jingrow/gunicorn
1
0
Fork 0
mirror of https://github.com/frappe/gunicorn.git synced 2026-01-14 11:09:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #690 from levigross/master

Browse Source 
Invalid user supplied messages should be HTML entity escaped.
This commit is contained in:
Randall Leeds 2014-02-06 12:45:34 -08:00
commit 56b9fca562
2 changed files with 15 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
gunicorn/util.py
View File

@ -18,11 +18,13 @@ import traceback
import inspect import inspect
import errno import errno
import warnings import warnings
import cgi
from gunicorn.errors import AppImportError from gunicorn.errors import AppImportError
from gunicorn.six import text_type, string_types from gunicorn.six import text_type
from gunicorn.workers import SUPPORTED_WORKERS from gunicorn.workers import SUPPORTED_WORKERS
MAXFD = 1024 MAXFD = 1024
REDIRECT_TO = getattr(os, 'devnull', '/dev/null') REDIRECT_TO = getattr(os, 'devnull', '/dev/null')
@ -328,11 +330,11 @@ def write_error(sock, status_int, reason, mesg):
<title>%(reason)s</title> <title>%(reason)s</title>
</head> </head>
<body> <body>
<h1>%(reason)s</h1> <h1><p>%(reason)s</p></h1>
%(mesg)s %(mesg)s
</body> </body>
</html> </html>
""") % {"reason": reason, "mesg": mesg} """) % {"reason": reason, "mesg": cgi.escape(mesg)}
http = textwrap.dedent("""\ http = textwrap.dedent("""\
HTTP/1.1 %s %s\r HTTP/1.1 %s %s\r

20
gunicorn/workers/base.py
View File

@ -88,7 +88,7 @@ class Worker(object):
raise SystemExit() raise SystemExit()
Reloader(callback=changed).start() Reloader(callback=changed).start()
# set enviroment' variables # set environment' variables
if self.cfg.env: if self.cfg.env:
for k, v in self.cfg.env.items(): for k, v in self.cfg.env.items():
os.environ[k] = v os.environ[k] = v
@ -104,7 +104,7 @@ class Worker(object):
util.set_non_blocking(p) util.set_non_blocking(p)
util.close_on_exec(p) util.close_on_exec(p)
# Prevent fd inherientence # Prevent fd inheritance
[util.close_on_exec(s) for s in self.sockets] [util.close_on_exec(s) for s in self.sockets]
util.close_on_exec(self.tmp.fileno()) util.close_on_exec(self.tmp.fileno())
@ -159,24 +159,24 @@ class Worker(object):
reason = "Bad Request" reason = "Bad Request"
if isinstance(exc, InvalidRequestLine): if isinstance(exc, InvalidRequestLine):
mesg = "<p>Invalid Request Line '%s'</p>" % str(exc) mesg = "Invalid Request Line '%s'" % str(exc)
elif isinstance(exc, InvalidRequestMethod): elif isinstance(exc, InvalidRequestMethod):
mesg = "<p>Invalid Method '%s'</p>" % str(exc) mesg = "Invalid Method '%s'" % str(exc)
elif isinstance(exc, InvalidHTTPVersion): elif isinstance(exc, InvalidHTTPVersion):
mesg = "<p>Invalid HTTP Version '%s'</p>" % str(exc) mesg = "Invalid HTTP Version '%s'" % str(exc)
elif isinstance(exc, (InvalidHeaderName, InvalidHeader,)): elif isinstance(exc, (InvalidHeaderName, InvalidHeader,)):
mesg = "<p>%s</p>" % str(exc) mesg = "%s" % str(exc)
if not req and hasattr(exc, "req"): if not req and hasattr(exc, "req"):
req = exc.req # for access log req = exc.req # for access log
elif isinstance(exc, LimitRequestLine): elif isinstance(exc, LimitRequestLine):
mesg = "<p>%s</p>" % str(exc) mesg = "%s" % str(exc)
elif isinstance(exc, LimitRequestHeaders): elif isinstance(exc, LimitRequestHeaders):
mesg = "<p>Error parsing headers: '%s'</p>" % str(exc) mesg = "Error parsing headers: '%s'" % str(exc)
elif isinstance(exc, InvalidProxyLine): elif isinstance(exc, InvalidProxyLine):
mesg = "<p>'%s'</p>" % str(exc) mesg = "'%s'" % str(exc)
elif isinstance(exc, ForbiddenProxyRequest): elif isinstance(exc, ForbiddenProxyRequest):
reason = "Forbidden" reason = "Forbidden"
mesg = "<p>Request forbidden</p>" mesg = "Request forbidden"
status_int = 403 status_int = 403
self.log.debug("Invalid request from ip={ip}: {error}"\ self.log.debug("Invalid request from ip={ip}: {error}"\