servestatic 4.3.2__tar.gz → 4.3.4__tar.gz

{servestatic-4.3.2 → servestatic-4.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: servestatic
-Version: 4.3.2
+Version: 4.3.4
 Summary: Production-grade static file server for Python WSGI & ASGI.
 Project-URL: Changelog, https://archmonger.github.io/ServeStatic/latest/changelog/
 Project-URL: Documentation, https://archmonger.github.io/ServeStatic/
@@ -63,7 +63,28 @@ When using `ServeStatic`, best practices are automatically handled such as:
 - Proper handling of `Accept-Encoding` and `Vary` headers
 - Setting far-future cache headers for immutable static files.
 
-Visit the [documentation](https://archmonger.github.io/ServeStatic/) to get started or learn more about `ServeStatic` .
+
+## Quick Start
+
+Here is a short example of ASGI standalone mode:
+
+```python
+# filename: my_project.py
+from servestatic import ServeStaticASGI
+
+asgi_app = ServeStaticASGI(
+    application=None,  # `application=None` will run ServeStatic in standalone mode.
+    root="/path/to/static/files",
+)
+```
+
+Now, use any webserver CLI to serve static files. Since this example uses ASGI, here is a sample command for `uvicorn` (a popular ASGI webserver):
+
+```
+uvicorn my_project:asgi_app
+```
+
+Visit the [documentation](https://archmonger.github.io/ServeStatic/) to get started, or learn more about `ServeStatic` .
 
 ## Frequently Asked Questions
 

{servestatic-4.3.2 → servestatic-4.3.4}/README.md

@@ -29,7 +29,28 @@ When using `ServeStatic`, best practices are automatically handled such as:
 - Proper handling of `Accept-Encoding` and `Vary` headers
 - Setting far-future cache headers for immutable static files.
 
-Visit the [documentation](https://archmonger.github.io/ServeStatic/) to get started or learn more about `ServeStatic` .
+
+## Quick Start
+
+Here is a short example of ASGI standalone mode:
+
+```python
+# filename: my_project.py
+from servestatic import ServeStaticASGI
+
+asgi_app = ServeStaticASGI(
+    application=None,  # `application=None` will run ServeStatic in standalone mode.
+    root="/path/to/static/files",
+)
+```
+
+Now, use any webserver CLI to serve static files. Since this example uses ASGI, here is a sample command for `uvicorn` (a popular ASGI webserver):
+
+```
+uvicorn my_project:asgi_app
+```
+
+Visit the [documentation](https://archmonger.github.io/ServeStatic/) to get started, or learn more about `ServeStatic` .
 
 ## Frequently Asked Questions
 

{servestatic-4.3.2 → servestatic-4.3.4}/src/servestatic/__init__.py

@@ -3,6 +3,6 @@ from __future__ import annotations
 from servestatic.asgi import ServeStaticASGI
 from servestatic.wsgi import ServeStatic
 
-__version__ = "4.3.2"
+__version__ = "4.3.4"
 
 __all__ = ["ServeStatic", "ServeStaticASGI"]

{servestatic-4.3.2 → servestatic-4.3.4}/src/servestatic/base.py

@@ -162,8 +162,15 @@ class ServeStaticBase:
         if getattr(self, "allow_unsafe_symlinks", False):
             return True
 
-        resolved_root = os.path.realpath(normalized_root)
-        resolved_path = os.path.realpath(normalized_path)
+        try:
+            resolved_root = os.path.realpath(normalized_root)
+            resolved_path = os.path.realpath(normalized_path)
+        except ValueError:
+            # A raw NUL byte (e.g. from a request path containing %00) survives
+            # normpath() but makes realpath() raise. Treat such a path as being
+            # outside the root (i.e. not found/forbidden) rather than letting an
+            # unhandled ValueError propagate and crash the request.
+            return False
         return self._path_is_within(resolved_root, resolved_path)
 
     @staticmethod

{servestatic-4.3.2 → servestatic-4.3.4}/src/servestatic/responders.py

@@ -3,7 +3,6 @@ from __future__ import annotations
 import contextlib
 import errno
 import os
-import re
 import stat
 from email.utils import formatdate, parsedate
 from http import HTTPStatus
@@ -13,7 +12,7 @@ from typing import TYPE_CHECKING
 from urllib.parse import quote
 from wsgiref.headers import Headers
 
-from servestatic.utils import AsyncFile
+from servestatic.utils import AsyncFile, parse_accept_encoding
 
 if TYPE_CHECKING:
     from collections.abc import Callable, Mapping
@@ -42,6 +41,7 @@ NOT_ALLOWED_RESPONSE = Response(
 # Headers which should be returned with a 304 Not Modified response as
 # specified here: https://tools.ietf.org/html/rfc7232#section-4.1
 NOT_MODIFIED_HEADERS = (
+    "Access-Control-Allow-Origin",
     "Cache-Control",
     "Content-Location",
     "Date",
@@ -184,7 +184,7 @@ class StaticFile:
             raise ValueError(msg)
         start, end = self.get_byte_range(range_header, size)
         if start > end:
-            return self.get_range_not_satisfiable_response(file_handle, size)
+            return self.get_range_not_satisfiable_response(file_handle, size, headers)
         if file_handle is not None:
             file_handle = SlicedFile(file_handle, start, end)
         headers.extend((
@@ -213,7 +213,7 @@ class StaticFile:
             raise ValueError(msg)
         start, end = self.get_byte_range(range_header, size)
         if start > end:
-            return await self.aget_range_not_satisfiable_response(file_handle, size)
+            return await self.aget_range_not_satisfiable_response(file_handle, size, headers)
         sliced_file: AsyncSlicedFile | None = None
         if file_handle is not None:
             sliced_file = AsyncSlicedFile(file_handle, start, end)
@@ -249,23 +249,35 @@ class StaticFile:
         return start, end
 
     @staticmethod
-    def get_range_not_satisfiable_response(file_handle: BufferedIOBase | None, size: int) -> Response:
+    def get_range_not_satisfiable_response(
+        file_handle: BufferedIOBase | None,
+        size: int,
+        headers: list[tuple[str, str | None]] | None = None,
+    ) -> Response:
         if file_handle is not None:
             file_handle.close()
+        response_headers = list(headers) if headers else []
+        response_headers.append(("Content-Range", f"bytes */{size}"))
         return Response(
             HTTPStatus.REQUESTED_RANGE_NOT_SATISFIABLE,
-            [("Content-Range", f"bytes */{size}")],
+            response_headers,
             None,
         )
 
     @staticmethod
-    async def aget_range_not_satisfiable_response(file_handle: AsyncFile | None, size: int) -> Response:
+    async def aget_range_not_satisfiable_response(
+        file_handle: AsyncFile | None,
+        size: int,
+        headers: list[tuple[str, str | None]] | None = None,
+    ) -> Response:
         """Variant of `get_range_not_satisfiable_response` that works with
         async file objects. Async file handles do not need to be closed, since they
         are only opened via context managers while being dispatched."""
+        response_headers = list(headers) if headers else []
+        response_headers.append(("Content-Range", f"bytes */{size}"))
         return Response(
             HTTPStatus.REQUESTED_RANGE_NOT_SATISFIABLE,
-            [("Content-Range", f"bytes */{size}")],
+            response_headers,
             None,
         )
 
@@ -313,7 +325,7 @@ class StaticFile:
     def get_alternatives(
         base_headers: Headers,
         files: Mapping[str | None, FileEntry],
-    ) -> list[tuple[re.Pattern[str], str, list[tuple[str, str | None]]]]:
+    ) -> list[tuple[str | None, str, list[tuple[str, str | None]]]]:
         # Sort by size so that the smallest compressed alternative matches first
         alternatives = []
         files_by_size = sorted(files.items(), key=lambda i: i[1].size)
@@ -322,10 +334,7 @@ class StaticFile:
             headers["Content-Length"] = str(file_entry.size)
             if encoding:
                 headers["Content-Encoding"] = encoding
-                encoding_re = re.compile(rf"\b{encoding}\b")
-            else:
-                encoding_re = re.compile(r"")
-            alternatives.append((encoding_re, file_entry.path, headers.items()))
+            alternatives.append((encoding, file_entry.path, headers.items()))
         return alternatives
 
     def is_not_modified(self, request_headers: Mapping[str, str]) -> bool:
@@ -347,12 +356,14 @@ class StaticFile:
         accept_encoding = request_headers.get("HTTP_ACCEPT_ENCODING", "")
         if accept_encoding == "*":
             accept_encoding = ""
+        accepted = parse_accept_encoding(accept_encoding)
         # These are sorted by size so first match is the best
         result = next(
             (
                 (path, headers)
-                for encoding_re, path, headers in self.alternatives
-                if encoding_re.search(accept_encoding)
+                for encoding, path, headers in self.alternatives
+                # An uncompressed file is always an acceptable fallback.
+                if not encoding or encoding in accepted
             ),
             None,
         )

{servestatic-4.3.2 → servestatic-4.3.4}/src/servestatic/utils.py

@@ -4,6 +4,7 @@ import asyncio
 import concurrent.futures
 import contextlib
 import functools
+import math
 import os
 from concurrent.futures import ThreadPoolExecutor
 from typing import TYPE_CHECKING, Concatenate, ParamSpec, TypeVar, cast
@@ -38,6 +39,45 @@ def ensure_leading_trailing_slash(path: str | None) -> str:
     return f"/{path}/" if path else "/"
 
 
+def parse_accept_encoding(header: str) -> set[str]:
+    """
+    Return the set of content codings the client is willing to accept.
+
+    The header is parsed as described in RFC 9110 section 12.5.3 rather than
+    matched as a substring, so that a coding the client has refused with
+    ``q=0`` is not offered to it, and a coding name is only recognised when it
+    appears as a whole token.
+    """
+    accepted: set[str] = set()
+    for entry in header.split(","):
+        coding, _, params = entry.partition(";")
+        coding = coding.strip().lower()
+        if not coding:
+            continue
+        quality = 1.0
+        for param in params.split(";"):
+            name, sep, value = param.partition("=")
+            if name.strip().lower() != "q":
+                continue
+            if not sep:
+                break
+            try:
+                quality = float(value.strip())
+            except ValueError:
+                # An unparseable qvalue makes the whole entry invalid; treat
+                # the coding as unacceptable rather than guess.
+                quality = 0.0
+            else:
+                # Per RFC 9110 a qvalue must be a number in the range 0.000 to
+                # 1.000; any other finite value (e.g. ``inf``) is invalid.
+                if not math.isfinite(quality) or not 0.0 <= quality <= 1.0:
+                    quality = 0.0
+            break
+        if quality > 0:
+            accepted.add(coding)
+    return accepted
+
+
 def scantree(root: str | PathLike[str]) -> Iterator[tuple[str, os.stat_result]]:
     """
     Recurse the given directory yielding (pathname, os.stat(pathname)) pairs