This is an archive of the discontinued Mercurial Phabricator instance.

Differential D2737

hgweb: teach WSGI parser about query strings
ClosedPublic

Authored by indygreg on Mar 8 2018, 8:06 PM.

Details

Reviewers
durin42
Group Reviewers
hg-reviewers
Commits
rHG3c15b84ab66c: hgweb: teach WSGI parser about query strings
rHGb48ac58ea4f6: hgweb: teach WSGI parser about query strings
Summary

Currently, req.form uses cgi.parse() to populate form data. Depending
on the request, form data can come from POST multipart/form-data,
application/x-www-form-urlencoded, or the URL query string.

Putting all these things into one data structure makes it difficult
to reason about how exactly parameters got to the request. It can
lead to wonkiness such as pulling parameters from both the URL and
POST data.

This commit teaches our WSGI request parser about argument data
in query strings. We populate fields containing the query string
data and only the query string data so it can't be confused with
POST data.

Diff Detail

Repository
rHG Mercurial
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

indygreg created this revision.Mar 8 2018, 8:06 PM
durin42 accepted this revision.Mar 9 2018, 2:02 PM
This revision is now accepted and ready to land.Mar 9 2018, 2:02 PM
Closed by commit rHGb48ac58ea4f6: hgweb: teach WSGI parser about query strings (authored by indygreg). · Explain WhyMar 9 2018, 2:29 PM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathPackages
Mmercurial/hgweb/request.py (19 lines)
Mmercurial/urllibcompat.py (2 lines)

Diff 6780

mercurial/hgweb/request.py

# WSGI application path. # WSGI application path.
apppath = attr.ib() apppath = attr.ib()
# List of path parts to be used for dispatch. # List of path parts to be used for dispatch.
dispatchparts = attr.ib() dispatchparts = attr.ib()
# URL path component (no query string) used for dispatch. # URL path component (no query string) used for dispatch.
dispatchpath = attr.ib() dispatchpath = attr.ib()
# Raw query string (part after "?" in URL). # Raw query string (part after "?" in URL).
querystring = attr.ib() querystring = attr.ib()
# List of 2-tuples of query string arguments.
querystringlist = attr.ib()
# Dict of query string arguments. Values are lists with at least 1 item.
querystringdict = attr.ib()
def parserequestfromenv(env): def parserequestfromenv(env):
"""Parse URL components from environment variables. """Parse URL components from environment variables.
WSGI defines request attributes via environment variables. This function WSGI defines request attributes via environment variables. This function
parses the environment variables into a data structure. parses the environment variables into a data structure.
""" """
# PEP-0333 defines the WSGI spec and is a useful reference for this code. # PEP-0333 defines the WSGI spec and is a useful reference for this code.
dispatchparts = dispatchparts[len(repoparts):] dispatchparts = dispatchparts[len(repoparts):]
else: else:
dispatchparts = [] dispatchparts = []
dispatchpath = '/'.join(dispatchparts) dispatchpath = '/'.join(dispatchparts)
querystring = env.get('QUERY_STRING', '') querystring = env.get('QUERY_STRING', '')
# We store as a list so we have ordering information. We also store as
# a dict to facilitate fast lookup.
querystringlist = util.urlreq.parseqsl(querystring, keep_blank_values=True)
querystringdict = {}
for k, v in querystringlist:
if k in querystringdict:
querystringdict[k].append(v)
else:
querystringdict[k] = [v]
return parsedrequest(url=fullurl, baseurl=baseurl, return parsedrequest(url=fullurl, baseurl=baseurl,
advertisedurl=advertisedfullurl, advertisedurl=advertisedfullurl,
advertisedbaseurl=advertisedbaseurl, advertisedbaseurl=advertisedbaseurl,
apppath=apppath, apppath=apppath,
dispatchparts=dispatchparts, dispatchpath=dispatchpath, dispatchparts=dispatchparts, dispatchpath=dispatchpath,
querystring=querystring) querystring=querystring,
querystringlist=querystringlist,
querystringdict=querystringdict)
class wsgirequest(object): class wsgirequest(object):
"""Higher-level API for a WSGI request. """Higher-level API for a WSGI request.
WSGI applications are invoked with 2 arguments. They are used to WSGI applications are invoked with 2 arguments. They are used to
instantiate instances of this class, which provides higher-level APIs instantiate instances of this class, which provides higher-level APIs
for obtaining request parameters, writing HTTP output, etc. for obtaining request parameters, writing HTTP output, etc.
""" """

mercurial/urllibcompat.py

"splitattr", "splitattr",
"splitpasswd", "splitpasswd",
"splitport", "splitport",
"splituser", "splituser",
"urlparse", "urlparse",
"urlunparse", "urlunparse",
)) ))
urlreq._registeralias(urllib.parse, "parse_qs", "parseqs") urlreq._registeralias(urllib.parse, "parse_qs", "parseqs")
urlreq._registeralias(urllib.parse, "parse_qsl", "parseqsl")
urlreq._registeralias(urllib.parse, "unquote_to_bytes", "unquote") urlreq._registeralias(urllib.parse, "unquote_to_bytes", "unquote")
import urllib.request import urllib.request
urlreq._registeraliases(urllib.request, ( urlreq._registeraliases(urllib.request, (
"AbstractHTTPHandler", "AbstractHTTPHandler",
"BaseHandler", "BaseHandler",
"build_opener", "build_opener",
"FileHandler", "FileHandler",
"FTPHandler", "FTPHandler",
"Request", "Request",
"urlopen", "urlopen",
)) ))
urlreq._registeraliases(urlparse, ( urlreq._registeraliases(urlparse, (
"urlparse", "urlparse",
"urlunparse", "urlunparse",
)) ))
urlreq._registeralias(urlparse, "parse_qs", "parseqs") urlreq._registeralias(urlparse, "parse_qs", "parseqs")
urlreq._registeralias(urlparse, "parse_qsl", "parseqsl")
urlerr._registeraliases(urllib2, ( urlerr._registeraliases(urllib2, (
"HTTPError", "HTTPError",
"URLError", "URLError",
)) ))
httpserver._registeraliases(BaseHTTPServer, ( httpserver._registeraliases(BaseHTTPServer, (
"HTTPServer", "HTTPServer",
"BaseHTTPRequestHandler", "BaseHTTPRequestHandler",
)) ))