Ben Darnell [Fri, 11 Aug 2023 01:41:40 +0000 (21:41 -0400)]
httpserver_test: Add ExpectLog to fix CI
The github security advisory feature lets you make private PRs but
it apparently doesn't support CI so this log failure wasn't caught
until after the PR was merged.
Ben Darnell [Wed, 9 Aug 2023 01:55:02 +0000 (21:55 -0400)]
http1connection: Make content-length parsing more strict
Content-length and chunk size parsing now strictly matches the RFCs.
We previously used the python int() function which accepted leading
plus signs and internal underscores, which are not allowed by the
HTTP RFCs (it also accepts minus signs, but these are less problematic
in this context since they'd result in errors elsewhere)
It is important to fix this because when combined with certain proxies,
the lax parsing could result in a request smuggling vulnerability (if
both Tornado and the proxy accepted an invalid content-length but
interpreted it differently). This is known to occur with old versions
of haproxy, although the current version of haproxy is unaffected.
Ben Darnell [Sun, 14 May 2023 00:58:52 +0000 (20:58 -0400)]
web: Fix an open redirect in StaticFileHandler
Under some configurations the default_filename redirect could be exploited
to redirect to an attacker-controlled site. This change refuses to redirect
to URLs that could be misinterpreted.
A test case for the specific vulnerable configuration will follow after the
patch has been available.
Ben Darnell [Sun, 23 Apr 2023 19:15:05 +0000 (15:15 -0400)]
test: Close a websocket client that causes occasional test failures
These failures occur on the build.yml workflow on the emulated arm64
platform: an ill-timed timer firing during test shutdown can result
in a message being logged and the test failing for dirty logs.
Ben Darnell [Sun, 9 Apr 2023 21:31:38 +0000 (21:31 +0000)]
ci: Update build workflow
Build wheels for Python 3.12 as well.
Update various dependencies. The upload/download artifact actions
were using deprecated versions, and we were using a deprecated
macos build image. While we're at it, update the other OS versions
and cibuildwheel.
Ben Darnell [Sat, 8 Apr 2023 19:42:05 +0000 (19:42 +0000)]
typing: Eagerly import all submodules in __init__.pyi
This makes the auto-import functionality compatible with mypy
and other typing-based tools such as autocomplete functionality.
Excluding these imports from static typing feels like a premature
optimization and made it much less appealing to make use of the
auto-imports.
This may slow down type checking of applications that use Tornado by
a little, since the type checker must now process all of Tornado and
not only the subset that was imported. However, the increasing use
of long-lived daemons for type checkers should mitigate this cost.
Ben Darnell [Wed, 15 Feb 2023 21:23:32 +0000 (21:23 +0000)]
wsgi: Set multithread flag correctly
Required making WSGIContainer.environ() an instance method.
This is technically a backwards-incompatible change to a documented
method but it was never really meant to be documented and seems
unlikely to be used.
Ben Darnell [Wed, 8 Feb 2023 20:12:47 +0000 (20:12 +0000)]
asyncio: Remove obsolete code
AsyncioLoop.start() used to save, set, and restore the thread-local
event loop. This avoided some edge cases in early versions of asyncio;
this appears to no longer be necessary since Python 3.7 introduced
the get_running_loop() method.
Removing this logic improves compatibility with Python 3.12, where
it is difficult if not impossible to do the same thing without
generating DeprecationWarnings.
Ben Darnell [Sat, 28 Jan 2023 19:10:16 +0000 (19:10 +0000)]
web: List all set_cookie arguments instead of kwargs
Multiple arguments needed special cases anyway, so it's better to
just be explicit about what's supported.
set_signed_cookie still uses kwarg forwarding since we don't need
to worry about the special cases at this level and using
explicit arguments would involve duplicating defaults in multiple
places.
Ben Darnell [Mon, 23 Jan 2023 18:51:53 +0000 (18:51 +0000)]
web: Rename "secure_cookie" methods to "signed_cookie"
This more precisely states the kind of security that is provided, and
avoids confusion with the use of the word "secure" as a standard
cookie attribute and prefix.
Ben Darnell [Fri, 20 Jan 2023 20:05:50 +0000 (20:05 +0000)]
Update most deps
Sphinx is pinned to <6 because of a conflict with sphinx_rtd_theme
Tox is pinned to <4 because we're affected by some backwards-incompatible
renamings in the config file.
Ben Darnell [Fri, 20 Jan 2023 19:51:28 +0000 (19:51 +0000)]
Consolidate maint and docs requirements files
This division was just complicating things unnecessarily.
Also adopt pip-tools instead of doing it all by hand.
No pinned versions have been changed in this commit.
Ben Darnell [Fri, 16 Dec 2022 20:52:15 +0000 (15:52 -0500)]
ci: Skip python 3.12 for now
The breaking changes begun by the deprecation warnings in 3.10 have
arrived, but according to https://github.com/python/cpython/issues/93453
the scope has changed somewhat (for the better, I think). Don't test
on 3.12 until we've adapted to the new plan.
Ben Darnell [Sun, 27 Nov 2022 20:06:08 +0000 (15:06 -0500)]
all: Support lazy imports of submodules
A getattr hook in the top-level "tornado" package now imports submodules
automatically, eliminating the need to explicitly reference multiple submodules
in imports
Ben Darnell [Sun, 27 Nov 2022 02:50:04 +0000 (21:50 -0500)]
testing: Deprecate environment-dependent behavior in ExpectLog
ExpectLog is sensitive to the difference between tornado.testing.main
(which sets the logging level to info) and most other test runners,
which do not. In the future ExpectLog will match WARNING and above
by default; matching lower levels without using the ``level`` argument
is deprecated.
Fix one test in httpserver_test.py that is affected by this.
Ben Darnell [Sat, 19 Nov 2022 22:20:33 +0000 (17:20 -0500)]
setup: Drop support for python 3.7
The main reason to drop this version before it reaches its EOL is so
that we can begin to use unittest.IsolatedAsyncioTestCase to replace
deprecated portions of the tornado.testing module.
A secondary reason is that Python 3.8 introduced support for the
samesite cookie attribute, which allows us to deprecate the
xsrf_token mechanism.
projects / thirdparty / tornado.git / log
