tests.py 28 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664
  1. # -*- coding: utf-8 -*-
  2. import gzip
  3. from io import BytesIO
  4. import random
  5. import re
  6. import warnings
  7. from django.conf import settings
  8. from django.core import mail
  9. from django.http import HttpRequest
  10. from django.http import HttpResponse, StreamingHttpResponse
  11. from django.middleware.clickjacking import XFrameOptionsMiddleware
  12. from django.middleware.common import CommonMiddleware, BrokenLinkEmailsMiddleware
  13. from django.middleware.http import ConditionalGetMiddleware
  14. from django.middleware.gzip import GZipMiddleware
  15. from django.test import TestCase, RequestFactory
  16. from django.test.utils import override_settings
  17. from django.utils import six
  18. from django.utils.six.moves import xrange
  19. class CommonMiddlewareTest(TestCase):
  20. def _get_request(self, path):
  21. request = HttpRequest()
  22. request.META = {
  23. 'SERVER_NAME': 'testserver',
  24. 'SERVER_PORT': 80,
  25. }
  26. request.path = request.path_info = "/middleware/%s" % path
  27. return request
  28. @override_settings(APPEND_SLASH=True)
  29. def test_append_slash_have_slash(self):
  30. """
  31. Tests that URLs with slashes go unmolested.
  32. """
  33. request = self._get_request('slash/')
  34. self.assertEqual(CommonMiddleware().process_request(request), None)
  35. @override_settings(APPEND_SLASH=True)
  36. def test_append_slash_slashless_resource(self):
  37. """
  38. Tests that matches to explicit slashless URLs go unmolested.
  39. """
  40. request = self._get_request('noslash')
  41. self.assertEqual(CommonMiddleware().process_request(request), None)
  42. @override_settings(APPEND_SLASH=True)
  43. def test_append_slash_slashless_unknown(self):
  44. """
  45. Tests that APPEND_SLASH doesn't redirect to unknown resources.
  46. """
  47. request = self._get_request('unknown')
  48. self.assertEqual(CommonMiddleware().process_request(request), None)
  49. @override_settings(APPEND_SLASH=True)
  50. def test_append_slash_redirect(self):
  51. """
  52. Tests that APPEND_SLASH redirects slashless URLs to a valid pattern.
  53. """
  54. request = self._get_request('slash')
  55. r = CommonMiddleware().process_request(request)
  56. self.assertEqual(r.status_code, 301)
  57. self.assertEqual(r['Location'], 'http://testserver/middleware/slash/')
  58. @override_settings(APPEND_SLASH=True, DEBUG=True)
  59. def test_append_slash_no_redirect_on_POST_in_DEBUG(self):
  60. """
  61. Tests that while in debug mode, an exception is raised with a warning
  62. when a failed attempt is made to POST to an URL which would normally be
  63. redirected to a slashed version.
  64. """
  65. request = self._get_request('slash')
  66. request.method = 'POST'
  67. with six.assertRaisesRegex(self, RuntimeError, 'end in a slash'):
  68. CommonMiddleware().process_request(request)
  69. @override_settings(APPEND_SLASH=False)
  70. def test_append_slash_disabled(self):
  71. """
  72. Tests disabling append slash functionality.
  73. """
  74. request = self._get_request('slash')
  75. self.assertEqual(CommonMiddleware().process_request(request), None)
  76. @override_settings(APPEND_SLASH=True)
  77. def test_append_slash_quoted(self):
  78. """
  79. Tests that URLs which require quoting are redirected to their slash
  80. version ok.
  81. """
  82. request = self._get_request('needsquoting#')
  83. r = CommonMiddleware().process_request(request)
  84. self.assertEqual(r.status_code, 301)
  85. self.assertEqual(
  86. r['Location'],
  87. 'http://testserver/middleware/needsquoting%23/')
  88. @override_settings(APPEND_SLASH=False, PREPEND_WWW=True)
  89. def test_prepend_www(self):
  90. request = self._get_request('path/')
  91. r = CommonMiddleware().process_request(request)
  92. self.assertEqual(r.status_code, 301)
  93. self.assertEqual(
  94. r['Location'],
  95. 'http://www.testserver/middleware/path/')
  96. @override_settings(APPEND_SLASH=True, PREPEND_WWW=True)
  97. def test_prepend_www_append_slash_have_slash(self):
  98. request = self._get_request('slash/')
  99. r = CommonMiddleware().process_request(request)
  100. self.assertEqual(r.status_code, 301)
  101. self.assertEqual(r['Location'],
  102. 'http://www.testserver/middleware/slash/')
  103. @override_settings(APPEND_SLASH=True, PREPEND_WWW=True)
  104. def test_prepend_www_append_slash_slashless(self):
  105. request = self._get_request('slash')
  106. r = CommonMiddleware().process_request(request)
  107. self.assertEqual(r.status_code, 301)
  108. self.assertEqual(r['Location'],
  109. 'http://www.testserver/middleware/slash/')
  110. # The following tests examine expected behavior given a custom urlconf that
  111. # overrides the default one through the request object.
  112. @override_settings(APPEND_SLASH=True)
  113. def test_append_slash_have_slash_custom_urlconf(self):
  114. """
  115. Tests that URLs with slashes go unmolested.
  116. """
  117. request = self._get_request('customurlconf/slash/')
  118. request.urlconf = 'regressiontests.middleware.extra_urls'
  119. self.assertEqual(CommonMiddleware().process_request(request), None)
  120. @override_settings(APPEND_SLASH=True)
  121. def test_append_slash_slashless_resource_custom_urlconf(self):
  122. """
  123. Tests that matches to explicit slashless URLs go unmolested.
  124. """
  125. request = self._get_request('customurlconf/noslash')
  126. request.urlconf = 'regressiontests.middleware.extra_urls'
  127. self.assertEqual(CommonMiddleware().process_request(request), None)
  128. @override_settings(APPEND_SLASH=True)
  129. def test_append_slash_slashless_unknown_custom_urlconf(self):
  130. """
  131. Tests that APPEND_SLASH doesn't redirect to unknown resources.
  132. """
  133. request = self._get_request('customurlconf/unknown')
  134. request.urlconf = 'regressiontests.middleware.extra_urls'
  135. self.assertEqual(CommonMiddleware().process_request(request), None)
  136. @override_settings(APPEND_SLASH=True)
  137. def test_append_slash_redirect_custom_urlconf(self):
  138. """
  139. Tests that APPEND_SLASH redirects slashless URLs to a valid pattern.
  140. """
  141. request = self._get_request('customurlconf/slash')
  142. request.urlconf = 'regressiontests.middleware.extra_urls'
  143. r = CommonMiddleware().process_request(request)
  144. self.assertFalse(r is None,
  145. "CommonMiddlware failed to return APPEND_SLASH redirect using request.urlconf")
  146. self.assertEqual(r.status_code, 301)
  147. self.assertEqual(r['Location'], 'http://testserver/middleware/customurlconf/slash/')
  148. @override_settings(APPEND_SLASH=True, DEBUG=True)
  149. def test_append_slash_no_redirect_on_POST_in_DEBUG_custom_urlconf(self):
  150. """
  151. Tests that while in debug mode, an exception is raised with a warning
  152. when a failed attempt is made to POST to an URL which would normally be
  153. redirected to a slashed version.
  154. """
  155. request = self._get_request('customurlconf/slash')
  156. request.urlconf = 'regressiontests.middleware.extra_urls'
  157. request.method = 'POST'
  158. with six.assertRaisesRegex(self, RuntimeError, 'end in a slash'):
  159. CommonMiddleware().process_request(request)
  160. @override_settings(APPEND_SLASH=False)
  161. def test_append_slash_disabled_custom_urlconf(self):
  162. """
  163. Tests disabling append slash functionality.
  164. """
  165. request = self._get_request('customurlconf/slash')
  166. request.urlconf = 'regressiontests.middleware.extra_urls'
  167. self.assertEqual(CommonMiddleware().process_request(request), None)
  168. @override_settings(APPEND_SLASH=True)
  169. def test_append_slash_quoted_custom_urlconf(self):
  170. """
  171. Tests that URLs which require quoting are redirected to their slash
  172. version ok.
  173. """
  174. request = self._get_request('customurlconf/needsquoting#')
  175. request.urlconf = 'regressiontests.middleware.extra_urls'
  176. r = CommonMiddleware().process_request(request)
  177. self.assertFalse(r is None,
  178. "CommonMiddlware failed to return APPEND_SLASH redirect using request.urlconf")
  179. self.assertEqual(r.status_code, 301)
  180. self.assertEqual(
  181. r['Location'],
  182. 'http://testserver/middleware/customurlconf/needsquoting%23/')
  183. @override_settings(APPEND_SLASH=False, PREPEND_WWW=True)
  184. def test_prepend_www_custom_urlconf(self):
  185. request = self._get_request('customurlconf/path/')
  186. request.urlconf = 'regressiontests.middleware.extra_urls'
  187. r = CommonMiddleware().process_request(request)
  188. self.assertEqual(r.status_code, 301)
  189. self.assertEqual(
  190. r['Location'],
  191. 'http://www.testserver/middleware/customurlconf/path/')
  192. @override_settings(APPEND_SLASH=True, PREPEND_WWW=True)
  193. def test_prepend_www_append_slash_have_slash_custom_urlconf(self):
  194. request = self._get_request('customurlconf/slash/')
  195. request.urlconf = 'regressiontests.middleware.extra_urls'
  196. r = CommonMiddleware().process_request(request)
  197. self.assertEqual(r.status_code, 301)
  198. self.assertEqual(r['Location'],
  199. 'http://www.testserver/middleware/customurlconf/slash/')
  200. @override_settings(APPEND_SLASH=True, PREPEND_WWW=True)
  201. def test_prepend_www_append_slash_slashless_custom_urlconf(self):
  202. request = self._get_request('customurlconf/slash')
  203. request.urlconf = 'regressiontests.middleware.extra_urls'
  204. r = CommonMiddleware().process_request(request)
  205. self.assertEqual(r.status_code, 301)
  206. self.assertEqual(r['Location'],
  207. 'http://www.testserver/middleware/customurlconf/slash/')
  208. # Legacy tests for the 404 error reporting via email (to be removed in 1.8)
  209. @override_settings(IGNORABLE_404_URLS=(re.compile(r'foo'),),
  210. SEND_BROKEN_LINK_EMAILS=True)
  211. def test_404_error_reporting(self):
  212. request = self._get_request('regular_url/that/does/not/exist')
  213. request.META['HTTP_REFERER'] = '/another/url/'
  214. with warnings.catch_warnings():
  215. warnings.simplefilter("ignore", PendingDeprecationWarning)
  216. response = self.client.get(request.path)
  217. CommonMiddleware().process_response(request, response)
  218. self.assertEqual(len(mail.outbox), 1)
  219. self.assertIn('Broken', mail.outbox[0].subject)
  220. @override_settings(IGNORABLE_404_URLS=(re.compile(r'foo'),),
  221. SEND_BROKEN_LINK_EMAILS=True)
  222. def test_404_error_reporting_no_referer(self):
  223. request = self._get_request('regular_url/that/does/not/exist')
  224. with warnings.catch_warnings():
  225. warnings.simplefilter("ignore", PendingDeprecationWarning)
  226. response = self.client.get(request.path)
  227. CommonMiddleware().process_response(request, response)
  228. self.assertEqual(len(mail.outbox), 0)
  229. @override_settings(IGNORABLE_404_URLS=(re.compile(r'foo'),),
  230. SEND_BROKEN_LINK_EMAILS=True)
  231. def test_404_error_reporting_ignored_url(self):
  232. request = self._get_request('foo_url/that/does/not/exist/either')
  233. request.META['HTTP_REFERER'] = '/another/url/'
  234. with warnings.catch_warnings():
  235. warnings.simplefilter("ignore", PendingDeprecationWarning)
  236. response = self.client.get(request.path)
  237. CommonMiddleware().process_response(request, response)
  238. self.assertEqual(len(mail.outbox), 0)
  239. # Other tests
  240. def test_non_ascii_query_string_does_not_crash(self):
  241. """Regression test for #15152"""
  242. request = self._get_request('slash')
  243. request.META['QUERY_STRING'] = 'drink=café'
  244. response = CommonMiddleware().process_request(request)
  245. self.assertEqual(response.status_code, 301)
  246. @override_settings(IGNORABLE_404_URLS=(re.compile(r'foo'),))
  247. class BrokenLinkEmailsMiddlewareTest(TestCase):
  248. def setUp(self):
  249. self.req = HttpRequest()
  250. self.req.META = {
  251. 'SERVER_NAME': 'testserver',
  252. 'SERVER_PORT': 80,
  253. }
  254. self.req.path = self.req.path_info = 'regular_url/that/does/not/exist'
  255. self.resp = self.client.get(self.req.path)
  256. def test_404_error_reporting(self):
  257. self.req.META['HTTP_REFERER'] = '/another/url/'
  258. BrokenLinkEmailsMiddleware().process_response(self.req, self.resp)
  259. self.assertEqual(len(mail.outbox), 1)
  260. self.assertIn('Broken', mail.outbox[0].subject)
  261. def test_404_error_reporting_no_referer(self):
  262. BrokenLinkEmailsMiddleware().process_response(self.req, self.resp)
  263. self.assertEqual(len(mail.outbox), 0)
  264. def test_404_error_reporting_ignored_url(self):
  265. self.req.path = self.req.path_info = 'foo_url/that/does/not/exist'
  266. BrokenLinkEmailsMiddleware().process_response(self.req, self.resp)
  267. self.assertEqual(len(mail.outbox), 0)
  268. class ConditionalGetMiddlewareTest(TestCase):
  269. urls = 'regressiontests.middleware.cond_get_urls'
  270. def setUp(self):
  271. self.req = HttpRequest()
  272. self.req.META = {
  273. 'SERVER_NAME': 'testserver',
  274. 'SERVER_PORT': 80,
  275. }
  276. self.req.path = self.req.path_info = "/"
  277. self.resp = self.client.get(self.req.path)
  278. # Tests for the Date header
  279. def test_date_header_added(self):
  280. self.assertFalse('Date' in self.resp)
  281. self.resp = ConditionalGetMiddleware().process_response(self.req, self.resp)
  282. self.assertTrue('Date' in self.resp)
  283. # Tests for the Content-Length header
  284. def test_content_length_header_added(self):
  285. content_length = len(self.resp.content)
  286. self.assertFalse('Content-Length' in self.resp)
  287. self.resp = ConditionalGetMiddleware().process_response(self.req, self.resp)
  288. self.assertTrue('Content-Length' in self.resp)
  289. self.assertEqual(int(self.resp['Content-Length']), content_length)
  290. def test_content_length_header_not_added(self):
  291. resp = StreamingHttpResponse('content')
  292. self.assertFalse('Content-Length' in resp)
  293. resp = ConditionalGetMiddleware().process_response(self.req, resp)
  294. self.assertFalse('Content-Length' in resp)
  295. def test_content_length_header_not_changed(self):
  296. bad_content_length = len(self.resp.content) + 10
  297. self.resp['Content-Length'] = bad_content_length
  298. self.resp = ConditionalGetMiddleware().process_response(self.req, self.resp)
  299. self.assertEqual(int(self.resp['Content-Length']), bad_content_length)
  300. # Tests for the ETag header
  301. def test_if_none_match_and_no_etag(self):
  302. self.req.META['HTTP_IF_NONE_MATCH'] = 'spam'
  303. self.resp = ConditionalGetMiddleware().process_response(self.req, self.resp)
  304. self.assertEqual(self.resp.status_code, 200)
  305. def test_no_if_none_match_and_etag(self):
  306. self.resp['ETag'] = 'eggs'
  307. self.resp = ConditionalGetMiddleware().process_response(self.req, self.resp)
  308. self.assertEqual(self.resp.status_code, 200)
  309. def test_if_none_match_and_same_etag(self):
  310. self.req.META['HTTP_IF_NONE_MATCH'] = self.resp['ETag'] = 'spam'
  311. self.resp = ConditionalGetMiddleware().process_response(self.req, self.resp)
  312. self.assertEqual(self.resp.status_code, 304)
  313. def test_if_none_match_and_different_etag(self):
  314. self.req.META['HTTP_IF_NONE_MATCH'] = 'spam'
  315. self.resp['ETag'] = 'eggs'
  316. self.resp = ConditionalGetMiddleware().process_response(self.req, self.resp)
  317. self.assertEqual(self.resp.status_code, 200)
  318. @override_settings(USE_ETAGS=True)
  319. def test_etag(self):
  320. req = HttpRequest()
  321. res = HttpResponse('content')
  322. self.assertTrue(
  323. CommonMiddleware().process_response(req, res).has_header('ETag'))
  324. @override_settings(USE_ETAGS=True)
  325. def test_etag_streaming_response(self):
  326. req = HttpRequest()
  327. res = StreamingHttpResponse(['content'])
  328. res['ETag'] = 'tomatoes'
  329. self.assertEqual(
  330. CommonMiddleware().process_response(req, res).get('ETag'),
  331. 'tomatoes')
  332. @override_settings(USE_ETAGS=True)
  333. def test_no_etag_streaming_response(self):
  334. req = HttpRequest()
  335. res = StreamingHttpResponse(['content'])
  336. self.assertFalse(
  337. CommonMiddleware().process_response(req, res).has_header('ETag'))
  338. # Tests for the Last-Modified header
  339. def test_if_modified_since_and_no_last_modified(self):
  340. self.req.META['HTTP_IF_MODIFIED_SINCE'] = 'Sat, 12 Feb 2011 17:38:44 GMT'
  341. self.resp = ConditionalGetMiddleware().process_response(self.req, self.resp)
  342. self.assertEqual(self.resp.status_code, 200)
  343. def test_no_if_modified_since_and_last_modified(self):
  344. self.resp['Last-Modified'] = 'Sat, 12 Feb 2011 17:38:44 GMT'
  345. self.resp = ConditionalGetMiddleware().process_response(self.req, self.resp)
  346. self.assertEqual(self.resp.status_code, 200)
  347. def test_if_modified_since_and_same_last_modified(self):
  348. self.req.META['HTTP_IF_MODIFIED_SINCE'] = 'Sat, 12 Feb 2011 17:38:44 GMT'
  349. self.resp['Last-Modified'] = 'Sat, 12 Feb 2011 17:38:44 GMT'
  350. self.resp = ConditionalGetMiddleware().process_response(self.req, self.resp)
  351. self.assertEqual(self.resp.status_code, 304)
  352. def test_if_modified_since_and_last_modified_in_the_past(self):
  353. self.req.META['HTTP_IF_MODIFIED_SINCE'] = 'Sat, 12 Feb 2011 17:38:44 GMT'
  354. self.resp['Last-Modified'] = 'Sat, 12 Feb 2011 17:35:44 GMT'
  355. self.resp = ConditionalGetMiddleware().process_response(self.req, self.resp)
  356. self.assertEqual(self.resp.status_code, 304)
  357. def test_if_modified_since_and_last_modified_in_the_future(self):
  358. self.req.META['HTTP_IF_MODIFIED_SINCE'] = 'Sat, 12 Feb 2011 17:38:44 GMT'
  359. self.resp['Last-Modified'] = 'Sat, 12 Feb 2011 17:41:44 GMT'
  360. self.resp = ConditionalGetMiddleware().process_response(self.req, self.resp)
  361. self.assertEqual(self.resp.status_code, 200)
  362. class XFrameOptionsMiddlewareTest(TestCase):
  363. """
  364. Tests for the X-Frame-Options clickjacking prevention middleware.
  365. """
  366. def test_same_origin(self):
  367. """
  368. Tests that the X_FRAME_OPTIONS setting can be set to SAMEORIGIN to
  369. have the middleware use that value for the HTTP header.
  370. """
  371. with override_settings(X_FRAME_OPTIONS='SAMEORIGIN'):
  372. r = XFrameOptionsMiddleware().process_response(HttpRequest(),
  373. HttpResponse())
  374. self.assertEqual(r['X-Frame-Options'], 'SAMEORIGIN')
  375. with override_settings(X_FRAME_OPTIONS='sameorigin'):
  376. r = XFrameOptionsMiddleware().process_response(HttpRequest(),
  377. HttpResponse())
  378. self.assertEqual(r['X-Frame-Options'], 'SAMEORIGIN')
  379. def test_deny(self):
  380. """
  381. Tests that the X_FRAME_OPTIONS setting can be set to DENY to
  382. have the middleware use that value for the HTTP header.
  383. """
  384. with override_settings(X_FRAME_OPTIONS='DENY'):
  385. r = XFrameOptionsMiddleware().process_response(HttpRequest(),
  386. HttpResponse())
  387. self.assertEqual(r['X-Frame-Options'], 'DENY')
  388. with override_settings(X_FRAME_OPTIONS='deny'):
  389. r = XFrameOptionsMiddleware().process_response(HttpRequest(),
  390. HttpResponse())
  391. self.assertEqual(r['X-Frame-Options'], 'DENY')
  392. def test_defaults_sameorigin(self):
  393. """
  394. Tests that if the X_FRAME_OPTIONS setting is not set then it defaults
  395. to SAMEORIGIN.
  396. """
  397. with override_settings(X_FRAME_OPTIONS=None):
  398. del settings.X_FRAME_OPTIONS # restored by override_settings
  399. r = XFrameOptionsMiddleware().process_response(HttpRequest(),
  400. HttpResponse())
  401. self.assertEqual(r['X-Frame-Options'], 'SAMEORIGIN')
  402. def test_dont_set_if_set(self):
  403. """
  404. Tests that if the X-Frame-Options header is already set then the
  405. middleware does not attempt to override it.
  406. """
  407. with override_settings(X_FRAME_OPTIONS='DENY'):
  408. response = HttpResponse()
  409. response['X-Frame-Options'] = 'SAMEORIGIN'
  410. r = XFrameOptionsMiddleware().process_response(HttpRequest(),
  411. response)
  412. self.assertEqual(r['X-Frame-Options'], 'SAMEORIGIN')
  413. with override_settings(X_FRAME_OPTIONS='SAMEORIGIN'):
  414. response = HttpResponse()
  415. response['X-Frame-Options'] = 'DENY'
  416. r = XFrameOptionsMiddleware().process_response(HttpRequest(),
  417. response)
  418. self.assertEqual(r['X-Frame-Options'], 'DENY')
  419. def test_response_exempt(self):
  420. """
  421. Tests that if the response has a xframe_options_exempt attribute set
  422. to False then it still sets the header, but if it's set to True then
  423. it does not.
  424. """
  425. with override_settings(X_FRAME_OPTIONS='SAMEORIGIN'):
  426. response = HttpResponse()
  427. response.xframe_options_exempt = False
  428. r = XFrameOptionsMiddleware().process_response(HttpRequest(),
  429. response)
  430. self.assertEqual(r['X-Frame-Options'], 'SAMEORIGIN')
  431. response = HttpResponse()
  432. response.xframe_options_exempt = True
  433. r = XFrameOptionsMiddleware().process_response(HttpRequest(),
  434. response)
  435. self.assertEqual(r.get('X-Frame-Options', None), None)
  436. def test_is_extendable(self):
  437. """
  438. Tests that the XFrameOptionsMiddleware method that determines the
  439. X-Frame-Options header value can be overridden based on something in
  440. the request or response.
  441. """
  442. class OtherXFrameOptionsMiddleware(XFrameOptionsMiddleware):
  443. # This is just an example for testing purposes...
  444. def get_xframe_options_value(self, request, response):
  445. if getattr(request, 'sameorigin', False):
  446. return 'SAMEORIGIN'
  447. if getattr(response, 'sameorigin', False):
  448. return 'SAMEORIGIN'
  449. return 'DENY'
  450. with override_settings(X_FRAME_OPTIONS='DENY'):
  451. response = HttpResponse()
  452. response.sameorigin = True
  453. r = OtherXFrameOptionsMiddleware().process_response(HttpRequest(),
  454. response)
  455. self.assertEqual(r['X-Frame-Options'], 'SAMEORIGIN')
  456. request = HttpRequest()
  457. request.sameorigin = True
  458. r = OtherXFrameOptionsMiddleware().process_response(request,
  459. HttpResponse())
  460. self.assertEqual(r['X-Frame-Options'], 'SAMEORIGIN')
  461. with override_settings(X_FRAME_OPTIONS='SAMEORIGIN'):
  462. r = OtherXFrameOptionsMiddleware().process_response(HttpRequest(),
  463. HttpResponse())
  464. self.assertEqual(r['X-Frame-Options'], 'DENY')
  465. class GZipMiddlewareTest(TestCase):
  466. """
  467. Tests the GZip middleware.
  468. """
  469. short_string = b"This string is too short to be worth compressing."
  470. compressible_string = b'a' * 500
  471. uncompressible_string = b''.join(six.int2byte(random.randint(0, 255)) for _ in xrange(500))
  472. sequence = [b'a' * 500, b'b' * 200, b'a' * 300]
  473. def setUp(self):
  474. self.req = HttpRequest()
  475. self.req.META = {
  476. 'SERVER_NAME': 'testserver',
  477. 'SERVER_PORT': 80,
  478. }
  479. self.req.path = self.req.path_info = "/"
  480. self.req.META['HTTP_ACCEPT_ENCODING'] = 'gzip, deflate'
  481. self.req.META['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1'
  482. self.resp = HttpResponse()
  483. self.resp.status_code = 200
  484. self.resp.content = self.compressible_string
  485. self.resp['Content-Type'] = 'text/html; charset=UTF-8'
  486. self.stream_resp = StreamingHttpResponse(self.sequence)
  487. self.stream_resp['Content-Type'] = 'text/html; charset=UTF-8'
  488. @staticmethod
  489. def decompress(gzipped_string):
  490. return gzip.GzipFile(mode='rb', fileobj=BytesIO(gzipped_string)).read()
  491. def test_compress_response(self):
  492. """
  493. Tests that compression is performed on responses with compressible content.
  494. """
  495. r = GZipMiddleware().process_response(self.req, self.resp)
  496. self.assertEqual(self.decompress(r.content), self.compressible_string)
  497. self.assertEqual(r.get('Content-Encoding'), 'gzip')
  498. self.assertEqual(r.get('Content-Length'), str(len(r.content)))
  499. def test_compress_streaming_response(self):
  500. """
  501. Tests that compression is performed on responses with streaming content.
  502. """
  503. r = GZipMiddleware().process_response(self.req, self.stream_resp)
  504. self.assertEqual(self.decompress(b''.join(r)), b''.join(self.sequence))
  505. self.assertEqual(r.get('Content-Encoding'), 'gzip')
  506. self.assertFalse(r.has_header('Content-Length'))
  507. def test_compress_non_200_response(self):
  508. """
  509. Tests that compression is performed on responses with a status other than 200.
  510. See #10762.
  511. """
  512. self.resp.status_code = 404
  513. r = GZipMiddleware().process_response(self.req, self.resp)
  514. self.assertEqual(self.decompress(r.content), self.compressible_string)
  515. self.assertEqual(r.get('Content-Encoding'), 'gzip')
  516. def test_no_compress_short_response(self):
  517. """
  518. Tests that compression isn't performed on responses with short content.
  519. """
  520. self.resp.content = self.short_string
  521. r = GZipMiddleware().process_response(self.req, self.resp)
  522. self.assertEqual(r.content, self.short_string)
  523. self.assertEqual(r.get('Content-Encoding'), None)
  524. def test_no_compress_compressed_response(self):
  525. """
  526. Tests that compression isn't performed on responses that are already compressed.
  527. """
  528. self.resp['Content-Encoding'] = 'deflate'
  529. r = GZipMiddleware().process_response(self.req, self.resp)
  530. self.assertEqual(r.content, self.compressible_string)
  531. self.assertEqual(r.get('Content-Encoding'), 'deflate')
  532. def test_no_compress_ie_js_requests(self):
  533. """
  534. Tests that compression isn't performed on JavaScript requests from Internet Explorer.
  535. """
  536. self.req.META['HTTP_USER_AGENT'] = 'Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)'
  537. self.resp['Content-Type'] = 'application/javascript; charset=UTF-8'
  538. r = GZipMiddleware().process_response(self.req, self.resp)
  539. self.assertEqual(r.content, self.compressible_string)
  540. self.assertEqual(r.get('Content-Encoding'), None)
  541. def test_no_compress_uncompressible_response(self):
  542. """
  543. Tests that compression isn't performed on responses with uncompressible content.
  544. """
  545. self.resp.content = self.uncompressible_string
  546. r = GZipMiddleware().process_response(self.req, self.resp)
  547. self.assertEqual(r.content, self.uncompressible_string)
  548. self.assertEqual(r.get('Content-Encoding'), None)
  549. @override_settings(USE_ETAGS=True)
  550. class ETagGZipMiddlewareTest(TestCase):
  551. """
  552. Tests if the ETag middleware behaves correctly with GZip middleware.
  553. """
  554. compressible_string = b'a' * 500
  555. def setUp(self):
  556. self.rf = RequestFactory()
  557. def test_compress_response(self):
  558. """
  559. Tests that ETag is changed after gzip compression is performed.
  560. """
  561. request = self.rf.get('/', HTTP_ACCEPT_ENCODING='gzip, deflate')
  562. response = GZipMiddleware().process_response(request,
  563. CommonMiddleware().process_response(request,
  564. HttpResponse(self.compressible_string)))
  565. gzip_etag = response.get('ETag')
  566. request = self.rf.get('/', HTTP_ACCEPT_ENCODING='')
  567. response = GZipMiddleware().process_response(request,
  568. CommonMiddleware().process_response(request,
  569. HttpResponse(self.compressible_string)))
  570. nogzip_etag = response.get('ETag')
  571. self.assertNotEqual(gzip_etag, nogzip_etag)