redbot 2.4.0__tar.gz → 2.4.2__tar.gz

{redbot-2.4.0/redbot.egg-info → redbot-2.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: redbot
-Version: 2.4.0
+Version: 2.4.2
 Summary: REDbot is lint for HTTP.
 Author-email: Mark Nottingham <mnot@mnot.net>
 License-Expression: MIT

{redbot-2.4.0 → redbot-2.4.2}/redbot/__init__.py

@@ -2,7 +2,7 @@
 This is the Resource Expert Droid.
 """
 
-__version__ = "2.4.0"
+__version__ = "2.4.2"
 __author__ = "Mark Nottingham <mnot@mnot.net>"
 __copyright__ = """\
 Copyright (c) 2008- Mark Nottingham

{redbot-2.4.0 → redbot-2.4.2}/redbot/resource/__init__.py

@@ -56,7 +56,7 @@ class HttpResource(RedFetcher):
         self.linked: List[Tuple[HttpResource, str]] = []  # linked HttpResources
         self._link_parser = link_parse.HTMLLinkParser(self.response, [self.process_link])
         if self.descend or config.getboolean("content_links", False):
-            self.response_content_processors.append(self._link_parser.feed_bytes)
+            self.response.decoded.processors.append(self._link_parser.feed_bytes)
 
     def run_active_checks(self) -> None:
         """

{redbot-2.4.0 → redbot-2.4.2}/redbot/resource/link_parse.py

@@ -13,6 +13,7 @@ from httplint.message import HttpMessageLinter
 from httplint.syntax import rfc9110
 
 DEFAULT_ENCODING = "utf-8"
+MAX_FEED_BYTES = 2 * 1024 * 1024
 
 
 class HTMLLinkParser(HTMLParser):
@@ -57,6 +58,7 @@ class HTMLLinkParser(HTMLParser):
         self.errors = 0
         self.last_err_pos: int = 0
         self.ok = True
+        self.bytes_fed = 0
         HTMLParser.__init__(self)
 
     def __getstate__(self) -> Dict[str, Any]:
@@ -65,6 +67,10 @@ class HTMLLinkParser(HTMLParser):
     def feed_bytes(self, bchunk: bytes) -> None:
         "Feed a given chunk of bytes to the parser"
         if self.ok:
+            self.bytes_fed += len(bchunk)
+            if self.bytes_fed > MAX_FEED_BYTES:
+                self.ok = False
+                return
             encoding = self.message.character_encoding or DEFAULT_ENCODING
             decoded = bchunk.decode(encoding, "ignore")
             self.feed(decoded)

{redbot-2.4.0 → redbot-2.4.2}/redbot/webui/handlers/run_test.py

@@ -10,12 +10,13 @@ from urllib.parse import urlencode, urlsplit
 
 import thor
 import thor.events
+from httplint.util import iri_to_uri
 from markupsafe import escape
 
 from redbot.formatter import find_formatter
 from redbot.resource import HttpResource
 from redbot.resource.active_check import active_checks
-from redbot.type import RawHeaderListType, RedWebUiProtocol, StrHeaderListType
+from redbot.type import RawHeaderListType, RedWebUiProtocol
 from redbot.utils import e_url
 from redbot.webui.captcha import CaptchaHandler
 from redbot.webui.handlers.base import RequestHandler
@@ -25,6 +26,29 @@ from redbot.webui.saved_tests import init_save_file, save_test
 if TYPE_CHECKING:
     from redbot.formatter import Formatter
 
+_BAD_HEADER_NAME_CHARS = set('()<>@,;:\\"/[]?={} \t\r\n')
+
+
+def _validate_req_hdrs(raw: List[str]) -> Tuple[List[Tuple[str, str]], Optional[str]]:
+    """Parse and validate user-supplied req_hdr entries.
+
+    Returns (headers, error). When error is not None, headers is meaningless
+    and the test should not run.
+    """
+    headers: List[Tuple[str, str]] = []
+    for entry in raw:
+        if ":" not in entry:
+            return [], f"Request header {entry!r} is missing a colon."
+        name, value = entry.split(":", 1)
+        if not name:
+            return [], "Request header field name is empty."
+        if any(c in _BAD_HEADER_NAME_CHARS or ord(c) < 33 or ord(c) > 126 for c in name):
+            return [], f"Request header field name {name!r} contains invalid characters."
+        if "\r" in value or "\n" in value:
+            return [], f"Request header {name!r} value contains CR or LF."
+        headers.append((name, value))
+    return headers, None
+
 
 class RunTestHandler(RequestHandler):
     """
@@ -59,11 +83,15 @@ class RunTestHandler(RequestHandler):
         """
         test_id = init_save_file(ui)
         test_uri = ui.query_string.get("uri", [""])[0]
-        test_req_hdrs: StrHeaderListType = [
-            cast(Tuple[str, str], tuple(h.split(":", 1)))
-            for h in ui.query_string.get("req_hdr", [])
-            if ":" in h
-        ]
+        try:
+            iri_to_uri(test_uri).encode("ascii")
+        except (ValueError, UnicodeError):
+            ui.error_response(b"400", b"Bad Request", "Request URI is malformed.")
+            return
+        test_req_hdrs, hdr_error = _validate_req_hdrs(ui.query_string.get("req_hdr", []))
+        if hdr_error:
+            ui.error_response(b"400", b"Bad Request", hdr_error)
+            return
         descend = "descend" in ui.query_string
 
         top_resource = HttpResource(ui.config, descend=descend)

{redbot-2.4.0 → redbot-2.4.2/redbot.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: redbot
-Version: 2.4.0
+Version: 2.4.2
 Summary: REDbot is lint for HTTP.
 Author-email: Mark Nottingham <mnot@mnot.net>
 License-Expression: MIT