�
Ϫ�f� � � � d Z ddlZ e edd� � e eej
d� � z
Z e edd� � Z G d� d� Z G d� d � Z y)
zF
Helpers for URI and method injection tests.
@see: U{CVE-2019-12387}
� N� �ascii� c �( � e Zd ZdZd� Zd� Zd� Zd� Zy)�MethodInjectionTestsMixina9
A mixin that runs HTTP method injection tests. Define
L{MethodInjectionTestsMixin.attemptRequestWithMaliciousMethod} in
a L{twisted.trial.unittest.SynchronousTestCase} subclass to test
how HTTP client code behaves when presented with malicious HTTP
methods.
@see: U{CVE-2019-12387}
c � � t � �)z�
Attempt to send a request with the given method. This should
synchronously raise a L{ValueError} if either is invalid.
@param method: the method (e.g. C{GET })
@param uri: the URI
@type method:
��NotImplementedError��self�methods �C/usr/lib/python3/dist-packages/twisted/web/test/injectionhelpers.py�!attemptRequestWithMaliciousMethodz;MethodInjectionTestsMixin.attemptRequestWithMaliciousMethod s
� � "�#�#� c �� � | j t � 5 }d}| j |� ddd� | j t j
� d� y# 1 sw Y �/xY w)z�
Issuing a request with a method that contains a carriage
return and line feed fails with a L{ValueError}.
s GET
X-Injected-Header: valueN�^Invalid method)� assertRaises�
ValueErrorr � assertRegex�str� exception)r �cmr
s r �test_methodWithCLRFRejectedz5MethodInjectionTestsMixin.test_methodWithCLRFRejected( sX � �
�
�
�z�
*� ;�b�7�F� � 2� 2�6� :� ;�
����R�\�\�*�,=�>� ;� ;�� �A�A!c � � t D ]f }dt |g� fz }| j t � 5 }| j |� ddd� | j t
j � d� �h y# 1 sw Y �1xY w)z�
Issuing a request with a method that contains unprintable
ASCII characters fails with a L{ValueError}.
� GET%sNr )�UNPRINTABLE_ASCII� bytearrayr r r r r r �r �cr
r s r �'test_methodWithUnprintableASCIIRejectedzAMethodInjectionTestsMixin.test_methodWithUnprintableASCIIRejected2 su � �
#� C�A� ��A�3� � 1�1�F��"�"�:�.�
?�"��6�6�v�>�
?� � � �S�� � � .�0A� B� C�
?�
?�� �A1�1A: c � � t D ]f }dt |g� fz }| j t � 5 }| j |� ddd� | j t
j � d� �h y# 1 sw Y �1xY w)zx
Issuing a request with a method that contains non-ASCII
characters fails with a L{ValueError}.
r Nr )�NONASCIIr r r r r r r r s r � test_methodWithNonASCIIRejectedz9MethodInjectionTestsMixin.test_methodWithNonASCIIRejected= su � �
� C�A� ��A�3� � 1�1�F��"�"�:�.�
?�"��6�6�v�>�
?� � � �S�� � � .�0A� B� C�
?�
?�r" N)�__name__�
__module__� __qualname__�__doc__r r r! r% � r r r r s � �� $�?� C� Cr r c �: � e Zd ZdZd� Zd� Zd� Zd� Zd� Zd� Z d� Z
y )
�URIInjectionTestsMixina
A mixin that runs HTTP URI injection tests. Define
L{MethodInjectionTestsMixin.attemptRequestWithMaliciousURI} in a
L{twisted.trial.unittest.SynchronousTestCase} subclass to test how
HTTP client code behaves when presented with malicious HTTP
URIs.
c � � t � �)z�
Attempt to send a request with the given URI. This should
synchronously raise a L{ValueError} if either is invalid.
@param uri: the URI.
@type method:
r r s r � attemptRequestWithMaliciousURIz5URIInjectionTestsMixin.attemptRequestWithMaliciousURIR s
� � "�#�#r c �� � | j t � 5 }d}| j |� ddd� | j t j
� d� y# 1 sw Y �/xY w)z�
Issuing a request with a URI whose host contains a carriage
return and line feed fails with a L{ValueError}.
s http://twisted
.invalid/pathN� ^Invalid URI�r r r. r r r �r r �uris r �test_hostWithCRLFRejectedz0URIInjectionTestsMixin.test_hostWithCRLFRejected] �W � �
�
�
�z�
*� 5�b�4�C� � /� /�� 4� 5�
����R�\�\�*�N�;� 5� 5�r c � � t D ]f }dt |g� fz }| j t � 5 }| j |� ddd� | j t
j � d� �h y# 1 sw Y �1xY w)z�
Issuing a request with a URI whose host contains unprintable
ASCII characters fails with a L{ValueError}.
� http://twisted%s.invalid/OKNr0 �r r r r r. r r r �r r r3 r s r �)test_hostWithWithUnprintableASCIIRejectedz@URIInjectionTestsMixin.test_hostWithWithUnprintableASCIIRejectedg �t � �
#� @�A�0�I�q�c�N�3D�D�C��"�"�:�.�
9�"��3�3�C�8�
9� � � �S�� � � .�� ?� @�
9�
9�r" c � � t D ]f }dt |g� fz }| j t � 5 }| j |� ddd� | j t
j � d� �h y# 1 sw Y �1xY w)z{
Issuing a request with a URI whose host contains non-ASCII
characters fails with a L{ValueError}.
r7 Nr0 �r$ r r r r. r r r r9 s r � test_hostWithNonASCIIRejectedz4URIInjectionTestsMixin.test_hostWithNonASCIIRejectedr �t � �
� @�A�0�I�q�c�N�3D�D�C��"�"�:�.�
9�"��3�3�C�8�
9� � � �S�� � � .�� ?� @�
9�
9�r" c �� � | j t � 5 }d}| j |� ddd� | j t j
� d� y# 1 sw Y �/xY w)z�
Issuing a request with a URI whose path contains a carriage
return and line feed fails with a L{ValueError}.
s http://twisted.invalid/
pathNr0 r1 r2 s r �test_pathWithCRLFRejectedz0URIInjectionTestsMixin.test_pathWithCRLFRejected} r5 r c � � t D ]f }dt |g� fz }| j t � 5 }| j |� ddd� | j t
j � d� �h y# 1 sw Y �1xY w)z�
Issuing a request with a URI whose path contains unprintable
ASCII characters fails with a L{ValueError}.
� http://twisted.invalid/OK%sNr0 r8 r9 s r �)test_pathWithWithUnprintableASCIIRejectedz@URIInjectionTestsMixin.test_pathWithWithUnprintableASCIIRejected� r; r" c � � t D ]f }dt |g� fz }| j t � 5 }| j |� ddd� | j t
j � d� �h y# 1 sw Y �1xY w)z{
Issuing a request with a URI whose path contains non-ASCII
characters fails with a L{ValueError}.
rC Nr0 r= r9 s r � test_pathWithNonASCIIRejectedz4URIInjectionTestsMixin.test_pathWithNonASCIIRejected� r? r" N) r& r' r( r) r. r4 r: r> rA rD rF r* r r r, r, I s. � �� $�<� @� @�<� @� @r r, )
r) �string� frozenset�ranger � printabler r$ r r, r* r r �<module>rK si ��� � �e�A�s�m�,�y�
�f� � ��(�0� � � �U�3��_� %��6C� 6C�rR@� R@r |