cpython/Lib/http/server.py at 3.15 · python/cpython · GitHub

Repository navigation

History

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

467

468

469

470

471

472

473

474

475

476

477

478

479

480

481

482

483

484

485

486

487

488

489

490

491

492

493

494

495

496

497

498

499

500

501

502

503

504

505

506

507

508

509

510

511

512

513

514

515

516

517

518

519

520

521

522

523

524

525

526

527

528

529

530

531

532

533

534

535

536

537

538

539

540

541

542

543

544

545

546

547

548

549

550

551

552

553

554

555

556

557

558

559

560

561

562

563

564

565

566

567

568

569

570

571

572

573

574

575

576

577

578

579

580

581

582

583

584

585

586

587

588

589

590

591

592

593

594

595

596

597

598

599

600

601

602

603

604

605

606

607

608

609

610

611

612

613

614

615

616

617

618

619

620

621

622

623

624

625

626

627

628

629

630

631

632

633

634

635

636

637

638

639

640

641

642

643

644

645

646

647

648

649

650

651

652

653

654

655

656

657

658

659

660

661

662

663

664

665

666

667

668

669

670

671

672

673

674

675

676

677

678

679

680

681

682

683

684

685

686

687

688

689

690

691

692

693

694

695

696

697

698

699

700

701

702

703

704

705

706

707

708

709

710

711

712

713

714

715

716

717

718

719

720

721

722

723

724

725

726

727

728

729

730

731

732

733

734

735

736

737

738

739

740

741

742

743

744

745

746

747

748

749

750

751

752

753

754

755

756

757

758

759

760

761

762

763

764

765

766

767

768

769

770

771

772

773

774

775

776

777

778

779

780

781

782

783

784

785

786

787

788

789

790

791

792

793

794

795

796

797

798

799

800

801

802

803

804

805

806

807

808

809

810

811

812

813

814

815

816

817

818

819

820

821

822

823

824

825

826

827

828

829

830

831

832

833

834

835

836

837

838

839

840

841

842

843

844

845

846

847

848

849

850

851

852

853

854

855

856

857

858

859

860

861

862

863

864

865

866

867

868

869

870

871

872

873

874

875

876

877

878

879

880

881

882

883

884

885

886

887

888

889

890

891

892

893

894

895

896

897

898

899

900

901

902

903

904

905

906

907

908

909

910

911

912

913

914

915

916

917

918

919

920

921

922

923

924

925

926

927

928

929

930

931

932

933

934

935

936

937

938

939

940

941

942

943

944

945

946

947

948

949

950

951

952

953

954

955

956

957

958

959

960

961

962

963

964

965

966

967

968

969

970

971

972

973

974

975

976

977

978

979

980

981

982

983

984

985

986

987

988

989

990

991

992

993

994

995

996

997

998

999

1000

"""HTTP server classes.

Note: BaseHTTPRequestHandler doesn't implement any HTTP request; see

SimpleHTTPRequestHandler for simple implementations of GET, HEAD and POST.

It does, however, optionally implement HTTP/1.1 persistent connections.

XXX To do:

- log requests even later (to capture byte count)

- log user-agent header and other interesting goodies

- send error log to separate file

"""

# See also:

# HTTP Working Group T. Berners-Lee

# INTERNET-DRAFT R. T. Fielding

# <draft-ietf-http-v10-spec-00.txt> H. Frystyk Nielsen

# Expires September 8, 1995 March 8, 1995

# URL: http://www.ics.uci.edu/pub/ietf/http/draft-ietf-http-v10-spec-00.txt

# and

# Network Working Group R. Fielding

# Request for Comments: 2616 et al

# Obsoletes: 2068 June 1999

# Category: Standards Track

# URL: http://www.faqs.org/rfcs/rfc2616.html

# Log files

# ---------

# Here's a quote from the NCSA httpd docs about log file format.

# | The logfile format is as follows. Each line consists of:

# |

# | host rfc931 authuser [DD/Mon/YYYY:hh:mm:ss] "request" ddd bbbb

# |

# | host: Either the DNS name or the IP number of the remote client

# | rfc931: Any information returned by identd for this person,

# | - otherwise.

# | authuser: If user sent a userid for authentication, the user name,

# | - otherwise.

# | DD: Day

# | Mon: Month (calendar name)

# | YYYY: Year

# | hh: hour (24-hour format, the machine's timezone)

# | mm: minutes

# | ss: seconds

# | request: The first line of the HTTP request as sent by the client.

# | ddd: the status code returned by the server, - if not available.

# | bbbb: the total number of bytes sent,

# | *not including the HTTP/1.0 header*, - if not available

# |

# | You can determine the name of the file accessed through request.

# (Actually, the latter is only true if you know the server configuration

# at the time the request was made!)

__all__ = [

"HTTPServer", "ThreadingHTTPServer",

"HTTPSServer", "ThreadingHTTPSServer",

"BaseHTTPRequestHandler", "SimpleHTTPRequestHandler",

]

import datetime

import email.utils

import html

import http.client

import io

import itertools

import mimetypes

import os

import posixpath

import shutil

import socket

import socketserver

import sys

import time

import urllib.parse

from http import HTTPStatus

lazy import _colorize

# Default error message template

DEFAULT_ERROR_MESSAGE = """\

<!DOCTYPE HTML>

<head>

:root {

color-scheme: light dark;

}

</style>

<title>Error response</title>

</head>

<body>

<h1>Error response</h1>

<p>Error code: %(code)d</p>

<p>Message: %(message)s.</p>

<p>Error code explanation: %(code)s - %(explain)s.</p>

</body>

</html>

"""

DEFAULT_ERROR_CONTENT_TYPE = "text/html;charset=utf-8"

class HTTPServer(socketserver.TCPServer):

allow_reuse_address = True # Seems to make sense in testing environment

allow_reuse_port = False

def server_bind(self):

"""Override server_bind to store the server name."""

socketserver.TCPServer.server_bind(self)

host, port = self.server_address[:2]

self.server_name = socket.getfqdn(host)

self.server_port = port

class ThreadingHTTPServer(socketserver.ThreadingMixIn, HTTPServer):

daemon_threads = True

class HTTPSServer(HTTPServer):

def __init__(self, server_address, RequestHandlerClass,

bind_and_activate=True, *, certfile, keyfile=None,

password=None, alpn_protocols=None):

try:

import ssl

except ImportError:

raise RuntimeError("SSL module is missing; "

"HTTPS support is unavailable")

self.ssl = ssl

self.certfile = certfile

self.keyfile = keyfile

self.password = password

# Support by default HTTP/1.1

self.alpn_protocols = (

["http/1.1"] if alpn_protocols is None else alpn_protocols

)

super().__init__(server_address,

RequestHandlerClass,

bind_and_activate)

def server_activate(self):

"""Wrap the socket in SSLSocket."""

super().server_activate()

context = self._create_context()

self.socket = context.wrap_socket(self.socket, server_side=True)

def _create_context(self):

"""Create a secure SSL context."""

context = self.ssl.create_default_context(self.ssl.Purpose.CLIENT_AUTH)

context.load_cert_chain(self.certfile, self.keyfile, self.password)

context.set_alpn_protocols(self.alpn_protocols)

return context

class ThreadingHTTPSServer(socketserver.ThreadingMixIn, HTTPSServer):

daemon_threads = True

class BaseHTTPRequestHandler(socketserver.StreamRequestHandler):

"""HTTP request handler base class.

The following explanation of HTTP serves to guide you through the

code as well as to expose any misunderstandings I may have about

HTTP (so you don't need to read the code to figure out I'm wrong

:-).

HTTP (HyperText Transfer Protocol) is an extensible protocol on

top of a reliable stream transport (e.g. TCP/IP). The protocol

recognizes three parts to a request:

1. One line identifying the request type and path

2. An optional set of RFC-822-style headers

3. An optional data part

The headers and data are separated by a blank line.

The first line of the request has the form

where <command> is a (case-sensitive) keyword such as GET or POST,

<path> is a string containing path information for the request,

and <version> should be the string "HTTP/1.0" or "HTTP/1.1".

<path> is encoded using the URL encoding scheme (using %xx to signify

the ASCII character with hex code xx).

The specification specifies that lines are separated by CRLF but

for compatibility with the widest range of clients recommends

servers also handle LF. Similarly, whitespace in the request line

is treated sensibly (allowing multiple spaces between components

and allowing trailing whitespace).

Similarly, for output, lines ought to be separated by CRLF pairs

but most clients grok LF characters just fine.

If the first line of the request has the form

(i.e. <version> is left out) then this is assumed to be an HTTP

0.9 request; this form has no optional headers and data part and

the reply consists of just the data.

The reply form of the HTTP 1.x protocol again has three parts:

1. One line giving the response code

2. An optional set of RFC-822-style headers

3. The data

Again, the headers and data are separated by a blank line.

The response code line has the form

where <version> is the protocol version ("HTTP/1.0" or "HTTP/1.1"),

<responsecode> is a 3-digit response code indicating success or

failure of the request, and <responsestring> is an optional

human-readable string explaining what the response code means.

This server parses the request and the headers, and then calls a

function specific to the request type (<command>). Specifically,

a request SPAM will be handled by a method do_SPAM(). If no

such method exists the server sends an error response to the

client. If it exists, it is called with no arguments:

do_SPAM()

Note that the request name is case sensitive (i.e. SPAM and spam

are different requests).

The various request details are stored in instance variables:

- client_address is the client IP address in the form (host,

port);

- command, path and version are the broken-down request line;

- headers is an instance of email.message.Message (or a derived

class) containing the header information;

- rfile is a file object open for reading positioned at the

start of the optional input data part;

- wfile is a file object open for writing.

IT IS IMPORTANT TO ADHERE TO THE PROTOCOL FOR WRITING!

The first thing to be written must be the response line. Then

follow 0 or more header lines, then a blank line, and then the

actual data (if any). The meaning of the header lines depends on

the command executed by the server; in most cases, when data is

returned, there should be at least one header line of the form

Content-type: <type>/<subtype>

where <type> and <subtype> should be registered MIME types,

e.g. "text/html" or "text/plain".

"""

# The Python system version, truncated to its first component.

sys_version = "Python/" + sys.version.split()[0]

# The server software version. You may want to override this.

# The format is multiple whitespace-separated strings,

# where each string is of the form name[/version].

server_version = "BaseHTTP"

error_message_format = DEFAULT_ERROR_MESSAGE

error_content_type = DEFAULT_ERROR_CONTENT_TYPE

# The default request version. This only affects responses up until

# the point where the request line is parsed, so it mainly decides what

# the client gets back when sending a malformed request line.

# Most web servers default to HTTP 0.9, i.e. don't send a status line.

default_request_version = "HTTP/0.9"

def parse_request(self):

"""Parse a request (internal).

The request should be stored in self.raw_requestline; the results

are in self.command, self.path, self.request_version and

self.headers.

Return True for success, False for failure; on failure, any relevant

error response has already been sent back.

"""

is_http_0_9 = False

self.command = None # set in case of error on the first line

self.request_version = version = self.default_request_version

self.close_connection = True

requestline = str(self.raw_requestline, 'iso-8859-1')

requestline = requestline.rstrip('\r\n')

self.requestline = requestline

words = requestline.split()

if len(words) == 0:

return False

if len(words) >= 3: # Enough to determine protocol version

version = words[-1]

try:

if not version.startswith('HTTP/'):

raise ValueError

base_version_number = version.split('/', 1)[1]

version_number = base_version_number.split(".")

# RFC 2145 section 3.1 says there can be only one "." and

# - major and minor numbers MUST be treated as

# separate integers;

# - HTTP/2.4 is a lower version than HTTP/2.13, which in

# turn is lower than HTTP/12.3;

# - Leading zeros MUST be ignored by recipients.

if len(version_number) != 2:

raise ValueError

if any(not component.isdigit() for component in version_number):

raise ValueError("non digit in http version")

if any(len(component) > 10 for component in version_number):

raise ValueError("unreasonable length http version")

version_number = int(version_number[0]), int(version_number[1])

except (ValueError, IndexError):

# Send the error response with a status line and headers.

self.request_version = ''

self.send_error(

HTTPStatus.BAD_REQUEST,

"Bad request version (%r)" % version)

return False

self.request_version = version

if version_number >= (1, 1) and self.protocol_version >= "HTTP/1.1":

self.close_connection = False

if version_number >= (2, 0):

self.send_error(

HTTPStatus.HTTP_VERSION_NOT_SUPPORTED,

"Invalid HTTP version (%s)" % base_version_number)

return False

if not 2 <= len(words) <= 3:

self.request_version = ''

self.send_error(

HTTPStatus.BAD_REQUEST,

"Bad request syntax (%r)" % requestline)

return False

command, path = words[:2]

if len(words) == 2:

self.close_connection = True

if command != 'GET':

self.request_version = ''

self.send_error(

HTTPStatus.BAD_REQUEST,

"Bad HTTP/0.9 request type (%r)" % command)

return False

is_http_0_9 = True

self.command, self.path = command, path

# gh-87389: The purpose of replacing '//' with '/' is to protect

# against open redirect attacks possibly triggered if the path starts

# with '//' because http clients treat //path as an absolute URI

# without scheme (similar to http://path) rather than a path.

if self.path.startswith('//'):

self.path = '/' + self.path.lstrip('/') # Reduce to a single /

# For HTTP/0.9, headers are not expected at all.

if is_http_0_9:

self.headers = {}

return True

# Examine the headers and look for a Connection directive.

try:

self.headers = http.client.parse_headers(self.rfile,

_class=self.MessageClass)

except http.client.LineTooLong as err:

self.send_error(

HTTPStatus.REQUEST_HEADER_FIELDS_TOO_LARGE,

"Line too long",

str(err))

return False

except http.client.HTTPException as err:

self.send_error(

HTTPStatus.REQUEST_HEADER_FIELDS_TOO_LARGE,

"Too many headers",

str(err)

)

return False

conntype = self.headers.get('Connection', "")

if conntype.lower() == 'close':

self.close_connection = True

elif (conntype.lower() == 'keep-alive' and

self.protocol_version >= "HTTP/1.1"):

self.close_connection = False

# Examine the headers and look for an Expect directive

expect = self.headers.get('Expect', "")

if (expect.lower() == "100-continue" and

self.protocol_version >= "HTTP/1.1" and

self.request_version >= "HTTP/1.1"):

if not self.handle_expect_100():

return False

return True

def handle_expect_100(self):

"""Decide what to do with an "Expect: 100-continue" header.

If the client is expecting a 100 Continue response, we must

respond with either a 100 Continue or a final response before

waiting for the request body. The default is to always respond

with a 100 Continue. You can behave differently (for example,

reject unauthorized requests) by overriding this method.

This method should either return True (possibly after sending

a 100 Continue response) or send an error response and return

False.

"""

self.send_response_only(HTTPStatus.CONTINUE)

self.end_headers()

return True

def handle_one_request(self):

"""Handle a single HTTP request.

You normally don't need to override this method; see the class

__doc__ string for information on how to handle specific HTTP

commands such as GET and POST.

"""

try:

self.raw_requestline = self.rfile.readline(65537)

if len(self.raw_requestline) > 65536:

self.requestline = ''

self.request_version = ''

self.command = ''

self.send_error(HTTPStatus.REQUEST_URI_TOO_LONG)

return

if not self.raw_requestline:

self.close_connection = True

return

if not self.parse_request():

# An error code has been sent, just exit

return

mname = 'do_' + self.command

if not hasattr(self, mname):

self.send_error(

HTTPStatus.NOT_IMPLEMENTED,

"Unsupported method (%r)" % self.command)

return

method = getattr(self, mname)

method()

self.wfile.flush() #actually send the response if not already done.

except TimeoutError as e:

#a read or a write timed out. Discard this connection

self.log_error("Request timed out: %r", e)

self.close_connection = True

return

def handle(self):

"""Handle multiple requests if necessary."""

self.close_connection = True

self.handle_one_request()

while not self.close_connection:

self.handle_one_request()

def send_error(self, code, message=None, explain=None):

"""Send and log an error reply.

Arguments are

* code: an HTTP error code

3 digits

* message: a simple optional 1 line reason phrase.

*( HTAB / SP / VCHAR / %x80-FF )

defaults to short entry matching the response code

* explain: a detailed message defaults to the long entry

matching the response code.

This sends an error response (so it must be called before any

output has been generated), logs the error, and finally sends

a piece of HTML explaining the error to the user.

"""

try:

shortmsg, longmsg = self.responses[code]

except KeyError:

shortmsg, longmsg = '???', '???'

if message is None:

message = shortmsg

if explain is None:

explain = longmsg

self.log_error("code %d, message %s", code, message)

self.send_response(code, message)

self.send_header('Connection', 'close')

# Message body is omitted for cases described in:

# - RFC7230: 3.3. 1xx, 204(No Content), 304(Not Modified)

# - RFC7231: 6.3.6. 205(Reset Content)

body = None

if (code >= 200 and

code not in (HTTPStatus.NO_CONTENT,

HTTPStatus.RESET_CONTENT,

HTTPStatus.NOT_MODIFIED)):

# HTML encode to prevent Cross Site Scripting attacks

# (see bug #1100201)

content = (self.error_message_format % {

'code': code,

'message': html.escape(message, quote=False),

'explain': html.escape(explain, quote=False)

})

body = content.encode('UTF-8', 'replace')

self.send_header("Content-Type", self.error_content_type)

self.send_header('Content-Length', str(len(body)))

self.end_headers()

if self.command != 'HEAD' and body:

self.wfile.write(body)

def send_response(self, code, message=None):

"""Add the response header to the headers buffer and log the

response code.

Also send two standard headers with the server software

version and the current date.

"""

self.log_request(code)

self.send_response_only(code, message)

self.send_header('Server', self.version_string())

self.send_header('Date', self.date_time_string())

def send_response_only(self, code, message=None):

"""Send the response header only."""

if self.request_version != 'HTTP/0.9':

if message is None:

if code in self.responses:

message = self.responses[code][0]

else:

message = ''

if not hasattr(self, '_headers_buffer'):

self._headers_buffer = []

self._headers_buffer.append(("%s %d %s\r\n" %

(self.protocol_version, code, message)).encode(

'latin-1', 'strict'))

def send_header(self, keyword, value, *, _is_extra=False):

"""Send a MIME header to the headers buffer."""

if self.request_version != 'HTTP/0.9':

if not hasattr(self, '_headers_buffer'):

self._headers_buffer = []

self._headers_buffer.append(

("%s: %s\r\n" % (keyword, value)).encode('latin-1', 'strict'))

if not hasattr(self, '_default_response_headers'):

self._default_response_headers = []

if not _is_extra:

self._default_response_headers.append((keyword, value))

if keyword.lower() == 'connection':

if value.lower() == 'close':

self.close_connection = True

elif value.lower() == 'keep-alive':

self.close_connection = False

def end_headers(self):

"""Send the blank line ending the MIME headers."""

if self.request_version != 'HTTP/0.9':

self._headers_buffer.append(b"\r\n")

self.flush_headers()

def flush_headers(self):

if hasattr(self, '_headers_buffer'):

self.wfile.write(b"".join(self._headers_buffer))

self._headers_buffer = []

if hasattr(self, '_default_response_headers'):

self._default_response_headers = []

def _colorize_request(self, code, size, t):

try:

code_int = int(code)

except (TypeError, ValueError):

code_color = ""

else:

if code_int >= 500:

code_color = t.status_server_error

elif code_int >= 400:

code_color = t.status_client_error

elif code_int >= 300:

code_color = t.status_redirect

elif code_int >= 200:

code_color = t.status_ok

else:

code_color = t.status_informational

request_line = self.requestline.translate(self._control_char_table)

parts = request_line.split(None, 2)

if len(parts) == 3:

method, path, version = parts

request_line = f"{method} {t.path}{path}{t.reset} {version}"

return f'"{request_line}" {code_color}{code} {t.size}{size}{t.reset}'

def log_request(self, code='-', size='-'):

"""Log an accepted request.

This is called by send_response().

"""

if isinstance(code, HTTPStatus):

code = code.value

self._log_request_info = (code, size)

self.log_message('"%s" %s %s',

self.requestline, str(code), str(size))

def log_error(self, format, *args):

"""Log an error.

This is called when a request cannot be fulfilled. By

default it passes the message on to log_message().

Arguments are the same as for log_message().

XXX This should go to the separate error log.

"""

self._log_is_error = True

self.log_message(format, *args)

# https://en.wikipedia.org/wiki/List_of_Unicode_characters#Control_codes

_control_char_table = str.maketrans(

{c: fr'\x{c:02x}' for c in itertools.chain(range(0x20), range(0x7f,0xa0))})

_control_char_table[ord('\\')] = r'\\'

def log_message(self, format, *args):

"""Log an arbitrary message.

This is used by all other logging functions. Override

it if you have specific logging wishes.

The first argument, FORMAT, is a format string for the

message to be logged. If the format string contains

any % escapes requiring parameters, they should be

specified as subsequent arguments (it's just like

printf!).

The client ip and current date/time are prefixed to

every message.

Unicode control characters are replaced with escaped hex

before writing the output to stderr.

"""

message = (format % args).translate(self._control_char_table)

t = _colorize.get_theme(tty_file=sys.stderr).http_server

info = getattr(self, "_log_request_info", None)

if info is not None:

self._log_request_info = None

message = self._colorize_request(*info, t)

elif getattr(self, "_log_is_error", False):

self._log_is_error = False

message = f"{t.error}{message}{t.reset}"

sys.stderr.write(

f"{t.timestamp}{self.address_string()} - - "

f"[{self.log_date_time_string()}]{t.reset} "

f"{message}\n"

)

def version_string(self):

"""Return the server software version string."""

return self.server_version + ' ' + self.sys_version

def date_time_string(self, timestamp=None):

"""Return the current date and time formatted for a message header."""

if timestamp is None:

timestamp = time.time()

return email.utils.formatdate(timestamp, usegmt=True)

def log_date_time_string(self):

"""Return the current time formatted for logging."""

now = time.time()

year, month, day, hh, mm, ss, x, y, z = time.localtime(now)

s = "%02d/%3s/%04d %02d:%02d:%02d" % (

day, self.monthname[month], year, hh, mm, ss)

return s

weekdayname = ['Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat', 'Sun']

monthname = [None,

'Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun',

'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec']

def address_string(self):

"""Return the client address."""

return self.client_address[0]

# Essentially static class variables

# The version of the HTTP protocol we support.

# Set this to HTTP/1.1 to enable automatic keepalive

protocol_version = "HTTP/1.0"

# MessageClass used to parse headers

MessageClass = http.client.HTTPMessage

# hack to maintain backwards compatibility

responses = {

v: (v.phrase, v.description)

for v in HTTPStatus.__members__.values()

}

class SimpleHTTPRequestHandler(BaseHTTPRequestHandler):

"""Simple HTTP request handler with GET and HEAD commands.

This serves files from the current directory and any of its

subdirectories. The MIME type for files is determined by

calling the .guess_type() method.

The GET and HEAD requests are identical except that the HEAD

request omits the actual contents of the file.

"""

server_version = "SimpleHTTP"

default_content_type = "application/octet-stream"

index_pages = ("index.html", "index.htm")

extensions_map = _encodings_map_default = {

'.gz': 'application/gzip',

'.Z': 'application/octet-stream',

'.bz2': 'application/x-bzip2',

'.xz': 'application/x-xz',

}

def __init__(self, *args, directory=None, extra_response_headers=None, **kwargs):

if directory is None:

directory = os.getcwd()

self.directory = os.fspath(directory)

self.extra_response_headers = extra_response_headers

super().__init__(*args, **kwargs)

def do_GET(self):

"""Serve a GET request."""

f = self.send_head()

if f:

try:

self.copyfile(f, self.wfile)

finally:

f.close()

def do_HEAD(self):

"""Serve a HEAD request."""

f = self.send_head()

if f:

f.close()

def _send_extra_response_headers(self):

"""Send the headers stored in self.extra_response_headers."""

if self.extra_response_headers is not None:

default_headers = {h.lower() for h, _ in self._default_response_headers}

for header, value in self.extra_response_headers:

# Don't send the header if it's already sent

# as part of the default response headers

if header.lower() not in default_headers:

self.send_header(header, value, _is_extra=True)

def send_head(self):

"""Common code for GET and HEAD commands.

This sends the response code and MIME headers.

Return value is either a file object (which has to be copied

to the outputfile by the caller unless the command was HEAD,

and must be closed by the caller under all circumstances), or

None, in which case the caller has nothing further to do.

"""

path = self.translate_path(self.path)

f = None

if os.path.isdir(path):

parts = urllib.parse.urlsplit(self.path)

if not parts.path.endswith(('/', '%2f', '%2F')):

# redirect browser - doing basically what apache does

self.send_response(HTTPStatus.MOVED_PERMANENTLY)

new_parts = (parts[0], parts[1], parts[2] + '/',

parts[3], parts[4])

new_url = urllib.parse.urlunsplit(new_parts)

self.send_header("Location", new_url)

self.send_header("Content-Length", "0")

self.end_headers()

return None

for index in self.index_pages:

index = os.path.join(path, index)

if os.path.isfile(index):

path = index

break

else:

return self.list_directory(path)

ctype = self.guess_type(path)

# check for trailing "/" which should return 404. See Issue17324

# The test for this was added in test_httpserver.py

# However, some OS platforms accept a trailingSlash as a filename

# See discussion on python-dev and Issue34711 regarding

# parsing and rejection of filenames with a trailing slash

if path.endswith("/"):

self.send_error(HTTPStatus.NOT_FOUND, "File not found")

return None

try:

f = open(path, 'rb')

except OSError:

self.send_error(HTTPStatus.NOT_FOUND, "File not found")

return None

try:

fs = os.fstat(f.fileno())

# Use browser cache if possible

if ("If-Modified-Since" in self.headers

and "If-None-Match" not in self.headers):

# compare If-Modified-Since and time of last file modification

try:

ims = email.utils.parsedate_to_datetime(

self.headers["If-Modified-Since"])

except (TypeError, IndexError, OverflowError, ValueError):

# ignore ill-formed values

pass

else:

if ims.tzinfo is None:

# obsolete format with no timezone, cf.

# https://tools.ietf.org/html/rfc7231#section-7.1.1.1

ims = ims.replace(tzinfo=datetime.timezone.utc)

if ims.tzinfo is datetime.timezone.utc:

# compare to UTC datetime of last modification

last_modif = datetime.datetime.fromtimestamp(

fs.st_mtime, datetime.timezone.utc)

# remove microseconds, like in If-Modified-Since

last_modif = last_modif.replace(microsecond=0)

if last_modif <= ims:

self.send_response(HTTPStatus.NOT_MODIFIED)

self.end_headers()

f.close()

return None

self.send_response(HTTPStatus.OK)

self.send_header("Content-type", ctype)

self.send_header("Content-Length", str(fs[6]))

self.send_header("Last-Modified",

self.date_time_string(fs.st_mtime))

self._send_extra_response_headers()

self.end_headers()

return f

except:

f.close()

raise

def list_directory(self, path):

"""Helper to produce a directory listing (absent index.html).

Return value is either a file object, or None (indicating an

error). In either case, the headers are sent, making the

interface the same as for send_head().

"""

try:

list = os.listdir(path)

except OSError:

self.send_error(

HTTPStatus.NOT_FOUND,

"No permission to list directory")

return None

list.sort(key=lambda a: a.lower())

r = []

displaypath = self.path

displaypath = displaypath.split('#', 1)[0]

displaypath = displaypath.split('?', 1)[0]

try:

displaypath = urllib.parse.unquote(displaypath,

errors='surrogatepass')

except UnicodeDecodeError:

displaypath = urllib.parse.unquote(displaypath)

displaypath = html.escape(displaypath, quote=False)

enc = sys.getfilesystemencoding()

title = f'Directory listing for {displaypath}'

r.append('<!DOCTYPE HTML>')

r.append('<html lang="en">')

r.append('<head>')

r.append(f'<meta charset="{enc}">')

r.append('<style type="text/css">\n:root {\ncolor-scheme: light dark;\n}\n</style>')

r.append(f'<title>{title}</title>\n</head>')

r.append(f'<body>\n<h1>{title}</h1>')

r.append('<hr>\n<ul>')

for name in list:

fullname = os.path.join(path, name)

displayname = linkname = name

# Append / for directories or @ for symbolic links

if os.path.isdir(fullname):

displayname = name + "/"

linkname = name + "/"

if os.path.islink(fullname):

displayname = name + "@"

# Note: a link to a directory displays with @ and links with /

r.append('<li><a href="%s">%s</a></li>'

% (urllib.parse.quote(linkname,

errors='surrogatepass'),

html.escape(displayname, quote=False)))

r.append('</ul>\n<hr>\n</body>\n</html>\n')

encoded = '\n'.join(r).encode(enc, 'surrogateescape')

f = io.BytesIO()

f.write(encoded)

f.seek(0)

self.send_response(HTTPStatus.OK)

self.send_header("Content-type", "text/html; charset=%s" % enc)

self.send_header("Content-Length", str(len(encoded)))

self._send_extra_response_headers()

self.end_headers()

return f

def translate_path(self, path):

"""Translate a /-separated PATH to the local filename syntax.

Components that mean special things to the local file system

(e.g. drive or directory names) are ignored. (XXX They should

probably be diagnosed.)

"""

# abandon query parameters

path = path.split('#', 1)[0]

path = path.split('?', 1)[0]

# Don't forget explicit trailing slash when normalizing. Issue17324

try:

path = urllib.parse.unquote(path, errors='surrogatepass')

except UnicodeDecodeError:

path = urllib.parse.unquote(path)

trailing_slash = path.endswith('/')

path = posixpath.normpath(path)

words = path.split('/')

words = filter(None, words)

path = self.directory

for word in words:

if os.path.dirname(word) or word in (os.curdir, os.pardir):

# Ignore components that are not a simple file/directory name

continue

path = os.path.join(path, word)

if trailing_slash:

path += '/'

return path

def copyfile(self, source, outputfile):

"""Copy all data between two file objects.

The SOURCE argument is a file object open for reading

(or anything with a read() method) and the DESTINATION

argument is a file object open for writing (or

anything with a write() method).

The only reason for overriding this would be to change

the block size or perhaps to replace newlines by CRLF

-- note however that this the default server uses this

to copy binary data as well.

"""

shutil.copyfileobj(source, outputfile)

def guess_type(self, path):

"""Guess the type of a file.

Argument is a PATH (a filename).

Return value is a string of the form type/subtype,

usable for a MIME Content-type header.

The default implementation looks the file's extension

up in the table self.extensions_map, using application/octet-stream

as a default; however it would be permissible (if

slow) to look inside the data to make a better guess.

"""

base, ext = posixpath.splitext(path)

if ext in self.extensions_map:

return self.extensions_map[ext]

ext = ext.lower()

if ext in self.extensions_map:

return self.extensions_map[ext]

guess, _ = mimetypes.guess_file_type(path)

if guess:

return guess

View remainder of file in raw view

cpython/Lib/http/server.py at 3.15 · python/cpython · GitHub

Repository navigation

Expand file tree

Breadcrumbs

server.py

Latest commit

History

Breadcrumbs

server.py

File metadata and controls