
+                        raise TooManyFilesSentError400(
                             "The number of files exceeded "
                             "settings.DATA_UPLOAD_MAX_NUMBER_FILES."
                         )
@@ -276,7 +275,12 @@ class MultiPartParser:
                     charset = content_type_extra.get("charset")
 
                     try:
-                        content_length = int(meta_data.get("content-length")[0])
+                        content_length_value = meta_data.get("content-length")
+                        content_length = (
+                            int(content_length_value[0])
+                            if content_length_value
+                            else None
+                        )
                     except (IndexError, TypeError, ValueError):
                         content_length = None
 
@@ -333,7 +337,7 @@ class MultiPartParser:
                     except SkipFile:
                         self._close_files()
                         # Just use up the rest of this file...
-                        exhaust(field_stream)
+                        _exhaust(field_stream)
                     else:
                         # Handle file upload completions on next iteration.
                         old_field_name = field_name
@@ -344,17 +348,17 @@ class MultiPartParser:
                     # after the other boundaries). This branch is usually not
                     # reached at all, because a missing content-disposition
                     # header will skip the whole boundary.
-                    exhaust(field_stream)
+                    _exhaust(field_stream)
         except StopUpload as e:
             self._close_files()
             if not e.connection_reset:
-                exhaust(self._input_data)
+                _exhaust(self._request)
         else:
             if not uploaded_file:
                 for handler in handlers:
                     handler.upload_interrupted()
             # Make sure that the request data is all fed
-            exhaust(self._input_data)
+            _exhaust(self._request)
 
         # Signal that the upload has completed.
         # any() shortcircuits if a handler's upload_complete() returns a value.
@@ -362,7 +366,7 @@ class MultiPartParser:
         self._post._mutable = False
         return self._post, self._files
 
-    def handle_file_complete(self, old_field_name, counters):
+    def handle_file_complete(self, old_field_name: str, counters: list[int]) -> None:
         """
         Handle all the signaling that takes place when a file is complete.
         """
@@ -376,7 +380,7 @@ class MultiPartParser:
                 )
                 break
 
-    def sanitize_file_name(self, file_name):
+    def sanitize_file_name(self, file_name: str) -> str | None:
         """
         Sanitize the filename of an upload.
 
@@ -399,16 +403,17 @@ class MultiPartParser:
             return None
         return file_name
 
-    def _close_files(self):
+    def _close_files(self) -> None:
         # Free up all file handles.
         # FIXME: this currently assumes that upload handlers store the file as 'file'
         # We should document that...
         # (Maybe add handler.free_file to complement new_file)
         for handler in self._upload_handlers:
             if hasattr(handler, "file"):
-                handler.file.close()
+                handler.file.close()  # type: ignore[union-attr]
 
 
+@internalcode
 class LazyStream:
     """
     The LazyStream wrapper allows one to get and "unget" bytes from a stream.
@@ -418,7 +423,7 @@ class LazyStream:
     variable in case you need to "unget" some bytes.
     """
 
-    def __init__(self, producer, length=None):
+    def __init__(self, producer: Iterator[bytes], length: int | None = None):
         """
         Every LazyStream must have a producer when instantiated.
 
@@ -433,11 +438,11 @@ class LazyStream:
         self._remaining = length
         self._unget_history = []
 
-    def tell(self):
+    def tell(self) -> int:
         return self.position
 
-    def read(self, size=None):
-        def parts():
+    def read(self, size: int | None = None) -> bytes:
+        def parts() -> Iterator[bytes]:
             remaining = self._remaining if size is None else size
             # do the whole thing in one shot if no limit was provided.
             if remaining is None:
@@ -462,7 +467,7 @@ class LazyStream:
 
         return b"".join(parts())
 
-    def __next__(self):
+    def __next__(self) -> bytes:
         """
         Used when the exact number of bytes to read is unimportant.
 
@@ -478,19 +483,19 @@ class LazyStream:
         self.position += len(output)
         return output
 
-    def close(self):
+    def close(self) -> None:
         """
         Used to invalidate/disable this lazy stream.
 
         Replace the producer with an empty list. Any leftover bytes that have
         already been read will still be reported upon read() and/or next().
         """
-        self._producer = []
+        self._producer = iter([])
 
-    def __iter__(self):
+    def __iter__(self) -> LazyStream:
         return self
 
-    def unget(self, bytes):
+    def unget(self, bytes: bytes) -> None:
         """
         Place bytes back onto the front of the lazy stream.
 
@@ -503,7 +508,7 @@ class LazyStream:
         self.position -= len(bytes)
         self._leftover = bytes + self._leftover
 
-    def _update_unget_history(self, num_bytes):
+    def _update_unget_history(self, num_bytes: int) -> None:
         """
         Update the unget history as a sanity check to see if we've pushed
         back the same number of bytes in one chunk. If we keep ungetting the
@@ -521,24 +526,25 @@ class LazyStream:
         )
 
         if number_equal > 40:
-            raise SuspiciousMultipartForm(
+            raise SuspiciousMultipartFormError400(
                 "The multipart parser got stuck, which shouldn't happen with"
                 " normal uploaded files. Check for malicious upload activity;"
                 " if there is none, report this to the Plain developers."
             )
 
 
+@internalcode
 class ChunkIter:
     """
     An iterable that will yield chunks of data. Given a file-like object as the
     constructor, yield chunks of read operations from that object.
     """
 
-    def __init__(self, flo, chunk_size=64 * 1024):
+    def __init__(self, flo: Any, chunk_size: int = 64 * 1024):
         self.flo = flo
         self.chunk_size = chunk_size
 
-    def __next__(self):
+    def __next__(self) -> bytes:
         try:
             data = self.flo.read(self.chunk_size)
         except InputStreamExhausted:
@@ -548,29 +554,31 @@ class ChunkIter:
         else:
             raise StopIteration()
 
-    def __iter__(self):
+    def __iter__(self) -> ChunkIter:
         return self
 
 
+@internalcode
 class InterBoundaryIter:
     """
     A Producer that will iterate over boundaries.
     """
 
-    def __init__(self, stream, boundary):
+    def __init__(self, stream: LazyStream, boundary: bytes):
         self._stream = stream
         self._boundary = boundary
 
-    def __iter__(self):
+    def __iter__(self) -> InterBoundaryIter:
         return self
 
-    def __next__(self):
+    def __next__(self) -> LazyStream:
         try:
             return LazyStream(BoundaryIter(self._stream, self._boundary))
         except InputStreamExhausted:
             raise StopIteration()
 
 
+@internalcode
 class BoundaryIter:
     """
     A Producer that is sensitive to boundaries.
@@ -583,7 +591,7 @@ class BoundaryIter:
     StopIteration exception.
     """
 
-    def __init__(self, stream, boundary):
+    def __init__(self, stream: LazyStream, boundary: bytes):
         self._stream = stream
         self._boundary = boundary
         self._done = False
@@ -598,10 +606,10 @@ class BoundaryIter:
             raise InputStreamExhausted()
         self._stream.unget(unused_char)
 
-    def __iter__(self):
+    def __iter__(self) -> BoundaryIter:
         return self
 
-    def __next__(self):
+    def __next__(self) -> bytes:
         if self._done:
             raise StopIteration()
 
@@ -642,7 +650,7 @@ class BoundaryIter:
                 stream.unget(chunk[-rollback:])
                 return chunk[:-rollback]
 
-    def _find_boundary(self, data):
+    def _find_boundary(self, data: bytes) -> tuple[int, int] | None:
         """
         Find a multipart boundary in data.
 
@@ -667,7 +675,7 @@ class BoundaryIter:
             return end, next
 
 
-def exhaust(stream_or_iterable):
+def _exhaust(stream_or_iterable: Any) -> None:
     """Exhaust an iterator or stream."""
     try:
         iterator = iter(stream_or_iterable)
@@ -676,7 +684,9 @@ def exhaust(stream_or_iterable):
     collections.deque(iterator, maxlen=0)  # consume iterator quickly.
 
 
-def parse_boundary_stream(stream, max_header_size):
+def _parse_boundary_stream(
+    stream: LazyStream, max_header_size: int
+) -> tuple[str, dict[str, Any], LazyStream]:
     """
     Parse one and exactly one stream that encapsulates a boundary.
     """
@@ -694,7 +704,7 @@ def parse_boundary_stream(stream, max_header_size):
         # we find no header, so we just mark this fact and pass on
         # the stream verbatim
         stream.unget(chunk)
-        return (RAW, {}, stream)
+        return (_RAW, {}, stream)
 
     header = chunk[:header_end]
 
@@ -702,7 +712,7 @@ def parse_boundary_stream(stream, max_header_size):
     # well as throwing away the CRLFCRLF bytes from above.
     stream.unget(chunk[header_end + 4 :])
 
-    TYPE = RAW
+    TYPE = _RAW
     outdict = {}
 
     # Eliminate blank lines
@@ -717,25 +727,26 @@ def parse_boundary_stream(stream, max_header_size):
             continue
 
         if name == "content-disposition":
-            TYPE = FIELD
+            TYPE = _FIELD
             if params.get("filename"):
-                TYPE = FILE
+                TYPE = _FILE
 
         outdict[name] = value, params
 
-    if TYPE == RAW:
+    if TYPE == _RAW:
         stream.unget(chunk)
 
     return (TYPE, outdict, stream)
 
 
+@internalcode
 class Parser:
-    def __init__(self, stream, boundary):
+    def __init__(self, stream: LazyStream, boundary: bytes):
         self._stream = stream
         self._separator = b"--" + boundary
 
-    def __iter__(self):
+    def __iter__(self) -> Iterator[tuple[str, dict[str, Any], LazyStream]]:
         boundarystream = InterBoundaryIter(self._stream, self._separator)
         for sub_stream in boundarystream:
             # Iterate over each part
-            yield parse_boundary_stream(sub_stream, 1024)
+            yield _parse_boundary_stream(sub_stream, 1024)