From fb783342fd55736c4df8242bbb2a212cb114050b Mon Sep 17 00:00:00 2001 From: Markus Unterwaditzer Date: Sun, 10 Apr 2016 23:48:45 +0200 Subject: [PATCH 1/4] Restore testcase for absolute requests --- tests/test_serving.py | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/tests/test_serving.py b/tests/test_serving.py index d42681802..9d125c14b 100644 --- a/tests/test_serving.py +++ b/tests/test_serving.py @@ -24,6 +24,11 @@ except ImportError: watchdog = None +try: + import httplib +except ImportError: + from http import client as httplib + import requests import requests.exceptions import pytest @@ -39,6 +44,24 @@ def test_serving(dev_server): assert b'Werkzeug/' + version.encode('ascii') in rv +def test_absolute_requests(dev_server): + server = dev_server(''' + def app(environ, start_response): + assert environ['HTTP_HOST'] == 'surelynotexisting.example.com:1337' + assert environ['PATH_INFO'] == '/index.htm' + addr = environ['HTTP_X_WERKZEUG_ADDR'] + assert environ['SERVER_PORT'] == addr.split(':')[1] + start_response('200 OK', [('Content-Type', 'text/html')]) + return [b'YES'] + ''') + + conn = httplib.HTTPConnection(server.addr) + conn.request('GET', 'http://surelynotexisting.example.com:1337/index.htm#ignorethis', + headers={'X-Werkzeug-Addr': server.addr}) + res = conn.getresponse() + assert res.read() == b'YES' + + def test_broken_app(dev_server): server = dev_server(''' def app(environ, start_response): From ad5716f5a7e48d80ba421cbce8ca26b24a18cc8d Mon Sep 17 00:00:00 2001 From: Markus Unterwaditzer Date: Sun, 10 Apr 2016 23:51:43 +0200 Subject: [PATCH 2/4] Add testcase for #822 --- tests/test_serving.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/tests/test_serving.py b/tests/test_serving.py index 9d125c14b..ef4026387 100644 --- a/tests/test_serving.py +++ b/tests/test_serving.py @@ -62,6 +62,18 @@ def app(environ, start_response): assert res.read() == b'YES' +def test_double_slash_path(dev_server): + server = dev_server(''' + def app(environ, start_response): + assert 'fail' not in environ['HTTP_HOST'] + start_response('200 OK', [('Content-Type', 'text/plain')]) + return [b'YES'] + ''') + + r = requests.get(server.url + '//fail') + assert r.content == b'YES' + + def test_broken_app(dev_server): server = dev_server(''' def app(environ, start_response): From 27f3839de17d621b5d9e7c62900fe873ddb02227 Mon Sep 17 00:00:00 2001 From: Markus Unterwaditzer Date: Sun, 10 Apr 2016 23:52:36 +0200 Subject: [PATCH 3/4] serving: absolute request URLs need a scheme Fix #822 --- werkzeug/serving.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/werkzeug/serving.py b/werkzeug/serving.py index 712cdc554..2485dc493 100644 --- a/werkzeug/serving.py +++ b/werkzeug/serving.py @@ -125,7 +125,7 @@ def shutdown_server(): if key not in ('HTTP_CONTENT_TYPE', 'HTTP_CONTENT_LENGTH'): environ[key] = value - if request_url.netloc: + if request.scheme and request_url.netloc: environ['HTTP_HOST'] = request_url.netloc return environ From 8c857a1c3e2fba29a42cdb5959ef46a8451c6ea8 Mon Sep 17 00:00:00 2001 From: Markus Unterwaditzer Date: Sun, 10 Apr 2016 23:55:43 +0200 Subject: [PATCH 4/4] Add changelog --- CHANGES | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGES b/CHANGES index 5b1198ea8..2da96dcfb 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,11 @@ Werkzeug Changelog ================== +Version 0.11.6 +-------------- + +- werkzeug.serving: Fix broken HTTP_HOST when path starts with double slash. + Version 0.11.5 --------------