web_middlewares.py 4.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121
  1. import re
  2. from typing import TYPE_CHECKING, Tuple, Type, TypeVar
  3. from .typedefs import Handler, Middleware
  4. from .web_exceptions import HTTPMove, HTTPPermanentRedirect
  5. from .web_request import Request
  6. from .web_response import StreamResponse
  7. from .web_urldispatcher import SystemRoute
  8. __all__ = (
  9. "middleware",
  10. "normalize_path_middleware",
  11. )
  12. if TYPE_CHECKING:
  13. from .web_app import Application
  14. _Func = TypeVar("_Func")
  15. async def _check_request_resolves(request: Request, path: str) -> Tuple[bool, Request]:
  16. alt_request = request.clone(rel_url=path)
  17. match_info = await request.app.router.resolve(alt_request)
  18. alt_request._match_info = match_info
  19. if match_info.http_exception is None:
  20. return True, alt_request
  21. return False, request
  22. def middleware(f: _Func) -> _Func:
  23. f.__middleware_version__ = 1 # type: ignore[attr-defined]
  24. return f
  25. def normalize_path_middleware(
  26. *,
  27. append_slash: bool = True,
  28. remove_slash: bool = False,
  29. merge_slashes: bool = True,
  30. redirect_class: Type[HTTPMove] = HTTPPermanentRedirect,
  31. ) -> Middleware:
  32. """Factory for producing a middleware that normalizes the path of a request.
  33. Normalizing means:
  34. - Add or remove a trailing slash to the path.
  35. - Double slashes are replaced by one.
  36. The middleware returns as soon as it finds a path that resolves
  37. correctly. The order if both merge and append/remove are enabled is
  38. 1) merge slashes
  39. 2) append/remove slash
  40. 3) both merge slashes and append/remove slash.
  41. If the path resolves with at least one of those conditions, it will
  42. redirect to the new path.
  43. Only one of `append_slash` and `remove_slash` can be enabled. If both
  44. are `True` the factory will raise an assertion error
  45. If `append_slash` is `True` the middleware will append a slash when
  46. needed. If a resource is defined with trailing slash and the request
  47. comes without it, it will append it automatically.
  48. If `remove_slash` is `True`, `append_slash` must be `False`. When enabled
  49. the middleware will remove trailing slashes and redirect if the resource
  50. is defined
  51. If merge_slashes is True, merge multiple consecutive slashes in the
  52. path into one.
  53. """
  54. correct_configuration = not (append_slash and remove_slash)
  55. assert correct_configuration, "Cannot both remove and append slash"
  56. @middleware
  57. async def impl(request: Request, handler: Handler) -> StreamResponse:
  58. if isinstance(request.match_info.route, SystemRoute):
  59. paths_to_check = []
  60. if "?" in request.raw_path:
  61. path, query = request.raw_path.split("?", 1)
  62. query = "?" + query
  63. else:
  64. query = ""
  65. path = request.raw_path
  66. if merge_slashes:
  67. paths_to_check.append(re.sub("//+", "/", path))
  68. if append_slash and not request.path.endswith("/"):
  69. paths_to_check.append(path + "/")
  70. if remove_slash and request.path.endswith("/"):
  71. paths_to_check.append(path[:-1])
  72. if merge_slashes and append_slash:
  73. paths_to_check.append(re.sub("//+", "/", path + "/"))
  74. if merge_slashes and remove_slash:
  75. merged_slashes = re.sub("//+", "/", path)
  76. paths_to_check.append(merged_slashes[:-1])
  77. for path in paths_to_check:
  78. path = re.sub("^//+", "/", path) # SECURITY: GHSA-v6wp-4m6f-gcjg
  79. resolves, request = await _check_request_resolves(request, path)
  80. if resolves:
  81. raise redirect_class(request.raw_path + query)
  82. return await handler(request)
  83. return impl
  84. def _fix_request_current_app(app: "Application") -> Middleware:
  85. @middleware
  86. async def impl(request: Request, handler: Handler) -> StreamResponse:
  87. match_info = request.match_info
  88. prev = match_info.current_app
  89. match_info.current_app = app
  90. try:
  91. return await handler(request)
  92. finally:
  93. match_info.current_app = prev
  94. return impl