Deal fully with deprecated functions.

If possible use a function based on inspect.signature to calculate the
arity.  If inspect.signature is not available fall back to getargspec. The
version based on inspect.signature looks like more code but is actually a
subset of what inspect.getfullargspec does.

html.escape is preferred over cgi.escape primarily because it defaults quote
to True. For this reason pass quote=True to cgi.escape when used.

gunicorn/_compat.py

@@ -262,3 +262,37 @@ if PY26:
 
 else:
     from gunicorn.six.moves.urllib.parse import urlsplit
+
+
+import inspect
+
+if hasattr(inspect, 'signature'):
+    positionals = (
+        inspect.Parameter.POSITIONAL_ONLY,
+        inspect.Parameter.POSITIONAL_OR_KEYWORD,
+    )
+
+    def get_arity(f):
+        sig = inspect.signature(f)
+        arity = 0
+
+        for param in sig.parameters.values():
+            if param.kind in positionals:
+                arity += 1
+
+        return arity
+else:
+    def get_arity(f):
+        return len(inspect.getargspec(f)[0])
+
+
+try:
+    import html
+
+    def html_escape(s):
+        return html.escape(s)
+except ImportError:
+    import cgi
+
+    def html_escape(s):
+        return cgi.escape(s, quote=True)

gunicorn/config.py

@@ -426,7 +426,7 @@ def validate_callable(arity):
                     "" % (obj_name, mod_name))
         if not six.callable(val):
             raise TypeError("Value is not six.callable: %s" % val)
-        if arity != -1 and arity != len(inspect.getargspec(val)[0]):
+        if arity != -1 and arity != _compat.get_arity(val):
             raise TypeError("Value must have an arity of: %s" % arity)
         return val
     return _validate_callable
@@ -464,7 +464,7 @@ def validate_group(val):
 def validate_post_request(val):
     val = validate_callable(-1)(val)
 
-    largs = len(inspect.getargspec(val)[0])
+    largs = _compat.get_arity(val)
     if largs == 4:
         return val
     elif largs == 3:

gunicorn/util.py

@@ -20,9 +20,9 @@ import traceback
 import inspect
 import errno
 import warnings
-import cgi
 import logging
 
+from gunicorn import _compat
 from gunicorn.errors import AppImportError
 from gunicorn.six import text_type
 from gunicorn.workers import SUPPORTED_WORKERS
@@ -329,7 +329,7 @@ def write_error(sock, status_int, reason, mesg):
         %(mesg)s
       </body>
     </html>
-    """) % {"reason": reason, "mesg": cgi.escape(mesg)}
+    """) % {"reason": reason, "mesg": _compat.html_escape(mesg)}
 
     http = textwrap.dedent("""\
     HTTP/1.1 %s %s\r