You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In a similar vein as #119 there is another difference between WebTest and a real WSGI server: WebTest passes HTTP headers through as-is, but HTTP has syntactical rules that need to be obeyed. I noticed this when I tried to base64-encode a (somewhat lengthy) header value -- the result can contain newlines, which (when not escaped) do not survive a transport through HTTP.
Here is an example:
fromwsgiref.simple_serverimportWSGIServer, WSGIRequestHandlerimportjsonimportrequestsimportthreadingimportunittestimportwebtestclassTest(unittest.TestCase):
HEADERS= {'X-Foo': 'Bar\nBaz\n'}
deftest_real_http_truncates_header_on_newline(self):
server=WSGIServer(('localhost', 0), WSGIRequestHandler)
port=server.server_portserver.set_app(echo_header_app)
thread=threading.Thread(target=server.serve_forever)
thread.daemon=Truethread.start()
r=requests.get('http://localhost:%s/'%port, headers=self.HEADERS)
# This is the expected truncated result.self.assertEqual('Bar', r.json()['HTTP_X_FOO'])
server.shutdown()
thread.join()
deftest_webtest_should_not_pass_header_through_unchecked(self):
app=webtest.TestApp(echo_header_app)
r=app.get('/', headers=self.HEADERS)
# This fails, actual value is 'Bar\nBaz\n'self.assertEqual('Bar', json.loads(r.body)['HTTP_X_FOO'])
defecho_header_app(env, start_response):
status='200 OK'headers= [('Content-type', 'application/json')]
start_response(status, headers)
return [json.dumps(
{key: valueforkey, valueinenv.items() ifkey.startswith('HTTP_')})]
The text was updated successfully, but these errors were encountered:
In a similar vein as #119 there is another difference between WebTest and a real WSGI server: WebTest passes HTTP headers through as-is, but HTTP has syntactical rules that need to be obeyed. I noticed this when I tried to base64-encode a (somewhat lengthy) header value -- the result can contain newlines, which (when not escaped) do not survive a transport through HTTP.
Here is an example:
The text was updated successfully, but these errors were encountered: