FileMgr

✏️ /usr/lib/python3/dist-packages/twisted/web/test/injectionhelpers.py

✕ Tutup

"""
Helpers for URI and method injection tests.

@see: U{CVE-2019-12387}
"""

import string

UNPRINTABLE_ASCII = frozenset(range(0, 128)) - frozenset(
    bytearray(string.printable, "ascii")
)

NONASCII = frozenset(range(128, 256))

class MethodInjectionTestsMixin:
    """
    A mixin that runs HTTP method injection tests.  Define
    L{MethodInjectionTestsMixin.attemptRequestWithMaliciousMethod} in
    a L{twisted.trial.unittest.SynchronousTestCase} subclass to test
    how HTTP client code behaves when presented with malicious HTTP
    methods.

@see: U{CVE-2019-12387}
    """

def attemptRequestWithMaliciousMethod(self, method):
        """
        Attempt to send a request with the given method.  This should
        synchronously raise a L{ValueError} if either is invalid.

@param method: the method (e.g. C{GET\x00})

@param uri: the URI

@type method:
        """
        raise NotImplementedError()

def test_methodWithCLRFRejected(self):
        """
        Issuing a request with a method that contains a carriage
        return and line feed fails with a L{ValueError}.
        """
        with self.assertRaises(ValueError) as cm:
            method = b"GET\r\nX-Injected-Header: value"
            self.attemptRequestWithMaliciousMethod(method)
        self.assertRegex(str(cm.exception), "^Invalid method")

def test_methodWithUnprintableASCIIRejected(self):
        """
        Issuing a request with a method that contains unprintable
        ASCII characters fails with a L{ValueError}.
        """
        for c in UNPRINTABLE_ASCII:
            method = b"GET%s" % (bytearray([c]),)
            with self.assertRaises(ValueError) as cm:
                self.attemptRequestWithMaliciousMethod(method)
            self.assertRegex(str(cm.exception), "^Invalid method")

def test_methodWithNonASCIIRejected(self):
        """
        Issuing a request with a method that contains non-ASCII
        characters fails with a L{ValueError}.
        """
        for c in NONASCII:
            method = b"GET%s" % (bytearray([c]),)
            with self.assertRaises(ValueError) as cm:
                self.attemptRequestWithMaliciousMethod(method)
            self.assertRegex(str(cm.exception), "^Invalid method")

class URIInjectionTestsMixin:
    """
    A mixin that runs HTTP URI injection tests.  Define
    L{MethodInjectionTestsMixin.attemptRequestWithMaliciousURI} in a
    L{twisted.trial.unittest.SynchronousTestCase} subclass to test how
    HTTP client code behaves when presented with malicious HTTP
    URIs.
    """

def attemptRequestWithMaliciousURI(self, method):
        """
        Attempt to send a request with the given URI.  This should
        synchronously raise a L{ValueError} if either is invalid.

@param uri: the URI.

@type method:
        """
        raise NotImplementedError()

def test_hostWithCRLFRejected(self):
        """
        Issuing a request with a URI whose host contains a carriage
        return and line feed fails with a L{ValueError}.
        """
        with self.assertRaises(ValueError) as cm:
            uri = b"http://twisted\r\n.invalid/path"
            self.attemptRequestWithMaliciousURI(uri)
        self.assertRegex(str(cm.exception), "^Invalid URI")

def test_hostWithWithUnprintableASCIIRejected(self):
        """
        Issuing a request with a URI whose host contains unprintable
        ASCII characters fails with a L{ValueError}.
        """
        for c in UNPRINTABLE_ASCII:
            uri = b"http://twisted%s.invalid/OK" % (bytearray([c]),)
            with self.assertRaises(ValueError) as cm:
                self.attemptRequestWithMaliciousURI(uri)
            self.assertRegex(str(cm.exception), "^Invalid URI")

def test_hostWithNonASCIIRejected(self):
        """
        Issuing a request with a URI whose host contains non-ASCII
        characters fails with a L{ValueError}.
        """
        for c in NONASCII:
            uri = b"http://twisted%s.invalid/OK" % (bytearray([c]),)
            with self.assertRaises(ValueError) as cm:
                self.attemptRequestWithMaliciousURI(uri)
            self.assertRegex(str(cm.exception), "^Invalid URI")

def test_pathWithCRLFRejected(self):
        """
        Issuing a request with a URI whose path contains a carriage
        return and line feed fails with a L{ValueError}.
        """
        with self.assertRaises(ValueError) as cm:
            uri = b"http://twisted.invalid/\r\npath"
            self.attemptRequestWithMaliciousURI(uri)
        self.assertRegex(str(cm.exception), "^Invalid URI")

def test_pathWithWithUnprintableASCIIRejected(self):
        """
        Issuing a request with a URI whose path contains unprintable
        ASCII characters fails with a L{ValueError}.
        """
        for c in UNPRINTABLE_ASCII:
            uri = b"http://twisted.invalid/OK%s" % (bytearray([c]),)
            with self.assertRaises(ValueError) as cm:
                self.attemptRequestWithMaliciousURI(uri)
            self.assertRegex(str(cm.exception), "^Invalid URI")

def test_pathWithNonASCIIRejected(self):
        """
        Issuing a request with a URI whose path contains non-ASCII
        characters fails with a L{ValueError}.
        """
        for c in NONASCII:
            uri = b"http://twisted.invalid/OK%s" % (bytearray([c]),)
            with self.assertRaises(ValueError) as cm:
                self.attemptRequestWithMaliciousURI(uri)
            self.assertRegex(str(cm.exception), "^Invalid URI")

Batal

⬅ web 35 item

Nama	Tipe	Ukuran	Diubah	Perm	Aksi
📁 __pycache__	dir	—	15/06/26 13:45	0755	📂
🐍 __init__.py	py	107 B	22/05/26 14:58	0644	✏️ ⬇
🐍 _util.py	py	3.3 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 injectionhelpers.py	py	5.5 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 requesthelper.py	py	15.1 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_agent.py	py	119.7 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_cgi.py	py	14.8 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_client.py	py	1.5 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_distrib.py	py	17.6 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_domhelpers.py	py	11.2 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_error.py	py	16.4 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_flatten.py	py	25.7 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_html.py	py	1.2 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_http.py	py	153.6 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_http2.py	py	105.2 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_http_headers.py	py	24.4 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_httpauth.py	py	23.2 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_newclient.py	py	106.8 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_pages.py	py	3.6 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_proxy.py	py	19.6 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_resource.py	py	10.4 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_script.py	py	3.9 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_soap.py	py	3 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_stan.py	py	7.1 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_static.py	py	66.6 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_tap.py	py	11.9 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_template.py	py	28.4 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_util.py	py	14.8 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_vhost.py	py	7.5 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_web.py	py	67.5 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_web__responses.py	py	837 B	22/05/26 14:58	0644	✏️ ⬇
🐍 test_webclient.py	py	11.5 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_wsgi.py	py	73.8 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_xml.py	py	42.3 KB	22/05/26 14:58	0644	✏️ ⬇
🐍 test_xmlrpc.py	py	29.9 KB	22/05/26 14:58	0644	✏️ ⬇

✏️ Rename

🔑 Ubah Permission