_abnf.py 4.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132
  1. # We use native strings for all the re patterns, to take advantage of string
  2. # formatting, and then convert to bytestrings when compiling the final re
  3. # objects.
  4. # https://svn.tools.ietf.org/svn/wg/httpbis/specs/rfc7230.html#whitespace
  5. # OWS = *( SP / HTAB )
  6. # ; optional whitespace
  7. OWS = r"[ \t]*"
  8. # https://svn.tools.ietf.org/svn/wg/httpbis/specs/rfc7230.html#rule.token.separators
  9. # token = 1*tchar
  10. #
  11. # tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*"
  12. # / "+" / "-" / "." / "^" / "_" / "`" / "|" / "~"
  13. # / DIGIT / ALPHA
  14. # ; any VCHAR, except delimiters
  15. token = r"[-!#$%&'*+.^_`|~0-9a-zA-Z]+"
  16. # https://svn.tools.ietf.org/svn/wg/httpbis/specs/rfc7230.html#header.fields
  17. # field-name = token
  18. field_name = token
  19. # The standard says:
  20. #
  21. # field-value = *( field-content / obs-fold )
  22. # field-content = field-vchar [ 1*( SP / HTAB ) field-vchar ]
  23. # field-vchar = VCHAR / obs-text
  24. # obs-fold = CRLF 1*( SP / HTAB )
  25. # ; obsolete line folding
  26. # ; see Section 3.2.4
  27. #
  28. # https://tools.ietf.org/html/rfc5234#appendix-B.1
  29. #
  30. # VCHAR = %x21-7E
  31. # ; visible (printing) characters
  32. #
  33. # https://svn.tools.ietf.org/svn/wg/httpbis/specs/rfc7230.html#rule.quoted-string
  34. # obs-text = %x80-FF
  35. #
  36. # However, the standard definition of field-content is WRONG! It disallows
  37. # fields containing a single visible character surrounded by whitespace,
  38. # e.g. "foo a bar".
  39. #
  40. # See: https://www.rfc-editor.org/errata_search.php?rfc=7230&eid=4189
  41. #
  42. # So our definition of field_content attempts to fix it up...
  43. #
  44. # Also, we allow lots of control characters, because apparently people assume
  45. # that they're legal in practice (e.g., google analytics makes cookies with
  46. # \x01 in them!):
  47. # https://github.com/python-hyper/h11/issues/57
  48. # We still don't allow NUL or whitespace, because those are often treated as
  49. # meta-characters and letting them through can lead to nasty issues like SSRF.
  50. vchar = r"[\x21-\x7e]"
  51. vchar_or_obs_text = r"[^\x00\s]"
  52. field_vchar = vchar_or_obs_text
  53. field_content = r"{field_vchar}+(?:[ \t]+{field_vchar}+)*".format(**globals())
  54. # We handle obs-fold at a different level, and our fixed-up field_content
  55. # already grows to swallow the whole value, so ? instead of *
  56. field_value = r"({field_content})?".format(**globals())
  57. # header-field = field-name ":" OWS field-value OWS
  58. header_field = (
  59. r"(?P<field_name>{field_name})"
  60. r":"
  61. r"{OWS}"
  62. r"(?P<field_value>{field_value})"
  63. r"{OWS}".format(**globals())
  64. )
  65. # https://svn.tools.ietf.org/svn/wg/httpbis/specs/rfc7230.html#request.line
  66. #
  67. # request-line = method SP request-target SP HTTP-version CRLF
  68. # method = token
  69. # HTTP-version = HTTP-name "/" DIGIT "." DIGIT
  70. # HTTP-name = %x48.54.54.50 ; "HTTP", case-sensitive
  71. #
  72. # request-target is complicated (see RFC 7230 sec 5.3) -- could be path, full
  73. # URL, host+port (for connect), or even "*", but in any case we are guaranteed
  74. # that it contists of the visible printing characters.
  75. method = token
  76. request_target = r"{vchar}+".format(**globals())
  77. http_version = r"HTTP/(?P<http_version>[0-9]\.[0-9])"
  78. request_line = (
  79. r"(?P<method>{method})"
  80. r" "
  81. r"(?P<target>{request_target})"
  82. r" "
  83. r"{http_version}".format(**globals())
  84. )
  85. # https://svn.tools.ietf.org/svn/wg/httpbis/specs/rfc7230.html#status.line
  86. #
  87. # status-line = HTTP-version SP status-code SP reason-phrase CRLF
  88. # status-code = 3DIGIT
  89. # reason-phrase = *( HTAB / SP / VCHAR / obs-text )
  90. status_code = r"[0-9]{3}"
  91. reason_phrase = r"([ \t]|{vchar_or_obs_text})*".format(**globals())
  92. status_line = (
  93. r"{http_version}"
  94. r" "
  95. r"(?P<status_code>{status_code})"
  96. # However, there are apparently a few too many servers out there that just
  97. # leave out the reason phrase:
  98. # https://github.com/scrapy/scrapy/issues/345#issuecomment-281756036
  99. # https://github.com/seanmonstar/httparse/issues/29
  100. # so make it optional. ?: is a non-capturing group.
  101. r"(?: (?P<reason>{reason_phrase}))?".format(**globals())
  102. )
  103. HEXDIG = r"[0-9A-Fa-f]"
  104. # Actually
  105. #
  106. # chunk-size = 1*HEXDIG
  107. #
  108. # but we impose an upper-limit to avoid ridiculosity. len(str(2**64)) == 20
  109. chunk_size = r"({HEXDIG}){{1,20}}".format(**globals())
  110. # Actually
  111. #
  112. # chunk-ext = *( ";" chunk-ext-name [ "=" chunk-ext-val ] )
  113. #
  114. # but we aren't parsing the things so we don't really care.
  115. chunk_ext = r";.*"
  116. chunk_header = (
  117. r"(?P<chunk_size>{chunk_size})"
  118. r"(?P<chunk_ext>{chunk_ext})?"
  119. r"{OWS}\r\n".format(
  120. **globals()
  121. ) # Even though the specification does not allow for extra whitespaces,
  122. # we are lenient with trailing whitespaces because some servers on the wild use it.
  123. )