shell bypass 403
o
` bY � @ s� d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZm Z d dl
m Z d dl m
Z
G dd� d�Ze� e _G dd � d �Zd
d � Zd ed
�fded
�fded
�fdi fdi fdd dgifded
�fded
�fded�fdddgifdddgifd ddgifd dd gifd ed
�fd ed!�fd"d#gd$gd%�fd&dd#d'gifd(d)gd*gd+gd,�fd-d.gd/gd0gd1gd2gd3gd4gd5gd6�fd7d8gd9gd:gd)gd;gd<gd=�fgZd>d?� Zd@dA� ZdBdC� ZdDdE� ZG dFdG� dGej�ZdHZdIZdJZdKZ dLZ e dMkr�e� � dS dS )N� N)�
namedtuple)�StringIO�BytesIO)�support)�warnings_helperc @ s e Zd Zg ZejZdS )�HackedSysModuleN)�__name__�
__module__� __qualname__�argv�sys�stdin� r r �6/usr/local/python-3.10/lib/python3.10/test/test_cgi.pyr s
r c @ s, e Zd Zdd� Zdd� Zdd� Zdd� Zd S )
�ComparableExceptionc C s
|| _ d S �N)�err)�selfr r r r �__init__ �
z ComparableException.__init__c C s
t | j�S r )�strr �r r r r �__str__ r zComparableException.__str__c C s* t |t�stS | jj|jko| jj|jkS r )�
isinstance� Exception�NotImplementedr � __class__�args)r ZanExcr r r �__eq__ s
�zComparableException.__eq__c C s t | j|�S r )�getattrr )r �attrr r r � __getattr__ � z ComparableException.__getattr__N)r r r
r r r r! r r r r r s
r c
C s� i }|dkrd }d|d< | |d< n"|dkr-t | �d��}d|d< d|d< tt| ��|d< ntd | ��z tj||d
d �W S tyR } z
t|�W Y d }~S d }~ww ) N�GET�REQUEST_METHOD� QUERY_STRING�POST�latin-1�!application/x-www-form-urlencoded� CONTENT_TYPE�CONTENT_LENGTHzunknown method: %s� )�strict_parsing) r �encoder �len�
ValueError�cgi�parser r )�buf�method�env�fpr r r r �do_test# s"
��r6 � �bad query field: ''�&z&&�=z=&=z=a�az&=az=a&z=&a�bad query field: 'a'zb=a�bzb+=azb za=b=aza=+b=az b=az&b=azb&=a�bad query field: 'b'z a=a+b&b=b+c�a b�b c�r; r= z a=a+b&a=b+a�b azx=1&y=2.0&z=2-3.%2b0�1�2.0�2-3.+0��x�y�zz�Hbc5161168c542333633315dee1182227:key_store_seqid=400006&cuyer=r&view=bustomer&order_id=0bb2e248638833d48cb7fed300000f1b&expire=964546263&lobale=en-US&kid=130003.300038&ss=envZ400006�rZ 964546263z
130003.300038zen-USZ 0bb2e248638833d48cb7fed300000f1br4 Zbustomer)z1Hbc5161168c542333633315dee1182227:key_store_seqidZcuyerZexpireZkidZlobaleZorder_id�ss�viewzQgroup_id=5470&set=custom&_assigned_to=31392&_status=1&_category=100&SUBMIT=BrowseZBrowseZ31392Z100Z5470Zcustom)ZSUBMITZ _assigned_toZ _categoryZ_statusZgroup_id�setc C s t | td�S )N)�key)�sorted�repr)�seqr r r �norm_ r" rR c C � dd� | D �S )Nc S s g | ]}|d �qS )r r ��.0�pr r r �
<listcomp>c s z first_elts.<locals>.<listcomp>r ��listr r r �
first_eltsb � rZ c C rS )Nc S s g | ] }|d |d d f�qS )r r+ r rT r r r rW f s z%first_second_elts.<locals>.<listcomp>r rX r r r �first_second_eltse r[ r\ c C sh d}t | �|��}|�d� tj|||d�}i }t|��� D ]\}}t|t�r,|� |�p.|j
||< q |S )Nr' r )r5 �environ�encoding) r r- �seekr0 � FieldStorage�dict�itemsr rY Zgetlist�value)�datar] r^ Z
fake_stdinZform�result�k�vr r r �
gen_resulth s
rh c @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z e
j e d�dd� �Z
dd� Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%d&gd'd(d)�Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Z d4d5� Z d6S )7�CgiTestsc C sP t t�d��}t�d�dd�}t�||�}dgdgdgdgd�}| �||� d S ) N�latin1�558��boundaryzCONTENT-LENGTH� Add �1234�
Testing 123.
r7 )�submit�id�file�title)r �POSTDATAr- �BOUNDARYr0 �parse_multipart� assertEqual)r r5 r4 re �expectedr r r �test_parse_multipartv s � �z CgiTests.test_parse_multipartc C sF d}t |�d��}dd�d�i}t�||�}ddgi}| �||� d S )NzY--JfISa01
Content-Disposition: form-data; name="submit-name"
just a string
--JfISa01--
rj rm �JfISa01� submit-namezjust a string
)r r- r0 rw rx )r ru r5 r4 re ry r r r �+test_parse_multipart_without_content_length s
z4CgiTests.test_parse_multipart_without_content_lengthc C s� d}d}t |�d��}|�d�tt|�d���d�}tj||ddd�}d d
gi}| �||� | �d �d�|d d �dd�� d S )
Nr{ u] --JfISa01
Content-Disposition: form-data; name="submit-name"
Content-Length: 3
☃
--JfISa01�utf8rj rl �ascii�surrogateescape)r^ �errorsr| u ���u ☃r )r r- r r. r0 rw rx )r rv ru r5 r4 re ry r r r �%test_parse_multipart_invalid_encoding� s �
�
�z.CgiTests.test_parse_multipart_invalid_encodingc C s^ t �� }| �|� | �dt|�� | �t|�t|�� �� |j�t dd�d�� | �
|� d S )Nr` ZMockFieldStorage�nameZ
fieldvalue) r0 r` � assertFalse�assertInrP rx rY �keys�appendr �
assertTrue�r �fsr r r � test_fieldstorage_properties� s
z%CgiTests.test_fieldstorage_propertiesc C sL | j ttjdddid� | � ttjdd� tjddid �}| � tt|� d S )
Nznot-a-file-objr$ �PUT�r] ZfooZbarz content-type�
text/plain)Zheaders)� assertRaises� TypeErrorr0 r` �boolr� r r r �test_fieldstorage_invalid� s �z"CgiTests.test_fieldstorage_invalidc C s t D ]}\}}t|d�}| �||dt|� � t|d�}| �||dt|� � d|i}tj|d�}t|t�r| �t|�t|�� | � |�
� |�
� � | �|� dd�d� |�
� D ]'}|| }| � ||� t|�d krs| �|� |�|� qW| �|� |�|d
� qWqd S ) Nr# zError parsing %s method GETr& z Error parsing %s method POSTr% r� znonexistent field�defaultr+ r )
�parse_strict_test_casesr6 rx rP r0 r` r ra r. ZassertCountEqualr� �getvaluer� )r �orig�expect�dr4 r� rN �
expect_valr r r � test_strict� s&
��zCgiTests.test_strictc C s ddgdgd�fddgdgdgd�fdt d �fd
t d �fd t d �fd
t d �fdt d�fddgdgd�fddddgifg }|D ]@\}}d|i}tjd|d�}t|t�r~|�� D ]'}|| }| �||� t|�dkrr| �|� |�|� qV| �|� |�|d � qVq>d S )Nz x=1;y=2.0rC rD )rG rH zx=1;y=2.0;z=2-3.%2b0rE rF �;r8 z;;z=;ar< z;b=azb;=ar> z a=a+b;b=b+cr? r@ rA z a=a+b;a=b+ar; rB r% )� separatorr] r+ r )
r/ r0 r` r ra r� r� r. rx r� )r Zparse_semicolonr� r� r4 r� rN r� r r r �test_separator� s,
�
��zCgiTests.test_separator)�categoryc C s� t �d� t� t _t �dd� t �dd� | �t j�� d� tj� tj
�r?d t _tj
t _ t �dd� | � t j
� t �d� d S d S )NZTestingz%szTesting initlog 1z
Testing log 2z Testing initlog 1
Testing log 2
z
Testing log 3z
Testing log 4)r0 �logr �logfp�initlogrx r� �os�path�exists�devnull�logfile�
addCleanup�closelogr r r r �test_log� s
�zCgiTests.test_logc C s~ G dd� d�}|t �d��}| �|j� |�dd � |�d� ddi}tj||d �}| �|jj� | � |j
d
� |�� d S ) Nc @ s& e Zd Zdd� Zddd�Zdd� ZdS ) z=CgiTests.test_fieldstorage_readline.<locals>.TestReadlineFilec S s || _ d| _d S )Nr )rs �numcalls)r rs r r r r � s
zFCgiTests.test_fieldstorage_readline.<locals>.TestReadlineFile.__init__Nc S s( | j d7 _ |r| j�|�S | j�� S )Nr+ )r� rs �readline)r �sizer r r r� � s
zFCgiTests.test_fieldstorage_readline.<locals>.TestReadlineFile.readlinec S s. | j d }t||�}t|t�st| ||� |S )Nrs )�__dict__r r �int�setattr)r r� rs r; r r r r! s
zICgiTests.test_fieldstorage_readline.<locals>.TestReadlineFile.__getattr__r )r r r
r r� r! r r r r �TestReadlineFile� s
r� zwb+s xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxi r r$ r� �r5 r] � ) �tempfile�
TemporaryFiler� �close�writer_ r0 r` rs Z
assertGreaterr� )r r� �fr4 r� r r r �test_fieldstorage_readline� s
z#CgiTests.test_fieldstorage_readlinec C s� dd� t�dd�}tt�d��}tj||dd�}| �t|j �d� dd d d
�d d d d
�d
ddd
�dd dd
�g}t
t|j ��D ]}|| � � D ]\}}t |j | |�}| �||� qFq>d S )Nr& � multipart/form-data; boundary={}rk �r$ r) r* r' �r] r^ � rr ro �r� �filenamerc rt r7 rs �test.txtrp rq rn �
�formatrv r ru r- r0 r` rx r. rY �rangerb r � r r4 r5 r� r� rG rf �exp�gotr r r �test_fieldstorage_multipart s$ �
���z$CgiTests.test_fieldstorage_multipartc C s� dd� t�dd�}tdt�d� �}tj||dd�}| �t|j �d� d d d
d �d d d
d �dddd �dd dd �g}t
t|j ��D ]}|| � � D ]\}}t |j | |�}| �||� qHq@d S )Nr& r� Z560r� s
r' r� r� rr ro r� rt r7 rs r� rp rq rn r� r� r r r �.test_fieldstorage_multipart_leading_whitespace& s$ �
���z7CgiTests.test_fieldstorage_multipart_leading_whitespacec
C s� dd� t�dd�}dD ]D}tt�|��}tj|||d�}| �t|j �d� dd d d
�g}t
t|j ��D ]}|| � � D ]\}}t |j | |�} | �| |� q;q3q d S ) Nr& r� rk r� )z
iso-8859-1zutf-8r� r+ rr u çñr� )
r� rv r �POSTDATA_NON_ASCIIr- r0 r` rx r. rY r� rb r )
r r4 r^ r5 r� r� rG rf r� r� r r r �%test_fieldstorage_multipart_non_ascii9 s ����z.CgiTests.test_fieldstorage_multipart_non_asciic s^ d}d � _ � fdd�}|d|d � |d|d d � |d|d d d|d � d S )Ni c sD d� dd�| }tt|��ddd�}� �t||�d| �d�i� d S ) Nzp---123
Content-Disposition: form-data; name="upload"; filename="fake.txt"
Content-Type: text/plain
%s
---123--
�
z
�"multipart/form-data; boundary=-123r& �r* r) r$ �uploadrj )�replacer r. rx rh r- )�contentrd r] r r r �checkL s
�
� �z;CgiTests.test_fieldstorage_multipart_maxline.<locals>.checkrG r+ �
rH )ZmaxDiff)r Zmaxliner� r r r �#test_fieldstorage_multipart_maxlineH s $z,CgiTests.test_fieldstorage_multipart_maxlinec
C s dd� t�ttt��d�}tt�d��}tj||dd�}| � t|j
�d� | � |j
d j d� | � |j
d j d � | � |j
d
j d � |j
d
j }| � t|�d� d d d
d�d ddd�g}t
t|��D ]}|| �� D ]\}}t|| |�} | � | |� qkqcd S )Nr& r� r� r' r� r� r r| �Larryr+ �filesz file1.txts ... contents of file1.txt ...r� z file2.gifs ...contents of file2.gif...)r� � BOUNDARY_W3r r. � POSTDATA_W3r r- r0 r` rx rY r� rc r� rb r )
r r4 r5 r� r� r� rG rf r� r� r r r � test_fieldstorage_multipart_w3c_ s*
�
���z(CgiTests.test_fieldstorage_multipart_w3cc C s~ d}d}dd� |�tt|��d�}t|�d��}tj||dd�}| �t|j�d� | �|jd j d
� | �|jd j
d � d S ) Nr{ z_--JfISa01
Content-Disposition: form-data; name="submit-name"
Content-Length: 5
Larry
--JfISa01r& r� r� r' r� r+ r r| r� ) r� r r. r r- r0 r` rx rY r� rc )r rv ru r4 r5 r� r r r �%test_fieldstorage_part_content_lengtht s
�z.CgiTests.test_fieldstorage_part_content_lengthc C s@ t d�}dd|d�}tj||d�}| �t|d j�� �d� d S )Nsa --MyBoundary
Content-Disposition: form-data; name="my-arg"; filename="foo"
Test
--MyBoundary--
r& z(multipart/form-data; boundary=MyBoundary)r$ r) z
wsgi.inputr� zmy-arg� )r r0 r` rx r. rs �read)r r5 r4 �fieldsr r r �.test_field_storage_multipart_no_content_length� s � z7CgiTests.test_field_storage_multipart_no_content_lengthc C s� t d�}ddi}tj||d��}|j�� }| �|jj� W d � n1 s&w Y | �|jj� | �|d� | � t
d�� |j�� W d � d S 1 sOw Y d S )Ns
xxxxxxxxxxr$ r� r� Z
xxxxxxxxxxz I/O operation on closed file) r r0 r` rs r� r� �closedr� rx ZassertRaisesRegexr/ )r r5 r4 r� r� r r r �$test_fieldstorage_as_context_manager� s
� "�z-CgiTests.test_fieldstorage_as_context_managerZvalue1Zvalue2xZvalue2yZvalue3Zvalue4)Zkey1Zkey2Zkey3Zkey4c C �6 d}t t|��dddd�}t||�}| �| j|� d S )Nz$key2=value2x&key3=value3&key4=value4r( zkey1=value1&key2=value2yr& �r* r) r% r$ �r r. rh rx �
_qs_result�r rd r] rg r r r �testQSAndUrlEncode� s
�
zCgiTests.testQSAndUrlEncodec C s� d� dgd �}tt|��ddd�}| �t�� tjt|�� �|dd� W d � n1 s.w Y d }tt|��d
d dd �}| �t�� tjt|�� �|d
d� W d � n1 s\w Y tjt|�� �|dd� d S )Nr9 za=a� r( r& r� �
)r5 r] �max_num_fieldsz�---123
Content-Disposition: form-data; name="a"
3
---123
Content-Type: application/x-www-form-urlencoded
a=4
---123
Content-Type: application/x-www-form-urlencoded
a=5
---123--
r� za=1&a=2r� r� r� ) �joinr r. r� r/ r0 r` r r- )r rd r] r r r �test_max_num_fields� s<
�
� �
�
� �
�z CgiTests.test_max_num_fieldsc C r� )Nz�---123
Content-Disposition: form-data; name="key2"
value2y
---123
Content-Disposition: form-data; name="key3"
value3
---123
Content-Disposition: form-data; name="key4"
value4
---123--
r� �key1=value1&key2=value2xr& r� r� r� r r r �testQSAndFormData� s
�
zCgiTests.testQSAndFormDatac C sL d}t t|��dddd�}| j�� }|�ddi� t||�}| �||� d S )NaE ---123
Content-Disposition: form-data; name="key2"
value2y
---123
Content-Disposition: form-data; name="key3"
value3
---123
Content-Disposition: form-data; name="key4"
value4
---123
Content-Disposition: form-data; name="upload"; filename="fake.txt"
Content-Type: text/plain
this is the content of the fake file
---123--
r� r� r& r� r� s% this is the content of the fake file
)r r. r� �copy�updaterh rx )r rd r] re rg r r r �testQSAndFormDataFile s
�
�
z CgiTests.testQSAndFormDataFilec C s� | � t�d�di f� | � t�d�di f� | � t�d�dddif� | � t�d�dddif� | � t�d�ddd d
�f� | � t�d �d d
dif� | � t�d�d d
dif� | � t�d�d ddd�f� | � t�d�dddd�f� d S )Nr� z text/vnd.just.made.this.up ; ztext/vnd.just.made.this.upztext/plain;charset=us-ascii�charsetzus-asciiz text/plain ; charset="us-ascii"z,text/plain ; charset="us-ascii"; another=opt�opt)r� Zanotherz attachment; filename="silly.txt"Z
attachmentr� z silly.txtz#attachment; filename="strange;name"z strange;namez-attachment; filename="strange;name";size=123;Z123)r� r� z-form-data; name="files"; filename="fo\"o;bar"z form-datar� zfo"o;bar)r� r� )rx r0 Z parse_headerr r r r �test_parse_header# sH ��
�
� �
�
� � �zCgiTests.test_parse_headerc C s h d�}t j| t|d� d S )N> Zvalid_boundaryr� �maxlenr� r� r� r� ZnologZdolog)� not_exported)r Z check__all__r0 )r r� r r r �test_all@ s zCgiTests.test_allN) r r r
rz r} r� r� r� r� r� r Zignore_warnings�DeprecationWarningr� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r ri t s<
% � 6" ri z6---------------------------721837373350705526688164684a -----------------------------721837373350705526688164684
Content-Disposition: form-data; name="id"
1234
-----------------------------721837373350705526688164684
Content-Disposition: form-data; name="title"
-----------------------------721837373350705526688164684
Content-Disposition: form-data; name="file"; filename="test.txt"
Content-Type: text/plain
Testing 123.
-----------------------------721837373350705526688164684
Content-Disposition: form-data; name="submit"
Add
-----------------------------721837373350705526688164684--
u� -----------------------------721837373350705526688164684
Content-Disposition: form-data; name="id"
çñ
-----------------------------721837373350705526688164684
ZAaB03xa� --AaB03x
Content-Disposition: form-data; name="submit-name"
Larry
--AaB03x
Content-Disposition: form-data; name="files"
Content-Type: multipart/mixed; boundary=BbC04y
--BbC04y
Content-Disposition: file; filename="file1.txt"
Content-Type: text/plain
... contents of file1.txt ...
--BbC04y
Content-Disposition: file; filename="file2.gif"
Content-Type: image/gif
Content-Transfer-Encoding: binary
...contents of file2.gif...
--BbC04y--
--AaB03x--
�__main__) r0 r� r r� Zunittest� collectionsr �ior r �testr Z test.supportr r r r6 r/ r� rR rZ r\ rh ZTestCaseri rv ru r� r� r� r �mainr r r r �<module> s�
�� ���* V �