1. import gzip

  2. import random

  3. import re

  4. import struct

  5. from io import BytesIO

  6. from urllib.parse import quote

  7. 

  8. from django.conf import settings

  9. from django.core import mail

  10. from django.core.exceptions import PermissionDenied

  11. from django.http import (

  12.     FileResponse,

  13.     HttpRequest,

  14.     HttpResponse,

  15.     HttpResponseNotFound,

  16.     HttpResponsePermanentRedirect,

  17.     HttpResponseRedirect,

  18.     StreamingHttpResponse,

  19. )

  20. from django.middleware.clickjacking import XFrameOptionsMiddleware

  21. from django.middleware.common import BrokenLinkEmailsMiddleware, CommonMiddleware

  22. from django.middleware.gzip import GZipMiddleware

  23. from django.middleware.http import ConditionalGetMiddleware

  24. from django.test import RequestFactory, SimpleTestCase, override_settings

  25. 

  26. int2byte = struct.Struct(">B").pack

  27. 

  28. 

  29. def get_response_empty(request):

  30.     return HttpResponse()

  31. 

  32. 

  33. def get_response_404(request):

  34.     return HttpResponseNotFound()

  35. 

  36. 

  37. @override_settings(ROOT_URLCONF="middleware.urls")

  38. class CommonMiddlewareTest(SimpleTestCase):

  39.     rf = RequestFactory()

  40. 

  41.     @override_settings(APPEND_SLASH=True)

  42.     def test_append_slash_have_slash(self):

  43.         """

  44.         URLs with slashes should go unmolested.

  45.         """

  46.         request = self.rf.get("/slash/")

  47.         self.assertIsNone(CommonMiddleware(get_response_404).process_request(request))

  48.         self.assertEqual(CommonMiddleware(get_response_404)(request).status_code, 404)

  49. 

  50.     @override_settings(APPEND_SLASH=True)

  51.     def test_append_slash_slashless_resource(self):

  52.         """

  53.         Matches to explicit slashless URLs should go unmolested.

  54.         """

  55. 

  56.         def get_response(req):

  57.             return HttpResponse("Here's the text of the web page.")

  58. 

  59.         request = self.rf.get("/noslash")

  60.         self.assertIsNone(CommonMiddleware(get_response).process_request(request))

  61.         self.assertEqual(

  62.             CommonMiddleware(get_response)(request).content,

  63.             b"Here's the text of the web page.",

  64.         )

  65. 

  66.     @override_settings(APPEND_SLASH=True)

  67.     def test_append_slash_slashless_unknown(self):

  68.         """

  69.         APPEND_SLASH should not redirect to unknown resources.

  70.         """

  71.         request = self.rf.get("/unknown")

  72.         response = CommonMiddleware(get_response_404)(request)

  73.         self.assertEqual(response.status_code, 404)

  74. 

  75.     @override_settings(APPEND_SLASH=True)

  76.     def test_append_slash_redirect(self):

  77.         """

  78.         APPEND_SLASH should redirect slashless URLs to a valid pattern.

  79.         """

  80.         request = self.rf.get("/slash")

  81.         r = CommonMiddleware(get_response_empty).process_request(request)

  82.         self.assertEqual(r.status_code, 301)

  83. 

  84.     @override_settings(APPEND_SLASH=True)

  85.     def test_append_slash_redirect_querystring(self):

  86.         """

  87.         APPEND_SLASH should preserve querystrings when redirecting.

  88.         """

  89.         request = self.rf.get("/slash?test=1")

  90.         resp = CommonMiddleware(get_response_404)(request)

  91.         self.assertEqual(resp.url, "/slash/?test=1")

  92. 

  93.     @override_settings(APPEND_SLASH=True)

  94.     def test_append_slash_redirect_querystring_have_slash(self):

  95.         """

  96.         APPEND_SLASH should append slash to path when redirecting a request

  97.         with a querystring ending with slash.

  98.         """

  99.         request = self.rf.get("/slash?test=slash/")

  100.         resp = CommonMiddleware(get_response_404)(request)

  101.         self.assertIsInstance(resp, HttpResponsePermanentRedirect)

  102.         self.assertEqual(resp.url, "/slash/?test=slash/")

  103. 

  104.     @override_settings(APPEND_SLASH=True, DEBUG=True)

  105.     def test_append_slash_no_redirect_on_POST_in_DEBUG(self):

  106.         """

  107.         While in debug mode, an exception is raised with a warning

  108.         when a failed attempt is made to POST, PUT, or PATCH to an URL which

  109.         would normally be redirected to a slashed version.

  110.         """

  111.         msg = "maintaining %s data. Change your form to point to testserver/slash/"

  112.         request = self.rf.get("/slash")

  113.         request.method = "POST"

  114.         with self.assertRaisesMessage(RuntimeError, msg % request.method):

  115.             CommonMiddleware(get_response_404)(request)

  116.         request = self.rf.get("/slash")

  117.         request.method = "PUT"

  118.         with self.assertRaisesMessage(RuntimeError, msg % request.method):

  119.             CommonMiddleware(get_response_404)(request)

  120.         request = self.rf.get("/slash")

  121.         request.method = "PATCH"

  122.         with self.assertRaisesMessage(RuntimeError, msg % request.method):

  123.             CommonMiddleware(get_response_404)(request)

  124. 

  125.     @override_settings(APPEND_SLASH=False)

  126.     def test_append_slash_disabled(self):

  127.         """

  128.         Disabling append slash functionality should leave slashless URLs alone.

  129.         """

  130.         request = self.rf.get("/slash")

  131.         self.assertEqual(CommonMiddleware(get_response_404)(request).status_code, 404)

  132. 

  133.     @override_settings(APPEND_SLASH=True)

  134.     def test_append_slash_opt_out(self):

  135.         """

  136.         Views marked with @no_append_slash should be left alone.

  137.         """

  138.         request = self.rf.get("/sensitive_fbv")

  139.         self.assertEqual(CommonMiddleware(get_response_404)(request).status_code, 404)

  140. 

  141.         request = self.rf.get("/sensitive_cbv")

  142.         self.assertEqual(CommonMiddleware(get_response_404)(request).status_code, 404)

  143. 

  144.     @override_settings(APPEND_SLASH=True)

  145.     def test_append_slash_quoted(self):

  146.         """

  147.         URLs which require quoting should be redirected to their slash version.

  148.         """

  149.         request = self.rf.get(quote("/needsquoting#"))

  150.         r = CommonMiddleware(get_response_404)(request)

  151.         self.assertEqual(r.status_code, 301)

  152.         self.assertEqual(r.url, "/needsquoting%23/")

  153. 

  154.     @override_settings(APPEND_SLASH=True)

  155.     def test_append_slash_leading_slashes(self):

  156.         """

  157.         Paths starting with two slashes are escaped to prevent open redirects.

  158.         If there's a URL pattern that allows paths to start with two slashes, a

  159.         request with path //evil.com must not redirect to //evil.com/ (appended

  160.         slash) which is a schemaless absolute URL. The browser would navigate

  161.         to evil.com/.

  162.         """

  163.         # Use 4 slashes because of RequestFactory behavior.

  164.         request = self.rf.get("////evil.com/security")

  165.         r = CommonMiddleware(get_response_404).process_request(request)

  166.         self.assertEqual(r.status_code, 301)

  167.         self.assertEqual(r.url, "/%2Fevil.com/security/")

  168.         r = CommonMiddleware(get_response_404)(request)

  169.         self.assertEqual(r.status_code, 301)

  170.         self.assertEqual(r.url, "/%2Fevil.com/security/")

  171. 

  172.     @override_settings(APPEND_SLASH=False, PREPEND_WWW=True)

  173.     def test_prepend_www(self):

  174.         request = self.rf.get("/path/")

  175.         r = CommonMiddleware(get_response_empty).process_request(request)

  176.         self.assertEqual(r.status_code, 301)

  177.         self.assertEqual(r.url, "http://www.testserver/path/")

  178. 

  179.     @override_settings(APPEND_SLASH=True, PREPEND_WWW=True)

  180.     def test_prepend_www_append_slash_have_slash(self):

  181.         request = self.rf.get("/slash/")

  182.         r = CommonMiddleware(get_response_empty).process_request(request)

  183.         self.assertEqual(r.status_code, 301)

  184.         self.assertEqual(r.url, "http://www.testserver/slash/")

  185. 

  186.     @override_settings(APPEND_SLASH=True, PREPEND_WWW=True)

  187.     def test_prepend_www_append_slash_slashless(self):

  188.         request = self.rf.get("/slash")

  189.         r = CommonMiddleware(get_response_empty).process_request(request)

  190.         self.assertEqual(r.status_code, 301)

  191.         self.assertEqual(r.url, "http://www.testserver/slash/")

  192. 

  193.     # The following tests examine expected behavior given a custom URLconf that

  194.     # overrides the default one through the request object.

  195. 

  196.     @override_settings(APPEND_SLASH=True)

  197.     def test_append_slash_have_slash_custom_urlconf(self):

  198.         """

  199.         URLs with slashes should go unmolested.

  200.         """

  201.         request = self.rf.get("/customurlconf/slash/")

  202.         request.urlconf = "middleware.extra_urls"

  203.         self.assertIsNone(CommonMiddleware(get_response_404).process_request(request))

  204.         self.assertEqual(CommonMiddleware(get_response_404)(request).status_code, 404)

  205. 

  206.     @override_settings(APPEND_SLASH=True)

  207.     def test_append_slash_slashless_resource_custom_urlconf(self):

  208.         """

  209.         Matches to explicit slashless URLs should go unmolested.

  210.         """

  211. 

  212.         def get_response(req):

  213.             return HttpResponse("web content")

  214. 

  215.         request = self.rf.get("/customurlconf/noslash")

  216.         request.urlconf = "middleware.extra_urls"

  217.         self.assertIsNone(CommonMiddleware(get_response).process_request(request))

  218.         self.assertEqual(

  219.             CommonMiddleware(get_response)(request).content, b"web content"

  220.         )

  221. 

  222.     @override_settings(APPEND_SLASH=True)

  223.     def test_append_slash_slashless_unknown_custom_urlconf(self):

  224.         """

  225.         APPEND_SLASH should not redirect to unknown resources.

  226.         """

  227.         request = self.rf.get("/customurlconf/unknown")

  228.         request.urlconf = "middleware.extra_urls"

  229.         self.assertIsNone(CommonMiddleware(get_response_404).process_request(request))

  230.         self.assertEqual(CommonMiddleware(get_response_404)(request).status_code, 404)

  231. 

  232.     @override_settings(APPEND_SLASH=True)

  233.     def test_append_slash_redirect_custom_urlconf(self):

  234.         """

  235.         APPEND_SLASH should redirect slashless URLs to a valid pattern.

  236.         """

  237.         request = self.rf.get("/customurlconf/slash")

  238.         request.urlconf = "middleware.extra_urls"

  239.         r = CommonMiddleware(get_response_404)(request)

  240.         self.assertIsNotNone(

  241.             r,

  242.             "CommonMiddleware failed to return APPEND_SLASH redirect using "

  243.             "request.urlconf",

  244.         )

  245.         self.assertEqual(r.status_code, 301)

  246.         self.assertEqual(r.url, "/customurlconf/slash/")

  247. 

  248.     @override_settings(APPEND_SLASH=True, DEBUG=True)

  249.     def test_append_slash_no_redirect_on_POST_in_DEBUG_custom_urlconf(self):

  250.         """

  251.         While in debug mode, an exception is raised with a warning

  252.         when a failed attempt is made to POST to an URL which would normally be

  253.         redirected to a slashed version.

  254.         """

  255.         request = self.rf.get("/customurlconf/slash")

  256.         request.urlconf = "middleware.extra_urls"

  257.         request.method = "POST"

  258.         with self.assertRaisesMessage(RuntimeError, "end in a slash"):

  259.             CommonMiddleware(get_response_404)(request)

  260. 

  261.     @override_settings(APPEND_SLASH=False)

  262.     def test_append_slash_disabled_custom_urlconf(self):

  263.         """

  264.         Disabling append slash functionality should leave slashless URLs alone.

  265.         """

  266.         request = self.rf.get("/customurlconf/slash")

  267.         request.urlconf = "middleware.extra_urls"

  268.         self.assertIsNone(CommonMiddleware(get_response_404).process_request(request))

  269.         self.assertEqual(CommonMiddleware(get_response_404)(request).status_code, 404)

  270. 

  271.     @override_settings(APPEND_SLASH=True)

  272.     def test_append_slash_quoted_custom_urlconf(self):

  273.         """

  274.         URLs which require quoting should be redirected to their slash version.

  275.         """

  276.         request = self.rf.get(quote("/customurlconf/needsquoting#"))

  277.         request.urlconf = "middleware.extra_urls"

  278.         r = CommonMiddleware(get_response_404)(request)

  279.         self.assertIsNotNone(

  280.             r,

  281.             "CommonMiddleware failed to return APPEND_SLASH redirect using "

  282.             "request.urlconf",

  283.         )

  284.         self.assertEqual(r.status_code, 301)

  285.         self.assertEqual(r.url, "/customurlconf/needsquoting%23/")

  286. 

  287.     @override_settings(APPEND_SLASH=False, PREPEND_WWW=True)

  288.     def test_prepend_www_custom_urlconf(self):

  289.         request = self.rf.get("/customurlconf/path/")

  290.         request.urlconf = "middleware.extra_urls"

  291.         r = CommonMiddleware(get_response_empty).process_request(request)

  292.         self.assertEqual(r.status_code, 301)

  293.         self.assertEqual(r.url, "http://www.testserver/customurlconf/path/")

  294. 

  295.     @override_settings(APPEND_SLASH=True, PREPEND_WWW=True)

  296.     def test_prepend_www_append_slash_have_slash_custom_urlconf(self):

  297.         request = self.rf.get("/customurlconf/slash/")

  298.         request.urlconf = "middleware.extra_urls"

  299.         r = CommonMiddleware(get_response_empty).process_request(request)

  300.         self.assertEqual(r.status_code, 301)

  301.         self.assertEqual(r.url, "http://www.testserver/customurlconf/slash/")

  302. 

  303.     @override_settings(APPEND_SLASH=True, PREPEND_WWW=True)

  304.     def test_prepend_www_append_slash_slashless_custom_urlconf(self):

  305.         request = self.rf.get("/customurlconf/slash")

  306.         request.urlconf = "middleware.extra_urls"

  307.         r = CommonMiddleware(get_response_empty).process_request(request)

  308.         self.assertEqual(r.status_code, 301)

  309.         self.assertEqual(r.url, "http://www.testserver/customurlconf/slash/")

  310. 

  311.     # Tests for the Content-Length header

  312. 

  313.     def test_content_length_header_added(self):

  314.         def get_response(req):

  315.             response = HttpResponse("content")

  316.             self.assertNotIn("Content-Length", response)

  317.             return response

  318. 

  319.         response = CommonMiddleware(get_response)(self.rf.get("/"))

  320.         self.assertEqual(int(response.headers["Content-Length"]), len(response.content))

  321. 

  322.     def test_content_length_header_not_added_for_streaming_response(self):

  323.         def get_response(req):

  324.             response = StreamingHttpResponse("content")

  325.             self.assertNotIn("Content-Length", response)

  326.             return response

  327. 

  328.         response = CommonMiddleware(get_response)(self.rf.get("/"))

  329.         self.assertNotIn("Content-Length", response)

  330. 

  331.     def test_content_length_header_not_changed(self):

  332.         bad_content_length = 500

  333. 

  334.         def get_response(req):

  335.             response = HttpResponse()

  336.             response.headers["Content-Length"] = bad_content_length

  337.             return response

  338. 

  339.         response = CommonMiddleware(get_response)(self.rf.get("/"))

  340.         self.assertEqual(int(response.headers["Content-Length"]), bad_content_length)

  341. 

  342.     # Other tests

  343. 

  344.     @override_settings(DISALLOWED_USER_AGENTS=[re.compile(r"foo")])

  345.     def test_disallowed_user_agents(self):

  346.         request = self.rf.get("/slash")

  347.         request.META["HTTP_USER_AGENT"] = "foo"

  348.         with self.assertRaisesMessage(PermissionDenied, "Forbidden user agent"):

  349.             CommonMiddleware(get_response_empty).process_request(request)

  350. 

  351.     def test_non_ascii_query_string_does_not_crash(self):

  352.         """Regression test for #15152"""

  353.         request = self.rf.get("/slash")

  354.         request.META["QUERY_STRING"] = "drink=café"

  355.         r = CommonMiddleware(get_response_empty).process_request(request)

  356.         self.assertEqual(r.status_code, 301)

  357. 

  358.     def test_response_redirect_class(self):

  359.         request = self.rf.get("/slash")

  360.         r = CommonMiddleware(get_response_404)(request)

  361.         self.assertEqual(r.status_code, 301)

  362.         self.assertEqual(r.url, "/slash/")

  363.         self.assertIsInstance(r, HttpResponsePermanentRedirect)

  364. 

  365.     def test_response_redirect_class_subclass(self):

  366.         class MyCommonMiddleware(CommonMiddleware):

  367.             response_redirect_class = HttpResponseRedirect

  368. 

  369.         request = self.rf.get("/slash")

  370.         r = MyCommonMiddleware(get_response_404)(request)

  371.         self.assertEqual(r.status_code, 302)

  372.         self.assertEqual(r.url, "/slash/")

  373.         self.assertIsInstance(r, HttpResponseRedirect)

  374. 

  375. 

  376. @override_settings(

  377.     IGNORABLE_404_URLS=[re.compile(r"foo")],

  378.     MANAGERS=[("PHD", "[email protected]")],

  379. )

  380. class BrokenLinkEmailsMiddlewareTest(SimpleTestCase):

  381.     rf = RequestFactory()

  382. 

  383.     def setUp(self):

  384.         self.req = self.rf.get("/regular_url/that/does/not/exist")

  385. 

  386.     def get_response(self, req):

  387.         return self.client.get(req.path)

  388. 

  389.     def test_404_error_reporting(self):

  390.         self.req.META["HTTP_REFERER"] = "/another/url/"

  391.         BrokenLinkEmailsMiddleware(self.get_response)(self.req)

  392.         self.assertEqual(len(mail.outbox), 1)

  393.         self.assertIn("Broken", mail.outbox[0].subject)

  394. 

  395.     def test_404_error_reporting_no_referer(self):

  396.         BrokenLinkEmailsMiddleware(self.get_response)(self.req)

  397.         self.assertEqual(len(mail.outbox), 0)

  398. 

  399.     def test_404_error_reporting_ignored_url(self):

  400.         self.req.path = self.req.path_info = "foo_url/that/does/not/exist"

  401.         BrokenLinkEmailsMiddleware(self.get_response)(self.req)

  402.         self.assertEqual(len(mail.outbox), 0)

  403. 

  404.     def test_custom_request_checker(self):

  405.         class SubclassedMiddleware(BrokenLinkEmailsMiddleware):

  406.             ignored_user_agent_patterns = (

  407.                 re.compile(r"Spider.*"),

  408.                 re.compile(r"Robot.*"),

  409.             )

  410. 

  411.             def is_ignorable_request(self, request, uri, domain, referer):

  412.                 """Check user-agent in addition to normal checks."""

  413.                 if super().is_ignorable_request(request, uri, domain, referer):

  414.                     return True

  415.                 user_agent = request.META["HTTP_USER_AGENT"]

  416.                 return any(

  417.                     pattern.search(user_agent)

  418.                     for pattern in self.ignored_user_agent_patterns

  419.                 )

  420. 

  421.         self.req.META["HTTP_REFERER"] = "/another/url/"

  422.         self.req.META["HTTP_USER_AGENT"] = "Spider machine 3.4"

  423.         SubclassedMiddleware(self.get_response)(self.req)

  424.         self.assertEqual(len(mail.outbox), 0)

  425.         self.req.META["HTTP_USER_AGENT"] = "My user agent"

  426.         SubclassedMiddleware(self.get_response)(self.req)

  427.         self.assertEqual(len(mail.outbox), 1)

  428. 

  429.     def test_referer_equal_to_requested_url(self):

  430.         """

  431.         Some bots set the referer to the current URL to avoid being blocked by

  432.         an referer check (#25302).

  433.         """

  434.         self.req.META["HTTP_REFERER"] = self.req.path

  435.         BrokenLinkEmailsMiddleware(self.get_response)(self.req)

  436.         self.assertEqual(len(mail.outbox), 0)

  437. 

  438.         # URL with scheme and domain should also be ignored

  439.         self.req.META["HTTP_REFERER"] = "http://testserver%s" % self.req.path

  440.         BrokenLinkEmailsMiddleware(self.get_response)(self.req)

  441.         self.assertEqual(len(mail.outbox), 0)

  442. 

  443.         # URL with a different scheme should be ignored as well because bots

  444.         # tend to use http:// in referers even when browsing HTTPS websites.

  445.         self.req.META["HTTP_X_PROTO"] = "https"

  446.         self.req.META["SERVER_PORT"] = 443

  447.         with self.settings(SECURE_PROXY_SSL_HEADER=("HTTP_X_PROTO", "https")):

  448.             BrokenLinkEmailsMiddleware(self.get_response)(self.req)

  449.         self.assertEqual(len(mail.outbox), 0)

  450. 

  451.     def test_referer_equal_to_requested_url_on_another_domain(self):

  452.         self.req.META["HTTP_REFERER"] = "http://anotherserver%s" % self.req.path

  453.         BrokenLinkEmailsMiddleware(self.get_response)(self.req)

  454.         self.assertEqual(len(mail.outbox), 1)

  455. 

  456.     @override_settings(APPEND_SLASH=True)

  457.     def test_referer_equal_to_requested_url_without_trailing_slash_with_append_slash(

  458.         self,

  459.     ):

  460.         self.req.path = self.req.path_info = "/regular_url/that/does/not/exist/"

  461.         self.req.META["HTTP_REFERER"] = self.req.path_info[:-1]

  462.         BrokenLinkEmailsMiddleware(self.get_response)(self.req)

  463.         self.assertEqual(len(mail.outbox), 0)

  464. 

  465.     @override_settings(APPEND_SLASH=False)

  466.     def test_referer_equal_to_requested_url_without_trailing_slash_with_no_append_slash(

  467.         self,

  468.     ):

  469.         self.req.path = self.req.path_info = "/regular_url/that/does/not/exist/"

  470.         self.req.META["HTTP_REFERER"] = self.req.path_info[:-1]

  471.         BrokenLinkEmailsMiddleware(self.get_response)(self.req)

  472.         self.assertEqual(len(mail.outbox), 1)

  473. 

  474. 

  475. @override_settings(ROOT_URLCONF="middleware.cond_get_urls")

  476. class ConditionalGetMiddlewareTest(SimpleTestCase):

  477.     request_factory = RequestFactory()

  478. 

  479.     def setUp(self):

  480.         self.req = self.request_factory.get("/")

  481.         self.resp_headers = {}

  482. 

  483.     def get_response(self, req):

  484.         resp = self.client.get(req.path_info)

  485.         for key, value in self.resp_headers.items():

  486.             resp[key] = value

  487.         return resp

  488. 

  489.     # Tests for the ETag header

  490. 

  491.     def test_middleware_calculates_etag(self):

  492.         resp = ConditionalGetMiddleware(self.get_response)(self.req)

  493.         self.assertEqual(resp.status_code, 200)

  494.         self.assertNotEqual("", resp["ETag"])

  495. 

  496.     def test_middleware_wont_overwrite_etag(self):

  497.         self.resp_headers["ETag"] = "eggs"

  498.         resp = ConditionalGetMiddleware(self.get_response)(self.req)

  499.         self.assertEqual(resp.status_code, 200)

  500.         self.assertEqual("eggs", resp["ETag"])

  501. 

  502.     def test_no_etag_streaming_response(self):

  503.         def get_response(req):

  504.             return StreamingHttpResponse(["content"])

  505. 

  506.         self.assertFalse(

  507.             ConditionalGetMiddleware(get_response)(self.req).has_header("ETag")

  508.         )

  509. 

  510.     def test_no_etag_response_empty_content(self):

  511.         def get_response(req):

  512.             return HttpResponse()

  513. 

  514.         self.assertFalse(

  515.             ConditionalGetMiddleware(get_response)(self.req).has_header("ETag")

  516.         )

  517. 

  518.     def test_no_etag_no_store_cache(self):

  519.         self.resp_headers["Cache-Control"] = "No-Cache, No-Store, Max-age=0"

  520.         self.assertFalse(

  521.             ConditionalGetMiddleware(self.get_response)(self.req).has_header("ETag")

  522.         )

  523. 

  524.     def test_etag_extended_cache_control(self):

  525.         self.resp_headers["Cache-Control"] = 'my-directive="my-no-store"'

  526.         self.assertTrue(

  527.             ConditionalGetMiddleware(self.get_response)(self.req).has_header("ETag")

  528.         )

  529. 

  530.     def test_if_none_match_and_no_etag(self):

  531.         self.req.META["HTTP_IF_NONE_MATCH"] = "spam"

  532.         resp = ConditionalGetMiddleware(self.get_response)(self.req)

  533.         self.assertEqual(resp.status_code, 200)

  534. 

  535.     def test_no_if_none_match_and_etag(self):

  536.         self.resp_headers["ETag"] = "eggs"

  537.         resp = ConditionalGetMiddleware(self.get_response)(self.req)

  538.         self.assertEqual(resp.status_code, 200)

  539. 

  540.     def test_if_none_match_and_same_etag(self):

  541.         self.req.META["HTTP_IF_NONE_MATCH"] = '"spam"'

  542.         self.resp_headers["ETag"] = '"spam"'

  543.         resp = ConditionalGetMiddleware(self.get_response)(self.req)

  544.         self.assertEqual(resp.status_code, 304)

  545. 

  546.     def test_if_none_match_and_different_etag(self):

  547.         self.req.META["HTTP_IF_NONE_MATCH"] = "spam"

  548.         self.resp_headers["ETag"] = "eggs"

  549.         resp = ConditionalGetMiddleware(self.get_response)(self.req)

  550.         self.assertEqual(resp.status_code, 200)

  551. 

  552.     def test_if_none_match_and_redirect(self):

  553.         def get_response(req):

  554.             resp = self.client.get(req.path_info)

  555.             resp["ETag"] = "spam"

  556.             resp["Location"] = "/"

  557.             resp.status_code = 301

  558.             return resp

  559. 

  560.         self.req.META["HTTP_IF_NONE_MATCH"] = "spam"

  561.         resp = ConditionalGetMiddleware(get_response)(self.req)

  562.         self.assertEqual(resp.status_code, 301)

  563. 

  564.     def test_if_none_match_and_client_error(self):

  565.         def get_response(req):

  566.             resp = self.client.get(req.path_info)

  567.             resp["ETag"] = "spam"

  568.             resp.status_code = 400

  569.             return resp

  570. 

  571.         self.req.META["HTTP_IF_NONE_MATCH"] = "spam"

  572.         resp = ConditionalGetMiddleware(get_response)(self.req)

  573.         self.assertEqual(resp.status_code, 400)

  574. 

  575.     # Tests for the Last-Modified header

  576. 

  577.     def test_if_modified_since_and_no_last_modified(self):

  578.         self.req.META["HTTP_IF_MODIFIED_SINCE"] = "Sat, 12 Feb 2011 17:38:44 GMT"

  579.         resp = ConditionalGetMiddleware(self.get_response)(self.req)

  580.         self.assertEqual(resp.status_code, 200)

  581. 

  582.     def test_no_if_modified_since_and_last_modified(self):

  583.         self.resp_headers["Last-Modified"] = "Sat, 12 Feb 2011 17:38:44 GMT"

  584.         resp = ConditionalGetMiddleware(self.get_response)(self.req)

  585.         self.assertEqual(resp.status_code, 200)

  586. 

  587.     def test_if_modified_since_and_same_last_modified(self):

  588.         self.req.META["HTTP_IF_MODIFIED_SINCE"] = "Sat, 12 Feb 2011 17:38:44 GMT"

  589.         self.resp_headers["Last-Modified"] = "Sat, 12 Feb 2011 17:38:44 GMT"

  590.         self.resp = ConditionalGetMiddleware(self.get_response)(self.req)

  591.         self.assertEqual(self.resp.status_code, 304)

  592. 

  593.     def test_if_modified_since_and_last_modified_in_the_past(self):

  594.         self.req.META["HTTP_IF_MODIFIED_SINCE"] = "Sat, 12 Feb 2011 17:38:44 GMT"

  595.         self.resp_headers["Last-Modified"] = "Sat, 12 Feb 2011 17:35:44 GMT"

  596.         resp = ConditionalGetMiddleware(self.get_response)(self.req)

  597.         self.assertEqual(resp.status_code, 304)

  598. 

  599.     def test_if_modified_since_and_last_modified_in_the_future(self):

  600.         self.req.META["HTTP_IF_MODIFIED_SINCE"] = "Sat, 12 Feb 2011 17:38:44 GMT"

  601.         self.resp_headers["Last-Modified"] = "Sat, 12 Feb 2011 17:41:44 GMT"

  602.         self.resp = ConditionalGetMiddleware(self.get_response)(self.req)

  603.         self.assertEqual(self.resp.status_code, 200)

  604. 

  605.     def test_if_modified_since_and_redirect(self):

  606.         def get_response(req):

  607.             resp = self.client.get(req.path_info)

  608.             resp["Last-Modified"] = "Sat, 12 Feb 2011 17:35:44 GMT"

  609.             resp["Location"] = "/"

  610.             resp.status_code = 301

  611.             return resp

  612. 

  613.         self.req.META["HTTP_IF_MODIFIED_SINCE"] = "Sat, 12 Feb 2011 17:38:44 GMT"

  614.         resp = ConditionalGetMiddleware(get_response)(self.req)

  615.         self.assertEqual(resp.status_code, 301)

  616. 

  617.     def test_if_modified_since_and_client_error(self):

  618.         def get_response(req):

  619.             resp = self.client.get(req.path_info)

  620.             resp["Last-Modified"] = "Sat, 12 Feb 2011 17:35:44 GMT"

  621.             resp.status_code = 400

  622.             return resp

  623. 

  624.         self.req.META["HTTP_IF_MODIFIED_SINCE"] = "Sat, 12 Feb 2011 17:38:44 GMT"

  625.         resp = ConditionalGetMiddleware(get_response)(self.req)

  626.         self.assertEqual(resp.status_code, 400)

  627. 

  628.     def test_not_modified_headers(self):

  629.         """

  630.         The 304 Not Modified response should include only the headers required

  631.         by section 4.1 of RFC 7232, Last-Modified, and the cookies.

  632.         """

  633. 

  634.         def get_response(req):

  635.             resp = self.client.get(req.path_info)

  636.             resp["Date"] = "Sat, 12 Feb 2011 17:35:44 GMT"

  637.             resp["Last-Modified"] = "Sat, 12 Feb 2011 17:35:44 GMT"

  638.             resp["Expires"] = "Sun, 13 Feb 2011 17:35:44 GMT"

  639.             resp["Vary"] = "Cookie"

  640.             resp["Cache-Control"] = "public"

  641.             resp["Content-Location"] = "/alt"

  642.             resp["Content-Language"] = "en"  # shouldn't be preserved

  643.             resp["ETag"] = '"spam"'

  644.             resp.set_cookie("key", "value")

  645.             return resp

  646. 

  647.         self.req.META["HTTP_IF_NONE_MATCH"] = '"spam"'

  648. 

  649.         new_response = ConditionalGetMiddleware(get_response)(self.req)

  650.         self.assertEqual(new_response.status_code, 304)

  651.         base_response = get_response(self.req)

  652.         for header in (

  653.             "Cache-Control",

  654.             "Content-Location",

  655.             "Date",

  656.             "ETag",

  657.             "Expires",

  658.             "Last-Modified",

  659.             "Vary",

  660.         ):

  661.             self.assertEqual(

  662.                 new_response.headers[header], base_response.headers[header]

  663.             )

  664.         self.assertEqual(new_response.cookies, base_response.cookies)

  665.         self.assertNotIn("Content-Language", new_response)

  666. 

  667.     def test_no_unsafe(self):

  668.         """

  669.         ConditionalGetMiddleware shouldn't return a conditional response on an

  670.         unsafe request. A response has already been generated by the time

  671.         ConditionalGetMiddleware is called, so it's too late to return a 412

  672.         Precondition Failed.

  673.         """

  674. 

  675.         def get_200_response(req):

  676.             return HttpResponse(status=200)

  677. 

  678.         response = ConditionalGetMiddleware(self.get_response)(self.req)

  679.         etag = response.headers["ETag"]

  680.         put_request = self.request_factory.put("/", HTTP_IF_MATCH=etag)

  681.         conditional_get_response = ConditionalGetMiddleware(get_200_response)(

  682.             put_request

  683.         )

  684.         self.assertEqual(

  685.             conditional_get_response.status_code, 200

  686.         )  # should never be a 412

  687. 

  688.     def test_no_head(self):

  689.         """

  690.         ConditionalGetMiddleware shouldn't compute and return an ETag on a

  691.         HEAD request since it can't do so accurately without access to the

  692.         response body of the corresponding GET.

  693.         """

  694. 

  695.         def get_200_response(req):

  696.             return HttpResponse(status=200)

  697. 

  698.         request = self.request_factory.head("/")

  699.         conditional_get_response = ConditionalGetMiddleware(get_200_response)(request)

  700.         self.assertNotIn("ETag", conditional_get_response)

  701. 

  702. 

  703. class XFrameOptionsMiddlewareTest(SimpleTestCase):

  704.     """

  705.     Tests for the X-Frame-Options clickjacking prevention middleware.

  706.     """

  707. 

  708.     def test_same_origin(self):

  709.         """

  710.         The X_FRAME_OPTIONS setting can be set to SAMEORIGIN to have the

  711.         middleware use that value for the HTTP header.

  712.         """

  713.         with override_settings(X_FRAME_OPTIONS="SAMEORIGIN"):

  714.             r = XFrameOptionsMiddleware(get_response_empty)(HttpRequest())

  715.             self.assertEqual(r.headers["X-Frame-Options"], "SAMEORIGIN")

  716. 

  717.         with override_settings(X_FRAME_OPTIONS="sameorigin"):

  718.             r = XFrameOptionsMiddleware(get_response_empty)(HttpRequest())

  719.             self.assertEqual(r.headers["X-Frame-Options"], "SAMEORIGIN")

  720. 

  721.     def test_deny(self):

  722.         """

  723.         The X_FRAME_OPTIONS setting can be set to DENY to have the middleware

  724.         use that value for the HTTP header.

  725.         """

  726.         with override_settings(X_FRAME_OPTIONS="DENY"):

  727.             r = XFrameOptionsMiddleware(get_response_empty)(HttpRequest())

  728.             self.assertEqual(r.headers["X-Frame-Options"], "DENY")

  729. 

  730.         with override_settings(X_FRAME_OPTIONS="deny"):

  731.             r = XFrameOptionsMiddleware(get_response_empty)(HttpRequest())

  732.             self.assertEqual(r.headers["X-Frame-Options"], "DENY")

  733. 

  734.     def test_defaults_sameorigin(self):

  735.         """

  736.         If the X_FRAME_OPTIONS setting is not set then it defaults to

  737.         DENY.

  738.         """

  739.         with override_settings(X_FRAME_OPTIONS=None):

  740.             del settings.X_FRAME_OPTIONS  # restored by override_settings

  741.             r = XFrameOptionsMiddleware(get_response_empty)(HttpRequest())

  742.             self.assertEqual(r.headers["X-Frame-Options"], "DENY")

  743. 

  744.     def test_dont_set_if_set(self):

  745.         """

  746.         If the X-Frame-Options header is already set then the middleware does

  747.         not attempt to override it.

  748.         """

  749. 

  750.         def same_origin_response(request):

  751.             response = HttpResponse()

  752.             response.headers["X-Frame-Options"] = "SAMEORIGIN"

  753.             return response

  754. 

  755.         def deny_response(request):

  756.             response = HttpResponse()

  757.             response.headers["X-Frame-Options"] = "DENY"

  758.             return response

  759. 

  760.         with override_settings(X_FRAME_OPTIONS="DENY"):

  761.             r = XFrameOptionsMiddleware(same_origin_response)(HttpRequest())

  762.             self.assertEqual(r.headers["X-Frame-Options"], "SAMEORIGIN")

  763. 

  764.         with override_settings(X_FRAME_OPTIONS="SAMEORIGIN"):

  765.             r = XFrameOptionsMiddleware(deny_response)(HttpRequest())

  766.             self.assertEqual(r.headers["X-Frame-Options"], "DENY")

  767. 

  768.     def test_response_exempt(self):

  769.         """

  770.         If the response has an xframe_options_exempt attribute set to False

  771.         then it still sets the header, but if it's set to True then it doesn't.

  772.         """

  773. 

  774.         def xframe_exempt_response(request):

  775.             response = HttpResponse()

  776.             response.xframe_options_exempt = True

  777.             return response

  778. 

  779.         def xframe_not_exempt_response(request):

  780.             response = HttpResponse()

  781.             response.xframe_options_exempt = False

  782.             return response

  783. 

  784.         with override_settings(X_FRAME_OPTIONS="SAMEORIGIN"):

  785.             r = XFrameOptionsMiddleware(xframe_not_exempt_response)(HttpRequest())

  786.             self.assertEqual(r.headers["X-Frame-Options"], "SAMEORIGIN")

  787. 

  788.             r = XFrameOptionsMiddleware(xframe_exempt_response)(HttpRequest())

  789.             self.assertIsNone(r.headers.get("X-Frame-Options"))

  790. 

  791.     def test_is_extendable(self):

  792.         """

  793.         The XFrameOptionsMiddleware method that determines the X-Frame-Options

  794.         header value can be overridden based on something in the request or

  795.         response.

  796.         """

  797. 

  798.         class OtherXFrameOptionsMiddleware(XFrameOptionsMiddleware):

  799.             # This is just an example for testing purposes...

  800.             def get_xframe_options_value(self, request, response):

  801.                 if getattr(request, "sameorigin", False):

  802.                     return "SAMEORIGIN"

  803.                 if getattr(response, "sameorigin", False):

  804.                     return "SAMEORIGIN"

  805.                 return "DENY"

  806. 

  807.         def same_origin_response(request):

  808.             response = HttpResponse()

  809.             response.sameorigin = True

  810.             return response

  811. 

  812.         with override_settings(X_FRAME_OPTIONS="DENY"):

  813.             r = OtherXFrameOptionsMiddleware(same_origin_response)(HttpRequest())

  814.             self.assertEqual(r.headers["X-Frame-Options"], "SAMEORIGIN")

  815. 

  816.             request = HttpRequest()

  817.             request.sameorigin = True

  818.             r = OtherXFrameOptionsMiddleware(get_response_empty)(request)

  819.             self.assertEqual(r.headers["X-Frame-Options"], "SAMEORIGIN")

  820. 

  821.         with override_settings(X_FRAME_OPTIONS="SAMEORIGIN"):

  822.             r = OtherXFrameOptionsMiddleware(get_response_empty)(HttpRequest())

  823.             self.assertEqual(r.headers["X-Frame-Options"], "DENY")

  824. 

  825. 

  826. class GZipMiddlewareTest(SimpleTestCase):

  827.     """

  828.     Tests the GZipMiddleware.

  829.     """

  830. 

  831.     short_string = b"This string is too short to be worth compressing."

  832.     compressible_string = b"a" * 500

  833.     incompressible_string = b"".join(

  834.         int2byte(random.randint(0, 255)) for _ in range(500)

  835.     )

  836.     sequence = [b"a" * 500, b"b" * 200, b"a" * 300]

  837.     sequence_unicode = ["a" * 500, "é" * 200, "a" * 300]

  838.     request_factory = RequestFactory()

  839. 

  840.     def setUp(self):

  841.         self.req = self.request_factory.get("/")

  842.         self.req.META["HTTP_ACCEPT_ENCODING"] = "gzip, deflate"

  843.         self.req.META[

  844.             "HTTP_USER_AGENT"

  845.         ] = "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"

  846.         self.resp = HttpResponse()

  847.         self.resp.status_code = 200

  848.         self.resp.content = self.compressible_string

  849.         self.resp["Content-Type"] = "text/html; charset=UTF-8"

  850. 

  851.     def get_response(self, request):

  852.         return self.resp

  853. 

  854.     @staticmethod

  855.     def decompress(gzipped_string):

  856.         with gzip.GzipFile(mode="rb", fileobj=BytesIO(gzipped_string)) as f:

  857.             return f.read()

  858. 

  859.     @staticmethod

  860.     def get_mtime(gzipped_string):

  861.         with gzip.GzipFile(mode="rb", fileobj=BytesIO(gzipped_string)) as f:

  862.             f.read()  # must read the data before accessing the header

  863.             return f.mtime

  864. 

  865.     def test_compress_response(self):

  866.         """

  867.         Compression is performed on responses with compressible content.

  868.         """

  869.         r = GZipMiddleware(self.get_response)(self.req)

  870.         self.assertEqual(self.decompress(r.content), self.compressible_string)

  871.         self.assertEqual(r.get("Content-Encoding"), "gzip")

  872.         self.assertEqual(r.get("Content-Length"), str(len(r.content)))

  873. 

  874.     def test_compress_streaming_response(self):

  875.         """

  876.         Compression is performed on responses with streaming content.

  877.         """

  878. 

  879.         def get_stream_response(request):

  880.             resp = StreamingHttpResponse(self.sequence)

  881.             resp["Content-Type"] = "text/html; charset=UTF-8"

  882.             return resp

  883. 

  884.         r = GZipMiddleware(get_stream_response)(self.req)

  885.         self.assertEqual(self.decompress(b"".join(r)), b"".join(self.sequence))

  886.         self.assertEqual(r.get("Content-Encoding"), "gzip")

  887.         self.assertFalse(r.has_header("Content-Length"))

  888. 

  889.     def test_compress_streaming_response_unicode(self):

  890.         """

  891.         Compression is performed on responses with streaming Unicode content.

  892.         """

  893. 

  894.         def get_stream_response_unicode(request):

  895.             resp = StreamingHttpResponse(self.sequence_unicode)

  896.             resp["Content-Type"] = "text/html; charset=UTF-8"

  897.             return resp

  898. 

  899.         r = GZipMiddleware(get_stream_response_unicode)(self.req)

  900.         self.assertEqual(

  901.             self.decompress(b"".join(r)),

  902.             b"".join(x.encode() for x in self.sequence_unicode),

  903.         )

  904.         self.assertEqual(r.get("Content-Encoding"), "gzip")

  905.         self.assertFalse(r.has_header("Content-Length"))

  906. 

  907.     def test_compress_file_response(self):

  908.         """

  909.         Compression is performed on FileResponse.

  910.         """

  911.         with open(__file__, "rb") as file1:

  912. 

  913.             def get_response(req):

  914.                 file_resp = FileResponse(file1)

  915.                 file_resp["Content-Type"] = "text/html; charset=UTF-8"

  916.                 return file_resp

  917. 

  918.             r = GZipMiddleware(get_response)(self.req)

  919.             with open(__file__, "rb") as file2:

  920.                 self.assertEqual(self.decompress(b"".join(r)), file2.read())

  921.             self.assertEqual(r.get("Content-Encoding"), "gzip")

  922.             self.assertIsNot(r.file_to_stream, file1)

  923. 

  924.     def test_compress_non_200_response(self):

  925.         """

  926.         Compression is performed on responses with a status other than 200

  927.         (#10762).

  928.         """

  929.         self.resp.status_code = 404

  930.         r = GZipMiddleware(self.get_response)(self.req)

  931.         self.assertEqual(self.decompress(r.content), self.compressible_string)

  932.         self.assertEqual(r.get("Content-Encoding"), "gzip")

  933. 

  934.     def test_no_compress_short_response(self):

  935.         """

  936.         Compression isn't performed on responses with short content.

  937.         """

  938.         self.resp.content = self.short_string

  939.         r = GZipMiddleware(self.get_response)(self.req)

  940.         self.assertEqual(r.content, self.short_string)

  941.         self.assertIsNone(r.get("Content-Encoding"))

  942. 

  943.     def test_no_compress_compressed_response(self):

  944.         """

  945.         Compression isn't performed on responses that are already compressed.

  946.         """

  947.         self.resp["Content-Encoding"] = "deflate"

  948.         r = GZipMiddleware(self.get_response)(self.req)

  949.         self.assertEqual(r.content, self.compressible_string)

  950.         self.assertEqual(r.get("Content-Encoding"), "deflate")

  951. 

  952.     def test_no_compress_incompressible_response(self):

  953.         """

  954.         Compression isn't performed on responses with incompressible content.

  955.         """

  956.         self.resp.content = self.incompressible_string

  957.         r = GZipMiddleware(self.get_response)(self.req)

  958.         self.assertEqual(r.content, self.incompressible_string)

  959.         self.assertIsNone(r.get("Content-Encoding"))

  960. 

  961.     def test_compress_deterministic(self):

  962.         """

  963.         Compression results are the same for the same content and don't

  964.         include a modification time (since that would make the results

  965.         of compression non-deterministic and prevent

  966.         ConditionalGetMiddleware from recognizing conditional matches

  967.         on gzipped content).

  968.         """

  969.         r1 = GZipMiddleware(self.get_response)(self.req)

  970.         r2 = GZipMiddleware(self.get_response)(self.req)

  971.         self.assertEqual(r1.content, r2.content)

  972.         self.assertEqual(self.get_mtime(r1.content), 0)

  973.         self.assertEqual(self.get_mtime(r2.content), 0)

  974. 

  975. 

  976. class ETagGZipMiddlewareTest(SimpleTestCase):

  977.     """

  978.     ETags are handled properly by GZipMiddleware.

  979.     """

  980. 

  981.     rf = RequestFactory()

  982.     compressible_string = b"a" * 500

  983. 

  984.     def test_strong_etag_modified(self):

  985.         """

  986.         GZipMiddleware makes a strong ETag weak.

  987.         """

  988. 

  989.         def get_response(req):

  990.             response = HttpResponse(self.compressible_string)

  991.             response.headers["ETag"] = '"eggs"'

  992.             return response

  993. 

  994.         request = self.rf.get("/", HTTP_ACCEPT_ENCODING="gzip, deflate")

  995.         gzip_response = GZipMiddleware(get_response)(request)

  996.         self.assertEqual(gzip_response.headers["ETag"], 'W/"eggs"')

  997. 

  998.     def test_weak_etag_not_modified(self):

  999.         """

  1000.         GZipMiddleware doesn't modify a weak ETag.

  1001.         """

  1002. 

  1003.         def get_response(req):

  1004.             response = HttpResponse(self.compressible_string)

  1005.             response.headers["ETag"] = 'W/"eggs"'

  1006.             return response

  1007. 

  1008.         request = self.rf.get("/", HTTP_ACCEPT_ENCODING="gzip, deflate")

  1009.         gzip_response = GZipMiddleware(get_response)(request)

  1010.         self.assertEqual(gzip_response.headers["ETag"], 'W/"eggs"')

  1011. 

  1012.     def test_etag_match(self):

  1013.         """

  1014.         GZipMiddleware allows 304 Not Modified responses.

  1015.         """

  1016. 

  1017.         def get_response(req):

  1018.             response = HttpResponse(self.compressible_string)

  1019.             return response

  1020. 

  1021.         def get_cond_response(req):

  1022.             return ConditionalGetMiddleware(get_response)(req)

  1023. 

  1024.         request = self.rf.get("/", HTTP_ACCEPT_ENCODING="gzip, deflate")

  1025.         response = GZipMiddleware(get_cond_response)(request)

  1026.         gzip_etag = response.headers["ETag"]

  1027.         next_request = self.rf.get(

  1028.             "/", HTTP_ACCEPT_ENCODING="gzip, deflate", HTTP_IF_NONE_MATCH=gzip_etag

  1029.         )

  1030.         next_response = ConditionalGetMiddleware(get_response)(next_request)

  1031.         self.assertEqual(next_response.status_code, 304)
About Sign Up Leave Feedback Contact