tobias/radicale
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Error if SCRIPT_NAME ends with '/'

Browse Source
This commit is contained in:
Unrud 2022-01-21 19:56:57 +01:00
parent 7fde7d5005
commit 3763ed46c4
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
radicale/app/__init__.py
View File

@ -191,6 +191,12 @@ class Application(ApplicationPartDelete, ApplicationPartHead,
base_prefix_src = ("HTTP_X_SCRIPT_NAME" if "HTTP_X_SCRIPT_NAME" in base_prefix_src = ("HTTP_X_SCRIPT_NAME" if "HTTP_X_SCRIPT_NAME" in
environ else "SCRIPT_NAME") environ else "SCRIPT_NAME")
base_prefix = environ.get(base_prefix_src, "") base_prefix = environ.get(base_prefix_src, "")
if base_prefix.endswith("/"):
logger.error("Base prefix (from %s) must not end with '/': %r",
base_prefix_src, base_prefix)
if base_prefix_src == "HTTP_X_SCRIPT_NAME":
return response(*httputils.BAD_REQUEST)
return response(*httputils.INTERNAL_SERVER_ERROR)
logger.debug("Base prefix (from %s): %r", base_prefix_src, base_prefix) logger.debug("Base prefix (from %s): %r", base_prefix_src, base_prefix)
# Sanitize request URI (a WSGI server indicates with an empty path, # Sanitize request URI (a WSGI server indicates with an empty path,
# that the URL targets the application root without a trailing slash) # that the URL targets the application root without a trailing slash)

8
radicale/tests/test_base.py
View File

@ -65,6 +65,10 @@ permissions: RrWw""")
SCRIPT_NAME="/radicale") SCRIPT_NAME="/radicale")
assert headers.get("Location") == "/radicale/.web" assert headers.get("Location") == "/radicale/.web"
def test_root_broken_script_name(self) -> None:
"""GET request at "/" with SCRIPT_NAME ending with "/"."""
self.get("/", check=500, SCRIPT_NAME="/radicale/")
def test_root_http_x_script_name(self) -> None: def test_root_http_x_script_name(self) -> None:
"""GET request at "/" with HTTP_X_SCRIPT_NAME.""" """GET request at "/" with HTTP_X_SCRIPT_NAME."""
for path in ["", "/", "//"]: for path in ["", "/", "//"]:
@ -72,6 +76,10 @@ permissions: RrWw""")
HTTP_X_SCRIPT_NAME="/radicale") HTTP_X_SCRIPT_NAME="/radicale")
assert headers.get("Location") == "/radicale/.web" assert headers.get("Location") == "/radicale/.web"
def test_root_broken_http_x_script_name(self) -> None:
"""GET request at "/" with HTTP_X_SCRIPT_NAME ending with "/"."""
self.get("/", check=400, HTTP_X_SCRIPT_NAME="/radicale/")
def test_sanitized_path(self) -> None: def test_sanitized_path(self) -> None:
"""GET request with unsanitized paths.""" """GET request with unsanitized paths."""
for path, sane_path in [ for path, sane_path in [