← Back
Editing: injectionhelpers.cpython-38.pyc
U s�@g� � @ s\ d Z ddlZeedd��eeejd�� Zeedd��ZG dd� de�Z G dd � d e�Z dS ) zF Helpers for URI and method injection tests. @see: U{CVE-2019-12387} � N� �ascii� c @ s0 e Zd ZdZdd� Zdd� Zdd� Zdd � Zd S ) �MethodInjectionTestsMixina9 A mixin that runs HTTP method injection tests. Define L{MethodInjectionTestsMixin.attemptRequestWithMaliciousMethod} in a L{twisted.trial.unittest.SynchronousTestCase} subclass to test how HTTP client code behaves when presented with malicious HTTP methods. @see: U{CVE-2019-12387} c C s t � �dS )z� Attempt to send a request with the given method. This should synchronously raise a L{ValueError} if either is invalid. @param method: the method (e.g. C{GET }) @param uri: the URI @type method: N��NotImplementedError��self�method� r �C/usr/lib/python3/dist-packages/twisted/web/test/injectionhelpers.py�!attemptRequestWithMaliciousMethod s z;MethodInjectionTestsMixin.attemptRequestWithMaliciousMethodc C s: | � t��}d}| �|� W 5 Q R X | �t|j�d� dS )z� Issuing a request with a method that contains a carriage return and line feed fails with a L{ValueError}. s GET X-Injected-Header: value�^Invalid methodN)� assertRaises� ValueErrorr � assertRegex�str� exception)r �cmr r r r �test_methodWithCLRFRejected, s z5MethodInjectionTestsMixin.test_methodWithCLRFRejectedc C sP t D ]F}dt|g�f }| �t��}| �|� W 5 Q R X | �t|j�d� qdS )z� Issuing a request with a method that contains unprintable ASCII characters fails with a L{ValueError}. � GET%sr N)�UNPRINTABLE_ASCII� bytearrayr r r r r r �r �cr r r r r �'test_methodWithUnprintableASCIIRejected7 s zAMethodInjectionTestsMixin.test_methodWithUnprintableASCIIRejectedc C sP t D ]F}dt|g�f }| �t��}| �|� W 5 Q R X | �t|j�d� qdS )zx Issuing a request with a method that contains non-ASCII characters fails with a L{ValueError}. r r N)�NONASCIIr r r r r r r r r r r � test_methodWithNonASCIIRejectedC s z9MethodInjectionTestsMixin.test_methodWithNonASCIIRejectedN)�__name__� __module__� __qualname__�__doc__r r r r r r r r r s r c @ sH e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z dd� Z dS )�URIInjectionTestsMixina A mixin that runs HTTP URI injection tests. Define L{MethodInjectionTestsMixin.attemptRequestWithMaliciousURI} in a L{twisted.trial.unittest.SynchronousTestCase} subclass to test how HTTP client code behaves when presented with malicious HTTP URIs. c C s t � �dS )z� Attempt to send a request with the given URI. This should synchronously raise a L{ValueError} if either is invalid. @param uri: the URI. @type method: Nr r r r r � attemptRequestWithMaliciousURIY s z5URIInjectionTestsMixin.attemptRequestWithMaliciousURIc C s: | � t��}d}| �|� W 5 Q R X | �t|j�d� dS )z� Issuing a request with a URI whose host contains a carriage return and line feed fails with a L{ValueError}. s http://twisted .invalid/path� ^Invalid URIN�r r r# r r r �r r �urir r r �test_hostWithCRLFRejectede s z0URIInjectionTestsMixin.test_hostWithCRLFRejectedc C sP t D ]F}dt|g�f }| �t��}| �|� W 5 Q R X | �t|j�d� qdS )z� Issuing a request with a URI whose host contains unprintable ASCII characters fails with a L{ValueError}. � http://twisted%s.invalid/OKr$ N�r r r r r# r r r �r r r' r r r r �)test_hostWithWithUnprintableASCIIRejectedp s z@URIInjectionTestsMixin.test_hostWithWithUnprintableASCIIRejectedc C sP t D ]F}dt|g�f }| �t��}| �|� W 5 Q R X | �t|j�d� qdS )z{ Issuing a request with a URI whose host contains non-ASCII characters fails with a L{ValueError}. r) r$ N�r r r r r# r r r r+ r r r � test_hostWithNonASCIIRejected| s z4URIInjectionTestsMixin.test_hostWithNonASCIIRejectedc C s: | � t��}d}| �|� W 5 Q R X | �t|j�d� dS )z� Issuing a request with a URI whose path contains a carriage return and line feed fails with a L{ValueError}. s http://twisted.invalid/ pathr$ Nr% r& r r r �test_pathWithCRLFRejected� s z0URIInjectionTestsMixin.test_pathWithCRLFRejectedc C sP t D ]F}dt|g�f }| �t��}| �|� W 5 Q R X | �t|j�d� qdS )z� Issuing a request with a URI whose path contains unprintable ASCII characters fails with a L{ValueError}. � http://twisted.invalid/OK%sr$ Nr* r+ r r r �)test_pathWithWithUnprintableASCIIRejected� s z@URIInjectionTestsMixin.test_pathWithWithUnprintableASCIIRejectedc C sP t D ]F}dt|g�f }| �t��}| �|� W 5 Q R X | �t|j�d� qdS )z{ Issuing a request with a URI whose path contains non-ASCII characters fails with a L{ValueError}. r0 r$ Nr- r+ r r r � test_pathWithNonASCIIRejected� s z4URIInjectionTestsMixin.test_pathWithNonASCIIRejectedN) r r r r! r# r( r, r. r/ r1 r2 r r r r r" P s r" ) r! �string� frozenset�ranger Z printabler r �objectr r" r r r r �<module> s ��=
Save File
Cancel