Ben Darnell [Fri, 8 Aug 2025 17:50:45 +0000 (13:50 -0400)]
web_test: Move an ignore_deprecation block
When warnings are in context-aware mode (the default in free-threaded
Python 3.14), the server captures the context from setUp and does not
see the warning filter installed in the test method. Move the warning
filter into the handler so it works consistently regardless of the
context_aware_warnings flag.
Ben Darnell [Thu, 24 Jul 2025 20:37:48 +0000 (20:37 +0000)]
websocket: Expand testing of next-ping calculation
Includes end-to-end tests that the correct number of pings are sent
(piggybacking on an existing test) and a unit test for the
`ping_sleep_time` calculation.
Oliver Sanders [Thu, 19 Jun 2025 10:06:29 +0000 (11:06 +0100)]
websocket_ping: fix ping interval with non-zero timeout and improve docs.
* Fix a bug that caused the ping interval to be less frequent than
configured.
* Fix erroneous documentation of the websocket_ping_timeout default and
clarify units for the ping interval.
- current version of setuptools (70.1+) does not need wheel at all
- older versions of setuptools would fetch wheel when building wheels (but not sdists)
Fix ValueError in file_uploader.py by converting @gen.coroutine to async/await
Fixes #3182
The file_uploader.py demo was failing with ValueError when trying to upload files
because @gen.coroutine decorated functions return tornado.concurrent.Future objects,
but asyncio.run() expects native coroutines.
This change converts the @gen.coroutine decorated functions to native async/await
syntax, which is the modern recommended approach and resolves the compatibility
issue with asyncio.run().
Changes:
- Remove tornado.gen import
- Convert @gen.coroutine decorators to async def
- Convert all yield statements to await
- Maintains backward compatibility with existing Tornado versions
Ben Darnell [Tue, 22 Jul 2025 17:54:03 +0000 (17:54 +0000)]
http1connection: Improve error logging for invalid host headers
This was previously being logged as an uncaught exception in application
code, which is wrong for a malformed request. HTTPInputError now passes
through the app-error logging to be caught and reported as a 400
(which logs at the warning level to the access log and info to the
general log).
Ben Darnell [Fri, 23 May 2025 01:05:58 +0000 (21:05 -0400)]
ci: Use Windows ARM builders
Now that native ARM builders are available for windows, we can use
them instead of cross-compiling. This improves parallelism in our build
and speeds things up a bit, plus we can test the windows-arm builds now.
Also stop producing x86_64 builds for macos, since they are redundant
with the universal2 builds (the x86_64 builds were useful with older
version of pip, but they've been fully supported for 5 years now).
Ben Darnell [Thu, 22 May 2025 14:59:48 +0000 (10:59 -0400)]
httputil: Fix support for non-latin1 filenames in multipart uploads
The change to be stricter about characters allowed in HTTP headers
inadvertently broke support for non-latin1 filenames in multipart
uploads (this was missed in testing because our i18n test case only
used characters in latin1). This commit adds a hacky workaround without
changing any APIs to make it safe for a 6.5.1 patch release; a more
robust solution will follow for future releases.
Ben Darnell [Thu, 8 May 2025 17:29:43 +0000 (13:29 -0400)]
httputil: Raise errors instead of logging in multipart/form-data parsing
We used to continue after logging an error, which allowed repeated
errors to spam the logs. The error raised here will still be logged,
but only once per request, consistent with other error handling in
Tornado.
Ben Darnell [Fri, 25 Apr 2025 19:31:13 +0000 (15:31 -0400)]
httputil: Reject header lines beginning with invalid whitespace
The obs-fold feature is defined only for tabs and spaces.
The str.isspace() method also accepts other whitespace characters.
These characters are not valid in HTTP headers and should be treated
as errors instead of triggering line folding.
Ben Darnell [Fri, 25 Apr 2025 18:08:18 +0000 (14:08 -0400)]
httputil: Process the Host header more strictly
- It is now an error to have multiple Host headers
- The Host header is now mandatory except in HTTP/1.0 mode
- Host headers containing characters that are disallowed by RFC 3986
are now rejected
Ben Darnell [Fri, 25 Apr 2025 15:53:44 +0000 (11:53 -0400)]
websocket: deprecate callback argument to websocket_connect
This was missed in the 6.0-era deprecation of callback arguments.
The on_message_callback remains because even in coroutine-oriented
code it is often more convenient to use a callback than to
loop on read_message.
Oliver Sanders [Tue, 22 Apr 2025 17:19:00 +0000 (18:19 +0100)]
websockets: fix ping_timeout (#3376)
* websockets: fix ping_timeout
* Closes #3258
* Closes #2905
* Closes #2655
* Fixes an issue with the calculation of ping timeout interval that
could cause connections to be erroneously timed out and closed
from the server end.
Ben Darnell [Wed, 19 Feb 2025 19:06:22 +0000 (14:06 -0500)]
httputil: Improve handling of trailing whitespace in headers
HTTPHeaders had undocumented assumptions about trailing whitespace,
leading to an unintentional regression in Tornado 6.4.1 in which
passing the arguments of an AsyncHTTPClient header_callback to
HTTPHeaders.parse_line would result in errors.
This commit moves newline parsing from parse to parse_line.
It also strips trailing whitespace from continuation lines (trailing
whitespace is not allowed in HTTP headers, but we didn't reject it
in continuation lines).
This commit also deprecates continuation lines and the legacy
handling of LF without CR.
Ben Darnell [Thu, 27 Mar 2025 20:30:08 +0000 (16:30 -0400)]
httputil: Make parse_request_start_line stricter
The method is now restricted to being valid token characters as defined
in RFC 9110, allowing us to correctly issue status code 400 or 405
as appropriate (this can make a difference with some caching proxies).
The request-target no longer allows control characters. This is less
strict than the RFC (which does not allow non-ascii characters),
but prioritizes backwards compatibility.
Ben Darnell [Thu, 27 Mar 2025 20:22:33 +0000 (16:22 -0400)]
httputil: Centralize regexes based directly on RFCs
This will make it easier to stay in strict conformance with the RFCs.
Note that this commit makes a few small semantic changes to response
start-line parsing: status codes must be exactly three digits, and
control characters are not allowed in reason phrases.
Ben Darnell [Fri, 28 Feb 2025 02:45:49 +0000 (21:45 -0500)]
ci: Add a cibuildwheel test run to test.yml
This lets us test the cibuildwheel workflow independently of the
infrequently-run build.yml. It also gives us an easy way to test
freethreading builds.
projects / thirdparty / tornado.git / log
