test-url.py
424 lines
| 14.1 KiB
| text/x-python
|
PythonLexer
/ tests / test-url.py
|
r29451 | # coding=utf-8 | ||
|
r28914 | from __future__ import absolute_import, print_function | ||
import doctest | ||||
|
r15398 | import os | ||
|
r12592 | |||
def check(a, b): | ||||
if a != b: | ||||
|
r28677 | print((a, b)) | ||
|
r12592 | |||
|
r12606 | def cert(cn): | ||
|
r20685 | return {'subject': ((('commonName', cn),),)} | ||
|
r12606 | |||
|
r28914 | from mercurial import ( | ||
sslutil, | ||||
) | ||||
|
r12592 | |||
|
r28914 | _verifycert = sslutil._verifycert | ||
|
r12724 | # Test non-wildcard certificates | ||
|
r12606 | check(_verifycert(cert('example.com'), 'example.com'), | ||
None) | ||||
check(_verifycert(cert('example.com'), 'www.example.com'), | ||||
|
r37892 | b'certificate is for example.com') | ||
|
r12606 | check(_verifycert(cert('www.example.com'), 'example.com'), | ||
|
r37892 | b'certificate is for www.example.com') | ||
|
r12592 | |||
# Test wildcard certificates | ||||
|
r12606 | check(_verifycert(cert('*.example.com'), 'www.example.com'), | ||
None) | ||||
check(_verifycert(cert('*.example.com'), 'example.com'), | ||||
|
r37892 | b'certificate is for *.example.com') | ||
|
r12606 | check(_verifycert(cert('*.example.com'), 'w.w.example.com'), | ||
|
r37892 | b'certificate is for *.example.com') | ||
|
r12592 | |||
|
r13249 | # Test subjectAltName | ||
san_cert = {'subject': ((('commonName', 'example.com'),),), | ||||
'subjectAltName': (('DNS', '*.example.net'), | ||||
('DNS', 'example.net'))} | ||||
check(_verifycert(san_cert, 'example.net'), | ||||
None) | ||||
check(_verifycert(san_cert, 'foo.example.net'), | ||||
None) | ||||
|
r14666 | # no fallback to subject commonName when subjectAltName has DNS | ||
|
r13249 | check(_verifycert(san_cert, 'example.com'), | ||
|
r37892 | b'certificate is for *.example.net, example.net') | ||
|
r14666 | # fallback to subject commonName when no DNS in subjectAltName | ||
san_cert = {'subject': ((('commonName', 'example.com'),),), | ||||
'subjectAltName': (('IP Address', '8.8.8.8'),)} | ||||
check(_verifycert(san_cert, 'example.com'), None) | ||||
|
r13249 | |||
|
r12592 | # Avoid some pitfalls | ||
|
r12606 | check(_verifycert(cert('*.foo'), 'foo'), | ||
|
r37892 | b'certificate is for *.foo') | ||
|
r29452 | check(_verifycert(cert('*o'), 'foo'), None) | ||
|
r12592 | |||
|
r12742 | check(_verifycert({'subject': ()}, | ||
|
r12606 | 'example.com'), | ||
|
r37892 | b'no commonName or subjectAltName found in certificate') | ||
|
r12592 | check(_verifycert(None, 'example.com'), | ||
|
r37892 | b'no certificate received') | ||
|
r13248 | |||
|
r14666 | # Unicode (IDN) certname isn't supported | ||
check(_verifycert(cert(u'\u4f8b.jp'), 'example.jp'), | ||||
|
r37892 | b'IDN in certificate not supported') | ||
|
r14666 | |||
|
r29451 | # The following tests are from CPython's test_ssl.py. | ||
check(_verifycert(cert('example.com'), 'example.com'), None) | ||||
check(_verifycert(cert('example.com'), 'ExAmple.cOm'), None) | ||||
check(_verifycert(cert('example.com'), 'www.example.com'), | ||||
|
r37892 | b'certificate is for example.com') | ||
|
r29451 | check(_verifycert(cert('example.com'), '.example.com'), | ||
|
r37892 | b'certificate is for example.com') | ||
|
r29451 | check(_verifycert(cert('example.com'), 'example.org'), | ||
|
r37892 | b'certificate is for example.com') | ||
|
r29451 | check(_verifycert(cert('example.com'), 'exampleXcom'), | ||
|
r37892 | b'certificate is for example.com') | ||
|
r29451 | check(_verifycert(cert('*.a.com'), 'foo.a.com'), None) | ||
check(_verifycert(cert('*.a.com'), 'bar.foo.a.com'), | ||||
|
r37892 | b'certificate is for *.a.com') | ||
|
r29451 | check(_verifycert(cert('*.a.com'), 'a.com'), | ||
|
r37892 | b'certificate is for *.a.com') | ||
|
r29451 | check(_verifycert(cert('*.a.com'), 'Xa.com'), | ||
|
r37892 | b'certificate is for *.a.com') | ||
|
r29452 | check(_verifycert(cert('*.a.com'), '.a.com'), | ||
|
r37892 | b'certificate is for *.a.com') | ||
|
r29451 | |||
# only match one left-most wildcard | ||||
|
r29452 | check(_verifycert(cert('f*.com'), 'foo.com'), None) | ||
check(_verifycert(cert('f*.com'), 'f.com'), None) | ||||
|
r29451 | check(_verifycert(cert('f*.com'), 'bar.com'), | ||
|
r37892 | b'certificate is for f*.com') | ||
|
r29451 | check(_verifycert(cert('f*.com'), 'foo.a.com'), | ||
|
r37892 | b'certificate is for f*.com') | ||
|
r29451 | check(_verifycert(cert('f*.com'), 'bar.foo.com'), | ||
|
r37892 | b'certificate is for f*.com') | ||
|
r29451 | |||
# NULL bytes are bad, CVE-2013-4073 | ||||
check(_verifycert(cert('null.python.org\x00example.org'), | ||||
'null.python.org\x00example.org'), None) | ||||
check(_verifycert(cert('null.python.org\x00example.org'), | ||||
'example.org'), | ||||
|
r37892 | b'certificate is for null.python.org\x00example.org') | ||
|
r29451 | check(_verifycert(cert('null.python.org\x00example.org'), | ||
'null.python.org'), | ||||
|
r37892 | b'certificate is for null.python.org\x00example.org') | ||
|
r29451 | |||
# error cases with wildcards | ||||
check(_verifycert(cert('*.*.a.com'), 'bar.foo.a.com'), | ||||
|
r37892 | b'certificate is for *.*.a.com') | ||
|
r29451 | check(_verifycert(cert('*.*.a.com'), 'a.com'), | ||
|
r37892 | b'certificate is for *.*.a.com') | ||
|
r29451 | check(_verifycert(cert('*.*.a.com'), 'Xa.com'), | ||
|
r37892 | b'certificate is for *.*.a.com') | ||
|
r29451 | check(_verifycert(cert('*.*.a.com'), '.a.com'), | ||
|
r37892 | b'certificate is for *.*.a.com') | ||
|
r29451 | |||
check(_verifycert(cert('a.*.com'), 'a.foo.com'), | ||||
|
r37892 | b'certificate is for a.*.com') | ||
|
r29451 | check(_verifycert(cert('a.*.com'), 'a..com'), | ||
|
r37892 | b'certificate is for a.*.com') | ||
|
r29451 | check(_verifycert(cert('a.*.com'), 'a.com'), | ||
|
r37892 | b'certificate is for a.*.com') | ||
|
r29451 | |||
# wildcard doesn't match IDNA prefix 'xn--' | ||||
idna = u'püthon.python.org'.encode('idna').decode('ascii') | ||||
check(_verifycert(cert(idna), idna), None) | ||||
check(_verifycert(cert('x*.python.org'), idna), | ||||
|
r37892 | b'certificate is for x*.python.org') | ||
|
r29451 | check(_verifycert(cert('xn--p*.python.org'), idna), | ||
|
r37892 | b'certificate is for xn--p*.python.org') | ||
|
r29451 | |||
# wildcard in first fragment and IDNA A-labels in sequent fragments | ||||
# are supported. | ||||
idna = u'www*.pythön.org'.encode('idna').decode('ascii') | ||||
check(_verifycert(cert(idna), | ||||
u'www.pythön.org'.encode('idna').decode('ascii')), | ||||
|
r29452 | None) | ||
|
r29451 | check(_verifycert(cert(idna), | ||
u'www1.pythön.org'.encode('idna').decode('ascii')), | ||||
|
r29452 | None) | ||
|
r29451 | check(_verifycert(cert(idna), | ||
u'ftp.pythön.org'.encode('idna').decode('ascii')), | ||||
|
r37892 | b'certificate is for www*.xn--pythn-mua.org') | ||
|
r29451 | check(_verifycert(cert(idna), | ||
u'pythön.org'.encode('idna').decode('ascii')), | ||||
|
r37892 | b'certificate is for www*.xn--pythn-mua.org') | ||
|
r29451 | |||
c = { | ||||
'notAfter': 'Jun 26 21:41:46 2011 GMT', | ||||
'subject': (((u'commonName', u'linuxfrz.org'),),), | ||||
'subjectAltName': ( | ||||
('DNS', 'linuxfr.org'), | ||||
('DNS', 'linuxfr.com'), | ||||
('othername', '<unsupported>'), | ||||
) | ||||
} | ||||
check(_verifycert(c, 'linuxfr.org'), None) | ||||
check(_verifycert(c, 'linuxfr.com'), None) | ||||
# Not a "DNS" entry | ||||
check(_verifycert(c, '<unsupported>'), | ||||
|
r37892 | b'certificate is for linuxfr.org, linuxfr.com') | ||
|
r29451 | # When there is a subjectAltName, commonName isn't used | ||
check(_verifycert(c, 'linuxfrz.org'), | ||||
|
r37892 | b'certificate is for linuxfr.org, linuxfr.com') | ||
|
r29451 | |||
# A pristine real-world example | ||||
c = { | ||||
'notAfter': 'Dec 18 23:59:59 2011 GMT', | ||||
'subject': ( | ||||
((u'countryName', u'US'),), | ||||
((u'stateOrProvinceName', u'California'),), | ||||
((u'localityName', u'Mountain View'),), | ||||
((u'organizationName', u'Google Inc'),), | ||||
((u'commonName', u'mail.google.com'),), | ||||
), | ||||
} | ||||
check(_verifycert(c, 'mail.google.com'), None) | ||||
|
r37892 | check(_verifycert(c, 'gmail.com'), b'certificate is for mail.google.com') | ||
|
r29451 | |||
# Only commonName is considered | ||||
|
r37892 | check(_verifycert(c, 'California'), b'certificate is for mail.google.com') | ||
|
r29451 | |||
# Neither commonName nor subjectAltName | ||||
c = { | ||||
'notAfter': 'Dec 18 23:59:59 2011 GMT', | ||||
'subject': ( | ||||
((u'countryName', u'US'),), | ||||
((u'stateOrProvinceName', u'California'),), | ||||
((u'localityName', u'Mountain View'),), | ||||
((u'organizationName', u'Google Inc'),), | ||||
), | ||||
} | ||||
check(_verifycert(c, 'mail.google.com'), | ||||
|
r37892 | b'no commonName or subjectAltName found in certificate') | ||
|
r29451 | |||
# No DNS entry in subjectAltName but a commonName | ||||
c = { | ||||
'notAfter': 'Dec 18 23:59:59 2099 GMT', | ||||
'subject': ( | ||||
((u'countryName', u'US'),), | ||||
((u'stateOrProvinceName', u'California'),), | ||||
((u'localityName', u'Mountain View'),), | ||||
((u'commonName', u'mail.google.com'),), | ||||
), | ||||
'subjectAltName': (('othername', 'blabla'),), | ||||
} | ||||
check(_verifycert(c, 'mail.google.com'), None) | ||||
# No DNS entry subjectAltName and no commonName | ||||
c = { | ||||
'notAfter': 'Dec 18 23:59:59 2099 GMT', | ||||
'subject': ( | ||||
((u'countryName', u'US'),), | ||||
((u'stateOrProvinceName', u'California'),), | ||||
((u'localityName', u'Mountain View'),), | ||||
((u'organizationName', u'Google Inc'),), | ||||
), | ||||
'subjectAltName': (('othername', 'blabla'),), | ||||
} | ||||
check(_verifycert(c, 'google.com'), | ||||
|
r37892 | b'no commonName or subjectAltName found in certificate') | ||
|
r29451 | |||
# Empty cert / no cert | ||||
|
r37892 | check(_verifycert(None, 'example.com'), b'no certificate received') | ||
check(_verifycert({}, 'example.com'), b'no certificate received') | ||||
|
r29451 | |||
# avoid denials of service by refusing more than one | ||||
# wildcard per fragment. | ||||
check(_verifycert({'subject': (((u'commonName', u'a*b.com'),),)}, | ||||
|
r29452 | 'axxb.com'), None) | ||
|
r29451 | check(_verifycert({'subject': (((u'commonName', u'a*b.co*'),),)}, | ||
|
r37892 | 'axxb.com'), b'certificate is for a*b.co*') | ||
|
r29451 | check(_verifycert({'subject': (((u'commonName', u'a*b*.com'),),)}, | ||
|
r29452 | 'axxbxxc.com'), | ||
|
r37892 | b'too many wildcards in certificate DNS name: a*b*.com') | ||
|
r29451 | |||
|
r13770 | def test_url(): | ||
""" | ||||
|
r37891 | >>> from mercurial import error, pycompat | ||
|
r37974 | >>> from mercurial.util import url | ||
>>> from mercurial.utils.stringutil import forcebytestr | ||||
|
r13770 | |||
This tests for edge cases in url.URL's parsing algorithm. Most of | ||||
these aren't useful for documentation purposes, so they aren't | ||||
part of the class's doc tests. | ||||
Query strings and fragments: | ||||
|
r37892 | >>> url(b'http://host/a?b#c') | ||
|
r13770 | <url scheme: 'http', host: 'host', path: 'a', query: 'b', fragment: 'c'> | ||
|
r37892 | >>> url(b'http://host/a?') | ||
|
r13770 | <url scheme: 'http', host: 'host', path: 'a'> | ||
|
r37892 | >>> url(b'http://host/a#b#c') | ||
|
r13770 | <url scheme: 'http', host: 'host', path: 'a', fragment: 'b#c'> | ||
|
r37892 | >>> url(b'http://host/a#b?c') | ||
|
r13770 | <url scheme: 'http', host: 'host', path: 'a', fragment: 'b?c'> | ||
|
r37892 | >>> url(b'http://host/?a#b') | ||
|
r13770 | <url scheme: 'http', host: 'host', path: '', query: 'a', fragment: 'b'> | ||
|
r37892 | >>> url(b'http://host/?a#b', parsequery=False) | ||
|
r13770 | <url scheme: 'http', host: 'host', path: '?a', fragment: 'b'> | ||
|
r37892 | >>> url(b'http://host/?a#b', parsefragment=False) | ||
|
r13770 | <url scheme: 'http', host: 'host', path: '', query: 'a#b'> | ||
|
r37892 | >>> url(b'http://host/?a#b', parsequery=False, parsefragment=False) | ||
|
r13770 | <url scheme: 'http', host: 'host', path: '?a#b'> | ||
IPv6 addresses: | ||||
|
r37892 | >>> url(b'ldap://[2001:db8::7]/c=GB?objectClass?one') | ||
|
r13770 | <url scheme: 'ldap', host: '[2001:db8::7]', path: 'c=GB', | ||
query: 'objectClass?one'> | ||||
|
r37892 | >>> url(b'ldap://joe:xxx@[2001:db8::7]:80/c=GB?objectClass?one') | ||
|
r13770 | <url scheme: 'ldap', user: 'joe', passwd: 'xxx', host: '[2001:db8::7]', | ||
port: '80', path: 'c=GB', query: 'objectClass?one'> | ||||
Missing scheme, host, etc.: | ||||
|
r37892 | >>> url(b'://192.0.2.16:80/') | ||
|
r13770 | <url path: '://192.0.2.16:80/'> | ||
|
r37892 | >>> url(b'https://mercurial-scm.org') | ||
|
r26421 | <url scheme: 'https', host: 'mercurial-scm.org'> | ||
|
r37892 | >>> url(b'/foo') | ||
|
r13770 | <url path: '/foo'> | ||
|
r37892 | >>> url(b'bundle:/foo') | ||
|
r13770 | <url scheme: 'bundle', path: '/foo'> | ||
|
r37892 | >>> url(b'a?b#c') | ||
|
r13770 | <url path: 'a?b', fragment: 'c'> | ||
|
r37892 | >>> url(b'http://x.com?arg=/foo') | ||
|
r13770 | <url scheme: 'http', host: 'x.com', query: 'arg=/foo'> | ||
|
r37892 | >>> url(b'http://joe:xxx@/foo') | ||
|
r13770 | <url scheme: 'http', user: 'joe', passwd: 'xxx', path: 'foo'> | ||
Just a scheme and a path: | ||||
|
r37892 | >>> url(b'mailto:John.Doe@example.com') | ||
|
r13770 | <url scheme: 'mailto', path: 'John.Doe@example.com'> | ||
|
r37892 | >>> url(b'a:b:c:d') | ||
|
r13808 | <url path: 'a:b:c:d'> | ||
|
r37892 | >>> url(b'aa:bb:cc:dd') | ||
|
r13808 | <url scheme: 'aa', path: 'bb:cc:dd'> | ||
|
r13770 | |||
SSH examples: | ||||
|
r37892 | >>> url(b'ssh://joe@host//home/joe') | ||
|
r13770 | <url scheme: 'ssh', user: 'joe', host: 'host', path: '/home/joe'> | ||
|
r37892 | >>> url(b'ssh://joe:xxx@host/src') | ||
|
r13770 | <url scheme: 'ssh', user: 'joe', passwd: 'xxx', host: 'host', path: 'src'> | ||
|
r37892 | >>> url(b'ssh://joe:xxx@host') | ||
|
r13770 | <url scheme: 'ssh', user: 'joe', passwd: 'xxx', host: 'host'> | ||
|
r37892 | >>> url(b'ssh://joe@host') | ||
|
r13770 | <url scheme: 'ssh', user: 'joe', host: 'host'> | ||
|
r37892 | >>> url(b'ssh://host') | ||
|
r13770 | <url scheme: 'ssh', host: 'host'> | ||
|
r37892 | >>> url(b'ssh://') | ||
|
r13770 | <url scheme: 'ssh'> | ||
|
r37892 | >>> url(b'ssh:') | ||
|
r13770 | <url scheme: 'ssh'> | ||
Non-numeric port: | ||||
|
r37892 | >>> url(b'http://example.com:dd') | ||
|
r13770 | <url scheme: 'http', host: 'example.com', port: 'dd'> | ||
|
r37892 | >>> url(b'ssh://joe:xxx@host:ssh/foo') | ||
|
r13770 | <url scheme: 'ssh', user: 'joe', passwd: 'xxx', host: 'host', port: 'ssh', | ||
path: 'foo'> | ||||
Bad authentication credentials: | ||||
|
r37892 | >>> url(b'http://joe@joeville:123@4:@host/a?b#c') | ||
|
r13770 | <url scheme: 'http', user: 'joe@joeville', passwd: '123@4:', | ||
host: 'host', path: 'a', query: 'b', fragment: 'c'> | ||||
|
r37892 | >>> url(b'http://!*#?/@!*#?/:@host/a?b#c') | ||
|
r13770 | <url scheme: 'http', host: '!*', fragment: '?/@!*#?/:@host/a?b#c'> | ||
|
r37892 | >>> url(b'http://!*#?@!*#?:@host/a?b#c') | ||
|
r13770 | <url scheme: 'http', host: '!*', fragment: '?@!*#?:@host/a?b#c'> | ||
|
r37892 | >>> url(b'http://!*@:!*@@host/a?b#c') | ||
|
r13770 | <url scheme: 'http', user: '!*@', passwd: '!*@', host: 'host', | ||
path: 'a', query: 'b', fragment: 'c'> | ||||
File paths: | ||||
|
r37892 | >>> url(b'a/b/c/d.g.f') | ||
|
r13770 | <url path: 'a/b/c/d.g.f'> | ||
|
r37892 | >>> url(b'/x///z/y/') | ||
|
r13770 | <url path: '/x///z/y/'> | ||
|
r37892 | >>> url(b'/foo:bar') | ||
|
r13848 | <url path: '/foo:bar'> | ||
|
r37892 | >>> url(b'\\\\foo:bar') | ||
|
r13848 | <url path: '\\\\foo:bar'> | ||
|
r37892 | >>> url(b'./foo:bar') | ||
|
r13848 | <url path: './foo:bar'> | ||
|
r13770 | |||
|
r13817 | Non-localhost file URL: | ||
|
r37891 | >>> try: | ||
... u = url(b'file://mercurial-scm.org/foo') | ||||
... except error.Abort as e: | ||||
... forcebytestr(e) | ||||
'file:// URLs can only refer to localhost' | ||||
|
r13817 | |||
|
r13770 | Empty URL: | ||
|
r37892 | >>> u = url(b'') | ||
|
r13770 | >>> u | ||
<url path: ''> | ||||
>>> str(u) | ||||
'' | ||||
Empty path with query string: | ||||
|
r37892 | >>> str(url(b'http://foo/?bar')) | ||
|
r13770 | 'http://foo/?bar' | ||
Invalid path: | ||||
|
r37892 | >>> u = url(b'http://foo/bar') | ||
>>> u.path = b'bar' | ||||
|
r13770 | >>> str(u) | ||
'http://foo/bar' | ||||
|
r37892 | >>> u = url(b'file:/foo/bar/baz') | ||
|
r14313 | >>> u | ||
<url scheme: 'file', path: '/foo/bar/baz'> | ||||
>>> str(u) | ||||
'file:///foo/bar/baz' | ||||
|
r37892 | >>> pycompat.bytestr(u.localpath()) | ||
|
r15018 | '/foo/bar/baz' | ||
|
r14313 | |||
|
r37892 | >>> u = url(b'file:///foo/bar/baz') | ||
|
r13770 | >>> u | ||
<url scheme: 'file', path: '/foo/bar/baz'> | ||||
>>> str(u) | ||||
|
r14313 | 'file:///foo/bar/baz' | ||
|
r37892 | >>> pycompat.bytestr(u.localpath()) | ||
|
r15018 | '/foo/bar/baz' | ||
|
r37892 | >>> u = url(b'file:///f:oo/bar/baz') | ||
|
r15018 | >>> u | ||
<url scheme: 'file', path: 'f:oo/bar/baz'> | ||||
>>> str(u) | ||||
|
r15611 | 'file:///f:oo/bar/baz' | ||
|
r37892 | >>> pycompat.bytestr(u.localpath()) | ||
|
r15018 | 'f:oo/bar/baz' | ||
|
r14313 | |||
|
r37892 | >>> u = url(b'file://localhost/f:oo/bar/baz') | ||
|
r15496 | >>> u | ||
<url scheme: 'file', host: 'localhost', path: 'f:oo/bar/baz'> | ||||
>>> str(u) | ||||
|
r15513 | 'file://localhost/f:oo/bar/baz' | ||
|
r37892 | >>> pycompat.bytestr(u.localpath()) | ||
|
r15496 | 'f:oo/bar/baz' | ||
|
r37892 | >>> u = url(b'file:foo/bar/baz') | ||
|
r14313 | >>> u | ||
<url scheme: 'file', path: 'foo/bar/baz'> | ||||
>>> str(u) | ||||
'file:foo/bar/baz' | ||||
|
r37892 | >>> pycompat.bytestr(u.localpath()) | ||
|
r15018 | 'foo/bar/baz' | ||
|
r13770 | """ | ||
|
r15398 | if 'TERM' in os.environ: | ||
del os.environ['TERM'] | ||||
|
r13770 | doctest.testmod(optionflags=doctest.NORMALIZE_WHITESPACE) | ||