FM / test

/usr/lib/python3/dist-packages/twisted/web/test/

/usr/lib/python3/dist-packages/twisted/web/test

Name	Size	Mode	Actions
__pycache__/	-	0755	rm
injectionhelpers.py	5593	0644	edit dl rm
requesthelper.py	15121	0644	edit dl rm
test_agent.py	121042	0644	edit dl rm
test_cgi.py	15119	0644	edit dl rm
test_client.py	1364	0644	edit dl rm
test_distrib.py	18036	0644	edit dl rm
test_domhelpers.py	11034	0644	edit dl rm
test_error.py	15946	0644	edit dl rm
test_flatten.py	22130	0644	edit dl rm
test_html.py	1222	0644	edit dl rm
test_http.py	155512	0644	edit dl rm
test_http2.py	107846	0644	edit dl rm
test_httpauth.py	23786	0644	edit dl rm
test_http_headers.py	23292	0644	edit dl rm
test_newclient.py	109366	0644	edit dl rm
test_proxy.py	20046	0644	edit dl rm
test_resource.py	9136	0644	edit dl rm
test_script.py	3814	0644	edit dl rm
test_soap.py	3134	0644	edit dl rm
test_stan.py	7252	0644	edit dl rm
test_static.py	68197	0644	edit dl rm
test_tap.py	11842	0644	edit dl rm
test_template.py	28841	0644	edit dl rm
test_util.py	15049	0644	edit dl rm
test_vhost.py	7736	0644	edit dl rm
test_web.py	69145	0644	edit dl rm
test_webclient.py	11792	0644	edit dl rm
test_web__responses.py	829	0644	edit dl rm
test_wsgi.py	76512	0644	edit dl rm
test_xml.py	42030	0644	edit dl rm
test_xmlrpc.py	30572	0644	edit dl rm
_util.py	3174	0644	edit dl rm
__init__.py	107	0644	edit dl rm

Edit: /usr/lib/python3/dist-packages/twisted/web/test/injectionhelpers.py (5593B)

"""
Helpers for URI and method injection tests.

@see: U{CVE-2019-12387}
"""

import string

UNPRINTABLE_ASCII = frozenset(range(0, 128)) - frozenset(
    bytearray(string.printable, "ascii")
)

NONASCII = frozenset(range(128, 256))

class MethodInjectionTestsMixin:
    """
    A mixin that runs HTTP method injection tests.  Define
    L{MethodInjectionTestsMixin.attemptRequestWithMaliciousMethod} in
    a L{twisted.trial.unittest.SynchronousTestCase} subclass to test
    how HTTP client code behaves when presented with malicious HTTP
    methods.

@see: U{CVE-2019-12387}
    """

def attemptRequestWithMaliciousMethod(self, method):
        """
        Attempt to send a request with the given method.  This should
        synchronously raise a L{ValueError} if either is invalid.

@param method: the method (e.g. C{GET\x00})

@param uri: the URI

@type method:
        """
        raise NotImplementedError()

def test_methodWithCLRFRejected(self):
        """
        Issuing a request with a method that contains a carriage
        return and line feed fails with a L{ValueError}.
        """
        with self.assertRaises(ValueError) as cm:
            method = b"GET\r\nX-Injected-Header: value"
            self.attemptRequestWithMaliciousMethod(method)
        self.assertRegex(str(cm.exception), "^Invalid method")

def test_methodWithUnprintableASCIIRejected(self):
        """
        Issuing a request with a method that contains unprintable
        ASCII characters fails with a L{ValueError}.
        """
        for c in UNPRINTABLE_ASCII:
            method = b"GET%s" % (bytearray([c]),)
            with self.assertRaises(ValueError) as cm:
                self.attemptRequestWithMaliciousMethod(method)
            self.assertRegex(str(cm.exception), "^Invalid method")

def test_methodWithNonASCIIRejected(self):
        """
        Issuing a request with a method that contains non-ASCII
        characters fails with a L{ValueError}.
        """
        for c in NONASCII:
            method = b"GET%s" % (bytearray([c]),)
            with self.assertRaises(ValueError) as cm:
                self.attemptRequestWithMaliciousMethod(method)
            self.assertRegex(str(cm.exception), "^Invalid method")

class URIInjectionTestsMixin:
    """
    A mixin that runs HTTP URI injection tests.  Define
    L{MethodInjectionTestsMixin.attemptRequestWithMaliciousURI} in a
    L{twisted.trial.unittest.SynchronousTestCase} subclass to test how
    HTTP client code behaves when presented with malicious HTTP
    URIs.
    """

def attemptRequestWithMaliciousURI(self, method):
        """
        Attempt to send a request with the given URI.  This should
        synchronously raise a L{ValueError} if either is invalid.

@param uri: the URI.

@type method:
        """
        raise NotImplementedError()

def test_hostWithCRLFRejected(self):
        """
        Issuing a request with a URI whose host contains a carriage
        return and line feed fails with a L{ValueError}.
        """
        with self.assertRaises(ValueError) as cm:
            uri = b"http://twisted\r\n.invalid/path"
            self.attemptRequestWithMaliciousURI(uri)
        self.assertRegex(str(cm.exception), "^Invalid URI")

def test_hostWithWithUnprintableASCIIRejected(self):
        """
        Issuing a request with a URI whose host contains unprintable
        ASCII characters fails with a L{ValueError}.
        """
        for c in UNPRINTABLE_ASCII:
            uri = b"http://twisted%s.invalid/OK" % (bytearray([c]),)
            with self.assertRaises(ValueError) as cm:
                self.attemptRequestWithMaliciousURI(uri)
            self.assertRegex(str(cm.exception), "^Invalid URI")

def test_hostWithNonASCIIRejected(self):
        """
        Issuing a request with a URI whose host contains non-ASCII
        characters fails with a L{ValueError}.
        """
        for c in NONASCII:
            uri = b"http://twisted%s.invalid/OK" % (bytearray([c]),)
            with self.assertRaises(ValueError) as cm:
                self.attemptRequestWithMaliciousURI(uri)
            self.assertRegex(str(cm.exception), "^Invalid URI")

def test_pathWithCRLFRejected(self):
        """
        Issuing a request with a URI whose path contains a carriage
        return and line feed fails with a L{ValueError}.
        """
        with self.assertRaises(ValueError) as cm:
            uri = b"http://twisted.invalid/\r\npath"
            self.attemptRequestWithMaliciousURI(uri)
        self.assertRegex(str(cm.exception), "^Invalid URI")

def test_pathWithWithUnprintableASCIIRejected(self):
        """
        Issuing a request with a URI whose path contains unprintable
        ASCII characters fails with a L{ValueError}.
        """
        for c in UNPRINTABLE_ASCII:
            uri = b"http://twisted.invalid/OK%s" % (bytearray([c]),)
            with self.assertRaises(ValueError) as cm:
                self.attemptRequestWithMaliciousURI(uri)
            self.assertRegex(str(cm.exception), "^Invalid URI")

def test_pathWithNonASCIIRejected(self):
        """
        Issuing a request with a URI whose path contains non-ASCII
        characters fails with a L{ValueError}.
        """
        for c in NONASCII:
            uri = b"http://twisted.invalid/OK%s" % (bytearray([c]),)
            with self.assertRaises(ValueError) as cm:
                self.attemptRequestWithMaliciousURI(uri)
            self.assertRegex(str(cm.exception), "^Invalid URI")

""" Helpers for URI and method injection tests. @see: U{CVE-2019-12387} """ import string UNPRINTABLE_ASCII = frozenset(range(0, 128)) - frozenset( bytearray(string.printable, "ascii") ) NONASCII = frozenset(range(128, 256)) class MethodInjectionTestsMixin: """ A mixin that runs HTTP method injection tests. Define L{MethodInjectionTestsMixin.attemptRequestWithMaliciousMethod} in a L{twisted.trial.unittest.SynchronousTestCase} subclass to test how HTTP client code behaves when presented with malicious HTTP methods. @see: U{CVE-2019-12387} """ def attemptRequestWithMaliciousMethod(self, method): """ Attempt to send a request with the given method. This should synchronously raise a L{ValueError} if either is invalid. @param method: the method (e.g. C{GET\x00}) @param uri: the URI @type method: """ raise NotImplementedError() def test_methodWithCLRFRejected(self): """ Issuing a request with a method that contains a carriage return and line feed fails with a L{ValueError}. """ with self.assertRaises(ValueError) as cm: method = b"GET\r\nX-Injected-Header: value" self.attemptRequestWithMaliciousMethod(method) self.assertRegex(str(cm.exception), "^Invalid method") def test_methodWithUnprintableASCIIRejected(self): """ Issuing a request with a method that contains unprintable ASCII characters fails with a L{ValueError}. """ for c in UNPRINTABLE_ASCII: method = b"GET%s" % (bytearray([c]),) with self.assertRaises(ValueError) as cm: self.attemptRequestWithMaliciousMethod(method) self.assertRegex(str(cm.exception), "^Invalid method") def test_methodWithNonASCIIRejected(self): """ Issuing a request with a method that contains non-ASCII characters fails with a L{ValueError}. """ for c in NONASCII: method = b"GET%s" % (bytearray([c]),) with self.assertRaises(ValueError) as cm: self.attemptRequestWithMaliciousMethod(method) self.assertRegex(str(cm.exception), "^Invalid method") class URIInjectionTestsMixin: """ A mixin that runs HTTP URI injection tests. Define L{MethodInjectionTestsMixin.attemptRequestWithMaliciousURI} in a L{twisted.trial.unittest.SynchronousTestCase} subclass to test how HTTP client code behaves when presented with malicious HTTP URIs. """ def attemptRequestWithMaliciousURI(self, method): """ Attempt to send a request with the given URI. This should synchronously raise a L{ValueError} if either is invalid. @param uri: the URI. @type method: """ raise NotImplementedError() def test_hostWithCRLFRejected(self): """ Issuing a request with a URI whose host contains a carriage return and line feed fails with a L{ValueError}. """ with self.assertRaises(ValueError) as cm: uri = b"http://twisted\r\n.invalid/path" self.attemptRequestWithMaliciousURI(uri) self.assertRegex(str(cm.exception), "^Invalid URI") def test_hostWithWithUnprintableASCIIRejected(self): """ Issuing a request with a URI whose host contains unprintable ASCII characters fails with a L{ValueError}. """ for c in UNPRINTABLE_ASCII: uri = b"http://twisted%s.invalid/OK" % (bytearray([c]),) with self.assertRaises(ValueError) as cm: self.attemptRequestWithMaliciousURI(uri) self.assertRegex(str(cm.exception), "^Invalid URI") def test_hostWithNonASCIIRejected(self): """ Issuing a request with a URI whose host contains non-ASCII characters fails with a L{ValueError}. """ for c in NONASCII: uri = b"http://twisted%s.invalid/OK" % (bytearray([c]),) with self.assertRaises(ValueError) as cm: self.attemptRequestWithMaliciousURI(uri) self.assertRegex(str(cm.exception), "^Invalid URI") def test_pathWithCRLFRejected(self): """ Issuing a request with a URI whose path contains a carriage return and line feed fails with a L{ValueError}. """ with self.assertRaises(ValueError) as cm: uri = b"http://twisted.invalid/\r\npath" self.attemptRequestWithMaliciousURI(uri) self.assertRegex(str(cm.exception), "^Invalid URI") def test_pathWithWithUnprintableASCIIRejected(self): """ Issuing a request with a URI whose path contains unprintable ASCII characters fails with a L{ValueError}. """ for c in UNPRINTABLE_ASCII: uri = b"http://twisted.invalid/OK%s" % (bytearray([c]),) with self.assertRaises(ValueError) as cm: self.attemptRequestWithMaliciousURI(uri) self.assertRegex(str(cm.exception), "^Invalid URI") def test_pathWithNonASCIIRejected(self): """ Issuing a request with a URI whose path contains non-ASCII characters fails with a L{ValueError}. """ for c in NONASCII: uri = b"http://twisted.invalid/OK%s" % (bytearray([c]),) with self.assertRaises(ValueError) as cm: self.attemptRequestWithMaliciousURI(uri) self.assertRegex(str(cm.exception), "^Invalid URI")