unicorn 0.93.0
[unicorn.git] / test / unit / test_http_parser.rb
blob1b3faaf189a2c9e2c6f4f108f1f3ac2873a7f0ba
1 # -*- encoding: binary -*-
3 # Copyright (c) 2005 Zed A. Shaw 
4 # You can redistribute it and/or modify it under the same terms as Ruby.
6 # Additional work donated by contributors.  See http://mongrel.rubyforge.org/attributions.html
7 # for more information.
9 require 'test/test_helper'
11 include Unicorn
13 class HttpParserTest < Test::Unit::TestCase
15   def test_parse_simple
16     parser = HttpParser.new
17     req = {}
18     http = "GET / HTTP/1.1\r\n\r\n"
19     assert_equal req, parser.headers(req, http)
20     assert_equal '', http
22     assert_equal 'HTTP/1.1', req['SERVER_PROTOCOL']
23     assert_equal '/', req['REQUEST_PATH']
24     assert_equal 'HTTP/1.1', req['HTTP_VERSION']
25     assert_equal '/', req['REQUEST_URI']
26     assert_equal 'GET', req['REQUEST_METHOD']
27     assert_nil req['FRAGMENT']
28     assert_equal '', req['QUERY_STRING']
30     assert parser.keepalive?
31     parser.reset
32     req.clear
34     http = "G"
35     assert_nil parser.headers(req, http)
36     assert_equal "G", http
37     assert req.empty?
39     # try parsing again to ensure we were reset correctly
40     http = "GET /hello-world HTTP/1.1\r\n\r\n"
41     assert parser.headers(req, http)
43     assert_equal 'HTTP/1.1', req['SERVER_PROTOCOL']
44     assert_equal '/hello-world', req['REQUEST_PATH']
45     assert_equal 'HTTP/1.1', req['HTTP_VERSION']
46     assert_equal '/hello-world', req['REQUEST_URI']
47     assert_equal 'GET', req['REQUEST_METHOD']
48     assert_nil req['FRAGMENT']
49     assert_equal '', req['QUERY_STRING']
50     assert_equal '', http
51     assert parser.keepalive?
52   end
54   def test_connection_close_no_ka
55     parser = HttpParser.new
56     req = {}
57     tmp = "GET / HTTP/1.1\r\nConnection: close\r\n\r\n"
58     assert_equal req.object_id, parser.headers(req, tmp).object_id
59     assert_equal "GET", req['REQUEST_METHOD']
60     assert ! parser.keepalive?
61   end
63   def test_connection_keep_alive_ka
64     parser = HttpParser.new
65     req = {}
66     tmp = "HEAD / HTTP/1.1\r\nConnection: keep-alive\r\n\r\n"
67     assert_equal req.object_id, parser.headers(req, tmp).object_id
68     assert parser.keepalive?
69   end
71   def test_connection_keep_alive_ka_bad_method
72     parser = HttpParser.new
73     req = {}
74     tmp = "POST / HTTP/1.1\r\nConnection: keep-alive\r\n\r\n"
75     assert_equal req.object_id, parser.headers(req, tmp).object_id
76     assert ! parser.keepalive?
77   end
79   def test_connection_keep_alive_ka_bad_version
80     parser = HttpParser.new
81     req = {}
82     tmp = "GET / HTTP/1.0\r\nConnection: keep-alive\r\n\r\n"
83     assert_equal req.object_id, parser.headers(req, tmp).object_id
84     assert parser.keepalive?
85   end
87   def test_parse_server_host_default_port
88     parser = HttpParser.new
89     req = {}
90     tmp = "GET / HTTP/1.1\r\nHost: foo\r\n\r\n"
91     assert_equal req, parser.headers(req, tmp)
92     assert_equal 'foo', req['SERVER_NAME']
93     assert_equal '80', req['SERVER_PORT']
94     assert_equal '', tmp
95     assert parser.keepalive?
96   end
98   def test_parse_server_host_alt_port
99     parser = HttpParser.new
100     req = {}
101     tmp = "GET / HTTP/1.1\r\nHost: foo:999\r\n\r\n"
102     assert_equal req, parser.headers(req, tmp)
103     assert_equal 'foo', req['SERVER_NAME']
104     assert_equal '999', req['SERVER_PORT']
105     assert_equal '', tmp
106     assert parser.keepalive?
107   end
109   def test_parse_server_host_empty_port
110     parser = HttpParser.new
111     req = {}
112     tmp = "GET / HTTP/1.1\r\nHost: foo:\r\n\r\n"
113     assert_equal req, parser.headers(req, tmp)
114     assert_equal 'foo', req['SERVER_NAME']
115     assert_equal '80', req['SERVER_PORT']
116     assert_equal '', tmp
117     assert parser.keepalive?
118   end
120   def test_parse_server_host_xfp_https
121     parser = HttpParser.new
122     req = {}
123     tmp = "GET / HTTP/1.1\r\nHost: foo:\r\n" \
124           "X-Forwarded-Proto: https\r\n\r\n"
125     assert_equal req, parser.headers(req, tmp)
126     assert_equal 'foo', req['SERVER_NAME']
127     assert_equal '443', req['SERVER_PORT']
128     assert_equal '', tmp
129     assert parser.keepalive?
130   end
132   def test_parse_strange_headers
133     parser = HttpParser.new
134     req = {}
135     should_be_good = "GET / HTTP/1.1\r\naaaaaaaaaaaaa:++++++++++\r\n\r\n"
136     assert_equal req, parser.headers(req, should_be_good)
137     assert_equal '', should_be_good
138     assert parser.keepalive?
139   end
141   # legacy test case from Mongrel that we never supported before...
142   # I still consider Pound irrelevant, unfortunately stupid clients that
143   # send extremely big headers do exist and they've managed to find Unicorn...
144   def test_nasty_pound_header
145     parser = HttpParser.new
146     nasty_pound_header = "GET / HTTP/1.1\r\nX-SSL-Bullshit:   -----BEGIN CERTIFICATE-----\r\n\tMIIFbTCCBFWgAwIBAgICH4cwDQYJKoZIhvcNAQEFBQAwcDELMAkGA1UEBhMCVUsx\r\n\tETAPBgNVBAoTCGVTY2llbmNlMRIwEAYDVQQLEwlBdXRob3JpdHkxCzAJBgNVBAMT\r\n\tAkNBMS0wKwYJKoZIhvcNAQkBFh5jYS1vcGVyYXRvckBncmlkLXN1cHBvcnQuYWMu\r\n\tdWswHhcNMDYwNzI3MTQxMzI4WhcNMDcwNzI3MTQxMzI4WjBbMQswCQYDVQQGEwJV\r\n\tSzERMA8GA1UEChMIZVNjaWVuY2UxEzARBgNVBAsTCk1hbmNoZXN0ZXIxCzAJBgNV\r\n\tBAcTmrsogriqMWLAk1DMRcwFQYDVQQDEw5taWNoYWVsIHBhcmQYJKoZIhvcNAQEB\r\n\tBQADggEPADCCAQoCggEBANPEQBgl1IaKdSS1TbhF3hEXSl72G9J+WC/1R64fAcEF\r\n\tW51rEyFYiIeZGx/BVzwXbeBoNUK41OK65sxGuflMo5gLflbwJtHBRIEKAfVVp3YR\r\n\tgW7cMA/s/XKgL1GEC7rQw8lIZT8RApukCGqOVHSi/F1SiFlPDxuDfmdiNzL31+sL\r\n\t0iwHDdNkGjy5pyBSB8Y79dsSJtCW/iaLB0/n8Sj7HgvvZJ7x0fr+RQjYOUUfrePP\r\n\tu2MSpFyf+9BbC/aXgaZuiCvSR+8Snv3xApQY+fULK/xY8h8Ua51iXoQ5jrgu2SqR\r\n\twgA7BUi3G8LFzMBl8FRCDYGUDy7M6QaHXx1ZWIPWNKsCAwEAAaOCAiQwggIgMAwG\r\n\tA1UdEwEB/wQCMAAwEQYJYIZIAYb4QgEBBAQDAgWgMA4GA1UdDwEB/wQEAwID6DAs\r\n\tBglghkgBhvhCAQ0EHxYdVUsgZS1TY2llbmNlIFVzZXIgQ2VydGlmaWNhdGUwHQYD\r\n\tVR0OBBYEFDTt/sf9PeMaZDHkUIldrDYMNTBZMIGaBgNVHSMEgZIwgY+AFAI4qxGj\r\n\tloCLDdMVKwiljjDastqooXSkcjBwMQswCQYDVQQGEwJVSzERMA8GA1UEChMIZVNj\r\n\taWVuY2UxEjAQBgNVBAsTCUF1dGhvcml0eTELMAkGA1UEAxMCQ0ExLTArBgkqhkiG\r\n\t9w0BCQEWHmNhLW9wZXJhdG9yQGdyaWQtc3VwcG9ydC5hYy51a4IBADApBgNVHRIE\r\n\tIjAggR5jYS1vcGVyYXRvckBncmlkLXN1cHBvcnQuYWMudWswGQYDVR0gBBIwEDAO\r\n\tBgwrBgEEAdkvAQEBAQYwPQYJYIZIAYb4QgEEBDAWLmh0dHA6Ly9jYS5ncmlkLXN1\r\n\tcHBvcnQuYWMudmT4sopwqlBWsvcHViL2NybC9jYWNybC5jcmwwPQYJYIZIAYb4QgEDBDAWLmh0\r\n\tdHA6Ly9jYS5ncmlkLXN1cHBvcnQuYWMudWsvcHViL2NybC9jYWNybC5jcmwwPwYD\r\n\tVR0fBDgwNjA0oDKgMIYuaHR0cDovL2NhLmdyaWQt5hYy51ay9wdWIv\r\n\tY3JsL2NhY3JsLmNybDANBgkqhkiG9w0BAQUFAAOCAQEAS/U4iiooBENGW/Hwmmd3\r\n\tXCy6Zrt08YjKCzGNjorT98g8uGsqYjSxv/hmi0qlnlHs+k/3Iobc3LjS5AMYr5L8\r\n\tUO7OSkgFFlLHQyC9JzPfmLCAugvzEbyv4Olnsr8hbxF1MbKZoQxUZtMVu29wjfXk\r\n\thTeApBv7eaKCWpSp7MCbvgzm74izKhu3vlDk9w6qVrxePfGgpKPqfHiOoGhFnbTK\r\n\twTC6o2xq5y0qZ03JonF7OJspEd3I5zKY3E+ov7/ZhW6DqT8UFvsAdjvQbXyhV8Eu\r\n\tYhixw1aKEPzNjNowuIseVogKOLXxWI5vAi5HgXdS0/ES5gDGsABo4fqovUKlgop3\r\n\tRA==\r\n\t-----END CERTIFICATE-----\r\n\r\n"
147     req = {}
148     buf = nasty_pound_header.dup
150     assert nasty_pound_header =~ /(-----BEGIN .*--END CERTIFICATE-----)/m
151     expect = $1.dup
152     expect.gsub!(/\r\n\t/, ' ')
153     assert_equal req, parser.headers(req, buf)
154     assert_equal '', buf
155     assert_equal expect, req['HTTP_X_SSL_BULLSHIT']
156   end
158   def test_continuation_eats_leading_spaces
159     parser = HttpParser.new
160     header = "GET / HTTP/1.1\r\n" \
161              "X-ASDF:      \r\n" \
162              "\t\r\n" \
163              "    \r\n" \
164              "  ASDF\r\n\r\n"
165     req = {}
166     assert_equal req, parser.headers(req, header)
167     assert_equal '', header
168     assert_equal 'ASDF', req['HTTP_X_ASDF']
169   end
171   def test_continuation_eats_scattered_leading_spaces
172     parser = HttpParser.new
173     header = "GET / HTTP/1.1\r\n" \
174              "X-ASDF:   hi\r\n" \
175              "    y\r\n" \
176              "\t\r\n" \
177              "       x\r\n" \
178              "  ASDF\r\n\r\n"
179     req = {}
180     assert_equal req, parser.headers(req, header)
181     assert_equal '', header
182     assert_equal 'hi y x ASDF', req['HTTP_X_ASDF']
183   end
185   def test_continuation_with_absolute_uri_and_ignored_host_header
186     parser = HttpParser.new
187     header = "GET http://example.com/ HTTP/1.1\r\n" \
188              "Host: \r\n" \
189              "    YHBT.net\r\n" \
190              "\r\n"
191     req = {}
192     assert_equal req, parser.headers(req, header)
193     assert_equal 'example.com', req['HTTP_HOST']
194   end
196   # this may seem to be testing more of an implementation detail, but
197   # it also helps ensure we're safe in the presence of multiple parsers
198   # in case we ever go multithreaded/evented...
199   def test_resumable_continuations
200     nr = 1000
201     req = {}
202     header = "GET / HTTP/1.1\r\n" \
203              "X-ASDF:      \r\n" \
204              "  hello\r\n"
205     tmp = []
206     nr.times { |i|
207       parser = HttpParser.new
208       assert parser.headers(req, "#{header} #{i}\r\n").nil?
209       asdf = req['HTTP_X_ASDF']
210       assert_equal "hello #{i}", asdf
211       tmp << [ parser, asdf ]
212       req.clear
213     }
214     tmp.each_with_index { |(parser, asdf), i|
215       assert_equal req, parser.headers(req, "#{header} #{i}\r\n .\r\n\r\n")
216       assert_equal "hello #{i} .", asdf
217     }
218   end
220   def test_invalid_continuation
221     parser = HttpParser.new
222     header = "GET / HTTP/1.1\r\n" \
223              "    y\r\n" \
224              "Host: hello\r\n" \
225              "\r\n"
226     req = {}
227     assert_raises(HttpParserError) { parser.headers(req, header) }
228   end
230   def test_parse_ie6_urls
231     %w(/some/random/path"
232        /some/random/path>
233        /some/random/path<
234        /we/love/you/ie6?q=<"">
235        /url?<="&>="
236        /mal"formed"?
237     ).each do |path|
238       parser = HttpParser.new
239       req = {}
240       sorta_safe = %(GET #{path} HTTP/1.1\r\n\r\n)
241       assert_equal req, parser.headers(req, sorta_safe)
242       assert_equal path, req['REQUEST_URI']
243       assert_equal '', sorta_safe
244       assert parser.keepalive?
245     end
246   end
247   
248   def test_parse_error
249     parser = HttpParser.new
250     req = {}
251     bad_http = "GET / SsUTF/1.1"
253     assert_raises(HttpParserError) { parser.headers(req, bad_http) }
255     # make sure we can recover
256     parser.reset
257     req.clear
258     assert_equal req, parser.headers(req, "GET / HTTP/1.0\r\n\r\n")
259     assert ! parser.keepalive?
260   end
262   def test_piecemeal
263     parser = HttpParser.new
264     req = {}
265     http = "GET"
266     assert_nil parser.headers(req, http)
267     assert_nil parser.headers(req, http)
268     assert_nil parser.headers(req, http << " / HTTP/1.0")
269     assert_equal '/', req['REQUEST_PATH']
270     assert_equal '/', req['REQUEST_URI']
271     assert_equal 'GET', req['REQUEST_METHOD']
272     assert_nil parser.headers(req, http << "\r\n")
273     assert_equal 'HTTP/1.0', req['HTTP_VERSION']
274     assert_nil parser.headers(req, http << "\r")
275     assert_equal req, parser.headers(req, http << "\n")
276     assert_equal 'HTTP/1.0', req['SERVER_PROTOCOL']
277     assert_nil req['FRAGMENT']
278     assert_equal '', req['QUERY_STRING']
279     assert_equal "", http
280     assert ! parser.keepalive?
281   end
283   # not common, but underscores do appear in practice
284   def test_absolute_uri_underscores
285     parser = HttpParser.new
286     req = {}
287     http = "GET http://under_score.example.com/foo?q=bar HTTP/1.0\r\n\r\n"
288     assert_equal req, parser.headers(req, http)
289     assert_equal 'http', req['rack.url_scheme']
290     assert_equal '/foo?q=bar', req['REQUEST_URI']
291     assert_equal '/foo', req['REQUEST_PATH']
292     assert_equal 'q=bar', req['QUERY_STRING']
294     assert_equal 'under_score.example.com', req['HTTP_HOST']
295     assert_equal 'under_score.example.com', req['SERVER_NAME']
296     assert_equal '80', req['SERVER_PORT']
297     assert_equal "", http
298     assert ! parser.keepalive?
299   end
301   def test_absolute_uri
302     parser = HttpParser.new
303     req = {}
304     http = "GET http://example.com/foo?q=bar HTTP/1.0\r\n\r\n"
305     assert_equal req, parser.headers(req, http)
306     assert_equal 'http', req['rack.url_scheme']
307     assert_equal '/foo?q=bar', req['REQUEST_URI']
308     assert_equal '/foo', req['REQUEST_PATH']
309     assert_equal 'q=bar', req['QUERY_STRING']
311     assert_equal 'example.com', req['HTTP_HOST']
312     assert_equal 'example.com', req['SERVER_NAME']
313     assert_equal '80', req['SERVER_PORT']
314     assert_equal "", http
315     assert ! parser.keepalive?
316   end
318   # X-Forwarded-Proto is not in rfc2616, absolute URIs are, however...
319   def test_absolute_uri_https
320     parser = HttpParser.new
321     req = {}
322     http = "GET https://example.com/foo?q=bar HTTP/1.1\r\n" \
323            "X-Forwarded-Proto: http\r\n\r\n"
324     assert_equal req, parser.headers(req, http)
325     assert_equal 'https', req['rack.url_scheme']
326     assert_equal '/foo?q=bar', req['REQUEST_URI']
327     assert_equal '/foo', req['REQUEST_PATH']
328     assert_equal 'q=bar', req['QUERY_STRING']
330     assert_equal 'example.com', req['HTTP_HOST']
331     assert_equal 'example.com', req['SERVER_NAME']
332     assert_equal '443', req['SERVER_PORT']
333     assert_equal "", http
334     assert parser.keepalive?
335   end
337   # Host: header should be ignored for absolute URIs
338   def test_absolute_uri_with_port
339     parser = HttpParser.new
340     req = {}
341     http = "GET http://example.com:8080/foo?q=bar HTTP/1.2\r\n" \
342            "Host: bad.example.com\r\n\r\n"
343     assert_equal req, parser.headers(req, http)
344     assert_equal 'http', req['rack.url_scheme']
345     assert_equal '/foo?q=bar', req['REQUEST_URI']
346     assert_equal '/foo', req['REQUEST_PATH']
347     assert_equal 'q=bar', req['QUERY_STRING']
349     assert_equal 'example.com:8080', req['HTTP_HOST']
350     assert_equal 'example.com', req['SERVER_NAME']
351     assert_equal '8080', req['SERVER_PORT']
352     assert_equal "", http
353     assert ! parser.keepalive? # TODO: read HTTP/1.2 when it's final
354   end
356   def test_absolute_uri_with_empty_port
357     parser = HttpParser.new
358     req = {}
359     http = "GET https://example.com:/foo?q=bar HTTP/1.1\r\n" \
360            "Host: bad.example.com\r\n\r\n"
361     assert_equal req, parser.headers(req, http)
362     assert_equal 'https', req['rack.url_scheme']
363     assert_equal '/foo?q=bar', req['REQUEST_URI']
364     assert_equal '/foo', req['REQUEST_PATH']
365     assert_equal 'q=bar', req['QUERY_STRING']
367     assert_equal 'example.com:', req['HTTP_HOST']
368     assert_equal 'example.com', req['SERVER_NAME']
369     assert_equal '443', req['SERVER_PORT']
370     assert_equal "", http
371     assert parser.keepalive? # TODO: read HTTP/1.2 when it's final
372   end
374   def test_put_body_oneshot
375     parser = HttpParser.new
376     req = {}
377     http = "PUT / HTTP/1.0\r\nContent-Length: 5\r\n\r\nabcde"
378     assert_equal req, parser.headers(req, http)
379     assert_equal '/', req['REQUEST_PATH']
380     assert_equal '/', req['REQUEST_URI']
381     assert_equal 'PUT', req['REQUEST_METHOD']
382     assert_equal 'HTTP/1.0', req['HTTP_VERSION']
383     assert_equal 'HTTP/1.0', req['SERVER_PROTOCOL']
384     assert_equal "abcde", http
385     assert ! parser.keepalive? # TODO: read HTTP/1.2 when it's final
386   end
388   def test_put_body_later
389     parser = HttpParser.new
390     req = {}
391     http = "PUT /l HTTP/1.0\r\nContent-Length: 5\r\n\r\n"
392     assert_equal req, parser.headers(req, http)
393     assert_equal '/l', req['REQUEST_PATH']
394     assert_equal '/l', req['REQUEST_URI']
395     assert_equal 'PUT', req['REQUEST_METHOD']
396     assert_equal 'HTTP/1.0', req['HTTP_VERSION']
397     assert_equal 'HTTP/1.0', req['SERVER_PROTOCOL']
398     assert_equal "", http
399     assert ! parser.keepalive? # TODO: read HTTP/1.2 when it's final
400   end
402   def test_unknown_methods
403     %w(GETT HEADR XGET XHEAD).each { |m|
404       parser = HttpParser.new
405       req = {}
406       s = "#{m} /forums/1/topics/2375?page=1#posts-17408 HTTP/1.1\r\n\r\n"
407       ok = false
408       assert_nothing_raised do
409         ok = parser.headers(req, s)
410       end
411       assert ok
412       assert_equal '/forums/1/topics/2375?page=1', req['REQUEST_URI']
413       assert_equal 'posts-17408', req['FRAGMENT']
414       assert_equal 'page=1', req['QUERY_STRING']
415       assert_equal "", s
416       assert_equal m, req['REQUEST_METHOD']
417       assert ! parser.keepalive? # TODO: read HTTP/1.2 when it's final
418     }
419   end
421   def test_fragment_in_uri
422     parser = HttpParser.new
423     req = {}
424     get = "GET /forums/1/topics/2375?page=1#posts-17408 HTTP/1.1\r\n\r\n"
425     ok = false
426     assert_nothing_raised do
427       ok = parser.headers(req, get)
428     end
429     assert ok
430     assert_equal '/forums/1/topics/2375?page=1', req['REQUEST_URI']
431     assert_equal 'posts-17408', req['FRAGMENT']
432     assert_equal 'page=1', req['QUERY_STRING']
433     assert_equal '', get
434     assert parser.keepalive?
435   end
437   # lame random garbage maker
438   def rand_data(min, max, readable=true)
439     count = min + ((rand(max)+1) *10).to_i
440     res = count.to_s + "/"
441     
442     if readable
443       res << Digest::SHA1.hexdigest(rand(count * 100).to_s) * (count / 40)
444     else
445       res << Digest::SHA1.digest(rand(count * 100).to_s) * (count / 20)
446     end
448     return res
449   end
450   
452   def test_horrible_queries
453     parser = HttpParser.new
455     # then that large header names are caught
456     10.times do |c|
457       get = "GET /#{rand_data(10,120)} HTTP/1.1\r\nX-#{rand_data(1024, 1024+(c*1024))}: Test\r\n\r\n"
458       assert_raises Unicorn::HttpParserError do
459         parser.headers({}, get)
460         parser.reset
461       end
462     end
464     # then that large mangled field values are caught
465     10.times do |c|
466       get = "GET /#{rand_data(10,120)} HTTP/1.1\r\nX-Test: #{rand_data(1024, 1024+(c*1024), false)}\r\n\r\n"
467       assert_raises Unicorn::HttpParserError do
468         parser.headers({}, get)
469         parser.reset
470       end
471     end
473     # then large headers are rejected too
474     get = "GET /#{rand_data(10,120)} HTTP/1.1\r\n"
475     get << "X-Test: test\r\n" * (80 * 1024)
476     assert_raises Unicorn::HttpParserError do
477       parser.headers({}, get)
478       parser.reset
479     end
481     # finally just that random garbage gets blocked all the time
482     10.times do |c|
483       get = "GET #{rand_data(1024, 1024+(c*1024), false)} #{rand_data(1024, 1024+(c*1024), false)}\r\n\r\n"
484       assert_raises Unicorn::HttpParserError do
485         parser.headers({}, get)
486         parser.reset
487       end
488     end
490   end