a -=ic@sBddlZddlZddlZddlZddlmZddlmZddlm Z ddl m Z ddl m Z ddl m Z dd lmZdd lmZdd lmZdd lmZdd lmZddlmZddlmZejrddlmZddlmZejdddddZdOdeeeej ej!e"e"dddZ#dej ej$e"ej e%fdddZ&dPdej ej!e"e"dd d!Z'dej e%dd"d#Z(dQdeej)e*d%d&d'Z+de"dd(d)Z,dRde"e"e"d,d-d.Z-dSde"e"e"d,d/d0Z.dTde"e"ej e"d,d1d2Z/dUde"e"ej e"d,d3d4Z0dVej1e"dfej1e"efe"e"eej e"d6d7d8Z2Gd9d:d:Z3dWdej)e*e%ej!e*d<d=d>Z4Gd?d@d@Z5GdAdBdBZ6ej1ej!e*ej)e*fej e%e%ej7e*dCdDdEZ8dXej1ej!e*ej)e*fej e%e%eej7e*dGdHdIZ9dYej1ej!e*ej)e*fe*ej e%e%eej7e*dJdKdLZ:GdMdNdNej;Z#zresponder..rrrrr responders rFr)environ root_onlystrip_querystring host_only trusted_hostsrcCsf|dt||d}|sV|dd|d<|sV|dd|d<|sV|ddd |d <tjfi|S) aXRecreate the URL for a request from the parts in a WSGI environment. The URL is an IRI, not a URI, so it may contain Unicode characters. Use :func:`~werkzeug.urls.iri_to_uri` to convert it to ASCII. :param environ: The WSGI environment to get the URL parts from. :param root_only: Only build the root path, don't include the remaining path or query string. :param strip_querystring: Don't include the query string. :param host_only: Only build the scheme and host. :param trusted_hosts: A list of trusted host names to validate the host against. wsgi.url_scheme)schemehost SCRIPT_NAME root_path PATH_INFOpath QUERY_STRINGlatin1Z query_string)get_hostgetencode _sansio_utilsget_current_url)rrrr r!partsrrrr0&sr0)rrc CsN|d}|durdSzt|dd}WnttfyDd}Yn0||fS)NZ SERVER_NAMEZ SERVER_PORT)r-int TypeError ValueError)rnameportrrr _get_serverLs  r7)rr!rcCst|d|dt||S)arReturn the host for the given WSGI environment. The ``Host`` header is preferred, then ``SERVER_NAME`` if it's not set. The returned host will only contain the port if it is different than the standard port for the protocol. Optionally, verify that the host is trusted using :func:`host_is_trusted` and raise a :exc:`~werkzeug.exceptions.SecurityError` if it is not. :param environ: A WSGI environment dict. :param trusted_hosts: A list of trusted host names. :return: Host, with port if necessary. :raise ~werkzeug.exceptions.SecurityError: If the host is not trusted. r"Z HTTP_HOST)r/r,r-r7)rr!rrrr,]s r,cCstj|d|dddS)aReturns the content length from the WSGI environment as integer. If it's not available or chunked transfer encoding is used, ``None`` is returned. .. versionadded:: 0.9 :param environ: the WSGI environ to fetch the content length from. ZCONTENT_LENGTHZHTTP_TRANSFER_ENCODINGr&)Zhttp_content_lengthZhttp_transfer_encoding)r/get_content_lengthr-)rrrrr8ys  r8T)r safe_fallbackrcCs\ttjt|d}t|}|dr,|S|durD|r@tS|Sttjtt||S)a Returns the input stream from the WSGI environment and wraps it in the most sensible way possible. The stream returned is not the raw WSGI stream in most cases but one that is safe to read from without taking into account the content length. If content length is not set, the stream will be empty for safety reasons. If the WSGI server supports chunked or infinite streams, it should set the ``wsgi.input_terminated`` value in the WSGI environ to indicate that. .. versionadded:: 0.9 :param environ: the WSGI environ to fetch the stream from. :param safe_fallback: use an empty stream as a safe fallback when the content length is not set. Disabling this allows infinite streams, which can be a denial-of-service risk. z wsgi.inputzwsgi.input_terminatedN) tcastIObytesr8r-ioBytesIO LimitedStream)rr9streamcontent_lengthrrrget_input_streams rCcCs.tjdtdd|ddd}t|ddS) aRReturns the ``QUERY_STRING`` from the WSGI environment. This also takes care of the WSGI decoding dance. The string returned will be restricted to ASCII characters. :param environ: WSGI environment to get the query string from. .. deprecated:: 2.2 Will be removed in Werkzeug 2.3. .. versionadded:: 0.9 zE'get_query_string' is deprecated and will be removed in Werkzeug 2.3. stacklevelr*r&r+z :&%=+$!*'(),)safe)warningswarnDeprecationWarningr-r.r)rqsrrrget_query_strings rLutf-8replace)rcharseterrorsrcCs"|ddd}t|||ddS)a[Return the ``PATH_INFO`` from the WSGI environment and decode it unless ``charset`` is ``None``. :param environ: WSGI environment to get the path from. :param charset: The charset for the path info, or ``None`` if no decoding should be performed. :param errors: The decoding error handling. .. versionadded:: 0.9 r(r&r+TZallow_none_charset)r-r.r rrOrPr)rrr get_path_infos rScCs2tjdtdd|ddd}t|||ddS) aReturn the ``SCRIPT_NAME`` from the WSGI environment and decode it unless `charset` is set to ``None``. :param environ: WSGI environment to get the path from. :param charset: The charset for the path, or ``None`` if no decoding should be performed. :param errors: The decoding error handling. .. deprecated:: 2.2 Will be removed in Werkzeug 2.3. .. versionadded:: 0.9 zD'get_script_name' is deprecated and will be removed in Werkzeug 2.3.rDrEr%r&r+TrQ)rHrIrJr-r.r rRrrrget_script_namesrTcCstjdtdd|d}|s"dS|dd}|}|d}||kr\|dt|t|7}d|vrd|d<|||d<|d }n4|dd \}}d||d<|||d<|d }t|||d d S) aRemoves and returns the next segment of `PATH_INFO`, pushing it onto `SCRIPT_NAME`. Returns `None` if there is nothing left on `PATH_INFO`. If the `charset` is set to `None` bytes are returned. If there are empty segments (``'/foo//bar``) these are ignored but properly pushed to the `SCRIPT_NAME`: >>> env = {'SCRIPT_NAME': '/foo', 'PATH_INFO': '/a/b'} >>> pop_path_info(env) 'a' >>> env['SCRIPT_NAME'] '/foo/a' >>> pop_path_info(env) 'b' >>> env['SCRIPT_NAME'] '/foo/a/b' .. deprecated:: 2.2 Will be removed in Werkzeug 2.3. .. versionadded:: 0.5 .. versionchanged:: 0.9 The path is now decoded and a charset and encoding parameter can be provided. :param environ: the WSGI environment that is modified. :param charset: The ``encoding`` parameter passed to :func:`bytes.decode`. :param errors: The ``errors`` paramater passed to :func:`bytes.decode`. zB'pop_path_info' is deprecated and will be removed in Werkzeug 2.3.rDrEr(Nr%r&/r+rTrQ) rHrIrJr-lstriplenr.splitr )rrOrPr) script_nameold_pathrvsegmentrrr pop_path_infos,$       r]cCsLtjdtdd|ddddd}|rHt|dd ||d d Sd S) aiReturns the next segment on the `PATH_INFO` or `None` if there is none. Works like :func:`pop_path_info` without modifying the environment: >>> env = {'SCRIPT_NAME': '/foo', 'PATH_INFO': '/a/b'} >>> peek_path_info(env) 'a' >>> peek_path_info(env) 'a' If the `charset` is set to `None` bytes are returned. .. deprecated:: 2.2 Will be removed in Werkzeug 2.3. .. versionadded:: 0.5 .. versionchanged:: 0.9 The path is now decoded and a charset and encoding parameter can be provided. :param environ: the WSGI environment that is checked. zC'peek_path_info' is deprecated and will be removed in Werkzeug 2.3.rDrEr(r&rUrrr+TrQN)rHrIrJr-rVrXr r.)rrOrPsegmentsrrrpeek_path_info3sr_werkzeug.url_quote)environ_or_baseurl path_or_urlrOrPcollapse_http_schemesrcCs tjdtddtttddd}t|||}t|trDt|dd}t|||}t|d d \}} } tt ||d d \} } } ||| } || | } |r|| fD]}|d vrd Sqn|d vr|| ksd S| | krd S| d } | | sd Sd | t | d  d S) ahExtracts the path info from the given URL (or WSGI environment) and path. The path info returned is a string. The URLs might also be IRIs. If the path info could not be determined, `None` is returned. Some examples: >>> extract_path_info('http://example.com/app', '/app/hello') '/hello' >>> extract_path_info('http://example.com/app', ... 'https://example.com/app/hello') '/hello' >>> extract_path_info('http://example.com/app', ... 'https://example.com/app/hello', ... collapse_http_schemes=False) is None True Instead of providing a base URL you can also pass a WSGI environment. :param environ_or_baseurl: a WSGI environment dict, a base URL or base IRI. This is the root of the application. :param path_or_url: an absolute path from the server root, a relative path (in which case it's the path info) or a full URL. :param charset: the charset for byte data in URLs :param errors: the error handling on decode :param collapse_http_schemes: if set to `False` the algorithm does not assume that http and https on the same server point to the same resource. .. deprecated:: 2.2 Will be removed in Werkzeug 2.3. .. versionchanged:: 0.15 The ``errors`` parameter defaults to leaving invalid bytes quoted instead of replacing them. .. versionadded:: 0.6 zF'extract_path_info' is deprecated and will be removed in Werkzeug 2.3.rDrE)r#netlocrcSsx|ddddd}t|dkrR|\}}|dkr<|dksL|dkr^|d kr^d}n |d }d}|durt|d|7}|S) N@r:rDhttp80https443r)rXrW)r#rdr1r6rrr_normalize_netlocs z,extract_path_info.._normalize_netlocT)rN)rhrjrU)rHrIrJstrr isinstancedictr0rrrstrip startswithrWrV)rarbrOrPrcrlr)Zbase_iriZ base_schemeZ base_netloc base_pathZ cur_schemeZ cur_netlocZcur_pathr#rrrextract_path_info[s41          rtc @s~eZdZdZd ejeejejej gdfejej gdffddddZ ddddZ edd d Z ddd d Z dS)ClosingIteratoraAThe WSGI specification requires that all middlewares and gateways respect the `close` callback of the iterable returned by the application. Because it is useful to add another close action to a returned iterable and adding a custom iterable is a boring task this class can be used for that:: return ClosingIterator(app(environ, start_response), [cleanup_session, cleanup_locals]) If there is just one close function it can be passed instead of the list. A closing iterator is not needed if the application uses response objects and finishes the processing if the response is started:: try: return response(environ, start_response) finally: cleanup_session() cleanup_locals() N)iterable callbacksrcCsrt|}ttjgtftt||_|dur4g}nt|rD|g}nt |}t |dd}|rh| d|||_ dS)Ncloser) iterr:r;Callabler=rnext_nextcallablelistgetattrinsert _callbacks)selfrvrwiteratorZiterable_closerrr__init__s  zClosingIterator.__init__rcCs|SNrrrrr__iter__szClosingIterator.__iter__cCs|Sr)r|rrrr__next__szClosingIterator.__next__cCs|jD] }|qdSr)r)rcallbackrrrrxs zClosingIterator.close)N)__name__ __module__ __qualname____doc__r:Iterabler=OptionalUnionrzrrrrxrrrrrus& ru )rfile buffer_sizercCs|dt||S)aWraps a file. This uses the WSGI server's file wrapper if available or otherwise the generic :class:`FileWrapper`. .. versionadded:: 0.5 If the file wrapper from the WSGI server is used it's important to not iterate over it from inside the application but to pass it through unchanged. If you want to pass out a file wrapper inside a response object you have to set :attr:`Response.direct_passthrough` to `True`. More information about file wrappers are available in :pep:`333`. :param file: a :class:`file`-like object with a :meth:`~file.read` method. :param buffer_size: number of bytes for one iteration. zwsgi.file_wrapper)r- FileWrapper)rrrrrr wrap_files rc@seZdZdZdejeeddddZdddd Z e dd d Z ej dd d dZ ejedddZddddZedddZdS)ra\This class can be used to convert a :class:`file`-like object into an iterable. It yields `buffer_size` blocks until the file is fully read. You should not use this class directly but rather use the :func:`wrap_file` function that uses the WSGI server's file wrapper support if it's available. .. versionadded:: 0.5 If you're using this object together with a :class:`Response` you have to use the `direct_passthrough` mode. :param file: a :class:`file`-like object with a :meth:`~file.read` method. :param buffer_size: number of bytes for one iteration. rN)rrrcCs||_||_dSr)rr)rrrrrrr$szFileWrapper.__init__rcCst|jdr|jdSNrx)hasattrrrxrrrrrx(s zFileWrapper.closecCs*t|jdr|jSt|jdr&dSdS)NseekableseekTF)rrrrrrrr,s    zFileWrapper.seekable)argsrcGst|jdr|jj|dS)Nr)rrr)rrrrrr3s zFileWrapper.seekcCst|jdr|jSdS)Ntell)rrrrrrrr7s  zFileWrapper.tellcCs|Srrrrrrr<szFileWrapper.__iter__cCs |j|j}|r|StdSr)rreadr StopIteration)rdatarrrr?szFileWrapper.__next__)r)rrrrr:r<r=r2rrxboolrAnyrrrrrrrrrrsrc@seZdZdZdejejeejefe ej e dddZ dddd Z edd d Z ejej ee fdd d ZedddZedddZddddZdS) _RangeWrapperasThis class can be used to convert an iterable object into an iterable that will only yield a piece of the underlying content. It yields blocks until the underlying stream range is fully read. The yielded blocks will have a size that can't exceed the original iterator defined block size, but that can be smaller. If you're using this object together with a :class:`Response` you have to use the `direct_passthrough` mode. :param iterable: an iterable object with a :meth:`__next__` method. :param start_byte: byte from which read will start. :param byte_range: how many bytes to read. rN)rv start_byte byte_rangecCsRt||_||_||_d|_|dur.|||_d|_t|doD||_d|_dS)NrrF) ryrvrrend_byte read_lengthrr end_reached)rrvrrrrrrWs  z_RangeWrapper.__init__rcCs|Srrrrrrrksz_RangeWrapper.__iter__cCsBz"t|j}|jt|7_|WSty<d|_Yn0dSNT)r{rvrrWrrrchunkrrr _next_chunkns  z_RangeWrapper._next_chunkcCsld}|jr,|j|j|j|_|j}n8|j|jkrB|}q,|dur^||j|jd}|j}||fSr)rrvrrrrrrrZcontextual_read_lengthrrr_first_iterationws   z_RangeWrapper._first_iterationcCsn|jr td}|j}|jdkr,|\}}|dur<|}|jdurj|j|jkrjd|_|d|j|S|S)NrT)rrrrrrrrrrr|s  z_RangeWrapper._nextcCs |}|r|Sd|_tdSr)r|rrrrrrrs z_RangeWrapper.__next__cCst|jdr|jdSr)rrvrxrrrrrxs z_RangeWrapper.close)rN)rrrrr:rrr=r<r2rrrrTuplerr|rrxrrrrrFs  r)rAlimitrrccst|tttfrtdt|ds:|D]}|r&|Vq&dSttjt|}t|t sv|durvttjtt ||}|j }||}|sq|Vq|dS)z-Helper for the line and chunk iter functions.zBPassed a string or byte object instead of true iterator or stream.rN) ror= bytearrayrnr3rr:r;r<r@r)rArritem_readrrr_make_chunk_iters" r()rArr cap_at_bufferrc #st||td}|sdSt|}tt|dtt|d}tt|d}tt|dttjtt|ftjtdfdd }} |D]6} | |kr| d d|kr| | 7} } | r| V| } q| r| VdS) aSafely iterates line-based over an input stream. If the input stream is not a :class:`LimitedStream` the `limit` parameter is mandatory. This uses the stream's :meth:`~file.read` method internally as opposite to the :meth:`~file.readline` method that is unsafe and can only be used in violation of the WSGI specification. The same problem applies to the `__iter__` function of the input stream which calls :meth:`~file.readline` without arguments. If you need line-by-line processing it's strongly recommended to iterate over the input stream using this helper function. .. versionchanged:: 0.8 This function now ensures that the limit was reached. .. versionadded:: 0.9 added support for iterators as input stream. .. versionadded:: 0.11.10 added support for the `cap_at_buffer` parameter. :param stream: the stream or iterate to iterate over. :param limit: the limit in bytes for the stream. (Usually content length. Not necessary if the `stream` is a :class:`LimitedStream`. :param buffer_size: The optional buffer size. :param cap_at_buffer: if this is set chunks are split if they are longer than the buffer size. Internally this is implemented that the buffer size might be exhausted by a factor of two however. r&N  z rc3sj}g}td}|sqg}d}ttjtt||dD]}|||t |7}|r~|ddvr~||Vg}q@r@|kr@||}t |kr|dV|d}q|g}q@|}q |r||VdS)Nr&rTrf) joinr{r:r;Iteratorr=r splitlinesappendrW)_joinbuffernew_datanew_bufbuf_sizerr[_iterrrZcrlfemptyrr_iter_basic_liness0      z)make_line_iter.._iter_basic_linesrf)rr{rr:r;r=rr) rArrr first_itemscrlfrpreviousrrrrmake_line_iters*%    r)rA separatorrrrrccsdt|||}t|d}|sdSttjtt|f|}t|trlt |}t dt |dj }dj}n(t|}t dt |dj }dj}g} t|d} | sqP|| } g} d} t| | D]}||kr|| Vg} d} q| t|7} | ||r| |kr|| }t||kr:|d|V||d}q|g} t|} q| } q| r`|| VdS) a Works like :func:`make_line_iter` but accepts a separator which divides chunks. If you want newline based processing you should use :func:`make_line_iter` instead as it supports arbitrary newline markers. .. versionadded:: 0.8 .. versionadded:: 0.9 added support for iterators as input stream. .. versionadded:: 0.11.10 added support for the `cap_at_buffer` parameter. :param stream: the stream or iterate to iterate over. :param separator: the separator that divides chunks. :param limit: the limit in bytes for the stream. (Usually content length. Not necessary if the `stream` is otherwise already limited). :param buffer_size: The optional buffer size. :param cap_at_buffer: if this is set chunks are split if they are longer than the buffer size. Internally this is implemented that the buffer size might be exhausted by a factor of two however. rN()r&()r)rr{r:r;rr=rrornr recompileescaperXrrrWr)rArrrrrr_splitrrrchunksrrrr[rrrmake_chunk_itersH         rc@seZdZdZejeeddddZddddZ e e dd d Z edd d Z edd dZd eddddZd!ejeedddZd"ejeedddZd#ejeejedddZedddZedddZe dddZdS)$r@aWraps a stream so that it doesn't read more than n bytes. If the stream is exhausted and the caller tries to get more bytes from it :func:`on_exhausted` is called which by default returns an empty string. The return value of that function is forwarded to the reader function. So if it returns an empty string :meth:`read` will return an empty string as well. The limit however must never be higher than what the stream can output. Otherwise :meth:`readlines` will try to read past the limit. .. admonition:: Note on WSGI compliance calls to :meth:`readline` and :meth:`readlines` are not WSGI compliant because it passes a size argument to the readline methods. Unfortunately the WSGI PEP is not safely implementable without a size argument to :meth:`readline` because there is no EOF marker in the stream. As a result of that the use of :meth:`readline` is discouraged. For the same reason iterating over the :class:`LimitedStream` is not portable. It internally calls :meth:`readline`. We strongly suggest using :meth:`read` only or using the :func:`make_line_iter` which safely iterates line-based over a WSGI input stream. :param stream: the stream to wrap. :param limit: the limit for the stream, must not be longer than what the string can provide if the stream does not end with `EOF` (like `wsgi.input`) N)rArrcCs |j|_|j|_d|_||_dS)Nr)rrreadline _readline_posr)rrArrrrrszLimitedStream.__init__rcCs|SrrrrrrrszLimitedStream.__iter__cCs |j|jkS)z4If the stream is exhausted this attribute is `True`.)rrrrrr is_exhaustedszLimitedStream.is_exhaustedcCs |dS)zThis is called when the stream tries to read past the limit. The return value of this function is returned from the reading function. r)rrrrr on_exhaustedszLimitedStream.on_exhaustedcCsddlm}|dS)aWhat should happen if a disconnect is detected? The return value of this function is returned from read functions in case the client went away. By default a :exc:`~werkzeug.exceptions.ClientDisconnected` exception is raised. r)ClientDisconnectedN) exceptionsr)rrrrr on_disconnects zLimitedStream.on_disconnect) chunk_sizercCs:|j|j}|}|dkr6t||}||||8}qdS)aExhaust the stream. This consumes all the data left until the limit is reached. :param chunk_size: the size for a chunk. It will read the chunk until the stream is exhausted and throw away the results. rN)rrminr)rrto_readrrrrexhausts    zLimitedStream.exhaust)sizerc Cs|j|jkr|S|dus$|dkr*|j}t|j|j|}z||}Wnttfyh|YS0|rt||kr|S|jt|7_|S)zyRead `size` bytes or if size is not provided everything is read. :param size: the number of bytes read. Nrf) rrrrrOSErrorr4rrW)rrrrrrrrs zLimitedStream.readc Cs|j|jkr|S|dur*|j|j}nt||j|j}z||}Wnttfyh|YS0|rz|sz|S|jt|7_|S)zReads one line from the stream.N) rrrrrr4rrrW)rrlinerrrrs zLimitedStream.readlinecCsp|j}g}|dur$t|j||}n|j}|dur@|||j8}|j|krLql||||dur*|j}q*|S)zReads a file into a list of strings. It calls :meth:`readline` until the file is read to the end. It does support the optional `size` argument if the underlying stream supports it for `readline`. N)rrrrr)rrZlast_posresultendrrr readliness zLimitedStream.readlinescCs|jS)zKReturns the position of the stream. .. versionadded:: 0.9 )rrrrrrszLimitedStream.tellcCs|}|st|Sr)rr)rrrrrrszLimitedStream.__next__cCsdSrrrrrrreadableszLimitedStream.readable)r)N)N)N)rrrrr:r<r=r2rrpropertyrrrrrrrrListrrrrrrrrr@bs!  r@)FFFN)N)T)rMrN)rMrN)rMrN)rMrN)rMr`T)r)NrF)NrF)=r>rtypingr:rH functoolsrr itertoolsr _internalrrr Zsansior r/Z sansio.utilsr urlsr r rrr TYPE_CHECKINGZ_typeshed.wsgirrrzrrrrrnr0rr2r7r,r8r<r=rCrLrSrTr]r_rrtrurrrrrrrIOBaser@rrrrs                '   &   D +   k6  4Z  _ M