OwlCyberSecurity - MANAGER
Edit File: multipartparser.cpython-39.pyc
a ���e�j � @ s0 d Z ddlZddlZddlZddlZddlmZ ddlmZm Z m Z m Z ddl m Z mZmZ ddlmZ ddlmZ ddlmZ dd lmZ d ZG d d � d e�ZG d d� de�ZdZ dZ dZ e e e g�Z G dd� d�Z!G dd� d�Z"G dd� d�Z#G dd� d�Z$G dd� d�Z%d d � Z&d d � Z'G d d!� d!�Z(dS )"z� Multi-part parsing for file uploads. Exposes one class, ``MultiPartParser``, which feeds chunks of uploaded data to file upload handlers for processing. � N)�settings)�RequestDataTooBig�SuspiciousMultipartForm�TooManyFieldsSent�TooManyFilesSent)�SkipFile�StopFutureHandlers� StopUpload)�MultiValueDict)� force_str)�parse_header_parameters)�_lazy_re_compile)�MultiPartParser�MultiPartParserError�InputStreamExhaustedc @ s e Zd ZdS )r N)�__name__� __module__� __qualname__� r r �\/home/gouroczh/virtualenv/pat/3.9/lib/python3.9/site-packages/django/http/multipartparser.pyr s r c @ s e Zd ZdZdS )r z5 No more reads are allowed from this device. N)r r r �__doc__r r r r r s r �raw�file�fieldc @ sN e Zd ZdZed�Zddd�Zdd� Zdd � Zd d � Z d d � Z e Z dd� Z dS )r z� An RFC 7578 multipart/form-data parser. ``MultiValueDict.parse()`` reads the input stream in ``chunk_size`` chunks and returns a tuple of ``(MultiValueDict(POST), MultiValueDict(FILES))``. z[ -~]{0,200}[!-~]Nc C s" |� dd�}|�d�s"td| ��z|�d� W n" tyR tdt|� ��Y n0 t|�\}}|� d�}|rz| j�|�s�tdt|� ��zt |� d d ��} W n t t fy� d } Y n0 | d k r�td | ��|�d�| _ || _ d d � |D �} tdg| �| _|| _|�ptj| _| | _|| _dS )a� Initialize the MultiPartParser object. :META: The standard ``META`` dictionary in Django request objects. :input_data: The raw post data, as a file-like object. :upload_handlers: A list of UploadHandler instances that perform operations on the uploaded data. :encoding: The encoding with which to treat the incoming data. Z CONTENT_TYPE� z multipart/zInvalid Content-Type: %s�asciiz/Invalid non-ASCII Content-Type in multipart: %s�boundaryz!Invalid boundary in multipart: %sZCONTENT_LENGTHr zInvalid content length: %rc S s g | ]}|j r|j �qS r )� chunk_size)�.0�xr r r � <listcomp>k � z,MultiPartParser.__init__.<locals>.<listcomp>i���N)�get� startswithr �encode�UnicodeEncodeErrorr r � boundary_re� fullmatch�int� ValueError� TypeError� _boundary� _input_data�min� _chunk_size�_metar �DEFAULT_CHARSET� _encoding�_content_length�_upload_handlers) �selfZMETAZ input_dataZupload_handlers�encoding� content_type�_�optsr �content_lengthZpossible_sizesr r r �__init__8 s> �� � zMultiPartParser.__init__c C sT z | � � W S tyN t| d�rH| j�� D ]\}}|D ] }|�� q8q,� Y n0 d S )N�_files)�_parse� Exception�hasattrr; �lists�close)r4 r7 �files�fileobjr r r �parses s zMultiPartParser.parsec # C s@ ddl m} | j}| j}| jdkr4|| jd�t� fS |D ]:}|�| j| j| j| j |�}|dur8|d |d f S q8|dd�| _ t� | _ t t | j| j��}d}dgt|� }d} d} d} d} d} �z�t|| j �D �]�\}}}|r�| �||� d}d} |tv �r*tjdu�r*| d7 } tjd | k �r*td ��z |d d }|d �� }W n tttf�yd Y q�Y n0 |�d �}|du�r�|d �� }t||d d�}|t k�rdtj du�r�tj | } |dk�r|j | d�}| t|�7 } zt � |�}W n t!j"�y� |}Y n0 n|j | d�}| t|�7 } | t|�d 7 } tj du�rJ| tj k�rJt#d��| j �$|t||d d�� q�|t%k�r�| d7 } tj&du�r�| tj&k�r�t'd��|�d�}|�r�t||d d�}| �(|�}|�s�q�|�ddi f�\}}|�� }|�d�}zt)|�d�d �}W n tt*t+f�y d}Y n0 dgt|� }d} �zF|D ]<}z|�,||||||� W n t-�yt Y �qzY n0 �q<|D ]�}|dk�r*d�.|�/� �} t| �d } | dk�r�|� d| �} | �sȐq�| d�.| �/� �7 } t| �d } �q�zt � | �}W n0 t0�y( } zt1d�| �W Y d} ~ n d} ~ 0 0 t2|�D ]B\} }t|�}!|�3||| �}|| |!7 < |du �r2 �q~�q2�q~W n$ t4�y� | �5� t6|� Y n0 |}q�t6|� q�W n@ t7�y� }" z&| �5� |"j8�s�t6| j� W Y d}"~"n.d}"~"0 0 | �s|D ]}|�9� �q t6| j� t:d d � |D �� d| j _;| j | j fS ) z� Parse the POST data and break it into a FILES MultiValueDict and a POST MultiValueDict. Return a tuple containing the POST and FILES dictionary, respectively. r )� QueryDict)r5 N� T)Zmutable� zRThe number of GET/POST parameters exceeded settings.DATA_UPLOAD_MAX_NUMBER_FIELDS.�content-disposition�namezcontent-transfer-encoding�replace��errors�base64)�sizez;Request body exceeded settings.DATA_UPLOAD_MAX_MEMORY_SIZE.zCThe number of files exceeded settings.DATA_UPLOAD_MAX_NUMBER_FILES.�filenamez content-typer �charsetzcontent-lengthFr! � z Could not decode base64 data.c s s | ]}|� � V qd S �N)Zupload_complete)r �handlerr r r � <genexpr>i r! z)MultiPartParser._parse.<locals>.<genexpr>)<Z django.httprD r1 r3 r2 r Zhandle_raw_inputr, r/ r+ �_postr; � LazyStream� ChunkIterr. �len�Parser�handle_file_complete� FIELD_TYPESr Z DATA_UPLOAD_MAX_NUMBER_FIELDSr �strip�KeyError� IndexError�AttributeErrorr" r �FIELDZDATA_UPLOAD_MAX_MEMORY_SIZE�readrL � b64decode�binascii�Errorr � appendlist�FILEZ DATA_UPLOAD_MAX_NUMBER_FILESr �sanitize_file_namer( r* r) �new_filer �join�splitr= r � enumerateZreceive_data_chunkr � _close_files�exhaustr Zconnection_resetZupload_interrupted�anyZ_mutable)#r4 rD r5 �handlersrR �result�stream�old_field_name�countersZnum_bytes_readZ num_post_keysZ num_files� read_sizeZ uploaded_fileZ item_typeZ meta_dataZ field_streamZ disposition� field_nameZtransfer_encoding�raw_data�data� file_namer6 Zcontent_type_extrarO r9 �chunkZstripped_chunk� remainingZ over_chunk�exc�iZ chunk_length�er r r r< � s0 � ��� � ���� ��� � � �� zMultiPartParser._parsec C sH t | j�D ]8\}}|�|| �}|r | j�t|| jdd�|� qDq dS )zT Handle all the signaling that takes place when a file is complete. rI rJ N)rj r3 Z file_completer; rd r r1 )r4 rq rr r{ rR Zfile_objr r r rY m s �z$MultiPartParser.handle_file_completec C sJ t �|�}|�d�d }|�d�d }d�dd� |D ��}|dv rFdS |S ) aT Sanitize the filename of an upload. Remove all possible path separators, even though that might remove more than actually required by the target system. Filenames that could potentially cause problems (current/parent dir) are also discarded. It should be noted that this function could still return a "filepath" like "C:some_file.txt" which is handled later on by the storage layer. So while this function does sanitize filenames to some extent, the resulting filename should still be considered as untrusted user input. �/����\r c S s g | ]}|� � r|�qS r )� isprintable)r �charr r r r � r! z6MultiPartParser.sanitize_file_name.<locals>.<listcomp>> r �.z..N)�html�unescape�rsplitrh )r4 rw r r r rf { s z"MultiPartParser.sanitize_file_namec C s$ | j D ]}t|d�r|j�� qd S )Nr )r3 r> r r@ )r4 rR r r r rk � s z MultiPartParser._close_files)N) r r r r r r& r: rC r< rY rf Z IE_sanitizerk r r r r r . s ; kr c @ sT e Zd ZdZddd�Zdd� Zddd�Zd d � Zd d � Zd d� Z dd� Z dd� Z dS )rU a! The LazyStream wrapper allows one to get and "unget" bytes from a stream. Given a producer object (an iterator that yields bytestrings), the LazyStream object will support iteration, reading, and keeping a "look-back" variable in case you need to "unget" some bytes. Nc C s. || _ d| _d| _|| _d| _|| _g | _dS )z� Every LazyStream must have a producer when instantiated. A producer is an iterable that returns a string each time it is called. Fr! r N)� _producer�_empty� _leftover�length�position� _remaining�_unget_history)r4 Zproducerr� r r r r: � s zLazyStream.__init__c C s | j S rQ )r� �r4 r r r �tell� s zLazyStream.tellc s � �fdd�}d� |� �S )Nc 3 s� �d u r� j n�} | d u r*d�� �V d S | dkr�| dksBJ d��z t� �}W n tyb Y d S 0 |d | � }� �|| d � � | t|�8 } |V q*d S )Nr! r z0remaining bytes to read should never go negative)r� rh �next� StopIteration�ungetrW )ry rx Zemitting�r4 rM r r �parts� s z LazyStream.read.<locals>.partsr! )rh )r4 rM r� r r� r r` � s zLazyStream.readc C s: | j r| j }d| _ nt| j�}g | _| jt|�7 _|S )z� Used when the exact number of bytes to read is unimportant. Return whatever chunk is conveniently returned from the iterator. Useful to avoid unnecessary bookkeeping if performance is an issue. r! )r� r� r� r� r� rW )r4 �outputr r r �__next__� s zLazyStream.__next__c C s g | _ dS )z� Used to invalidate/disable this lazy stream. Replace the producer with an empty list. Any leftover bytes that have already been read will still be reported upon read() and/or next(). N)r� r� r r r r@ � s zLazyStream.closec C s | S rQ r r� r r r �__iter__� s zLazyStream.__iter__c C s8 |sdS | � t|�� | jt|�8 _|| j | _dS )z� Place bytes back onto the front of the lazy stream. Future calls to read() will return those bytes first. The stream position and thus tell() will be rewound. N)�_update_unget_historyrW r� r� )r4 �bytesr r r r� � s zLazyStream.ungetc sB � g| j dd� | _ t� fdd�| j D ��}|dkr>td��dS )aZ Update the unget history as a sanity check to see if we've pushed back the same number of bytes in one chunk. If we keep ungetting the same number of bytes many times (here, 50), we're mostly likely in an infinite loop of some sort. This is usually caused by a maliciously-malformed MIME request. N�1 c s g | ]}|� kr|�qS r r )r Zcurrent_number�� num_bytesr r r s �z4LazyStream._update_unget_history.<locals>.<listcomp>�( z�The multipart parser got stuck, which shouldn't happen with normal uploaded files. Check for malicious upload activity; if there is none, report this to the Django developers.)r� rW r )r4 r� Z number_equalr r� r r� � s ���z LazyStream._update_unget_history)N)N) r r r r r: r� r` r� r@ r� r� r� r r r r rU � s rU c @ s* e Zd ZdZd dd�Zdd� Zdd� Zd S ) rV z� An iterable that will yield chunks of data. Given a file-like object as the constructor, yield chunks of read operations from that object. � c C s || _ || _d S rQ )�flor )r4 r� r r r r r: s zChunkIter.__init__c C s> z| j �| j�}W n ty* t� �Y n0 |r4|S t� �d S rQ )r� r` r r r� )r4 rv r r r r� s zChunkIter.__next__c C s | S rQ r r� r r r r� ) s zChunkIter.__iter__N)r� )r r r r r: r� r� r r r r rV s rV c @ s( e Zd ZdZdd� Zdd� Zdd� ZdS ) �InterBoundaryIterz7 A Producer that will iterate over boundaries. c C s || _ || _d S rQ )�_streamr+ �r4 rp r r r r r: 2 s zInterBoundaryIter.__init__c C s | S rQ r r� r r r r� 6 s zInterBoundaryIter.__iter__c C s2 zt t| j| j��W S ty, t� �Y n0 d S rQ )rU � BoundaryIterr� r+ r r� r� r r r r� 9 s zInterBoundaryIter.__next__N)r r r r r: r� r� r r r r r� - s r� c @ s0 e Zd ZdZdd� Zdd� Zdd� Zdd � Zd S ) r� ae A Producer that is sensitive to boundaries. Will happily yield bytes until a boundary is found. Will yield the bytes before the boundary, throw away the boundary bytes themselves, and push the post-boundary bytes back on the stream. The future calls to next() after locating the boundary will raise a StopIteration exception. c C sF || _ || _d| _t|�d | _| j �d�}|s6t� �| j �|� d S )NF� rE )r� r+ �_donerW � _rollbackr` r r� )r4 rp r Z unused_charr r r r: L s zBoundaryIter.__init__c C s | S rQ r r� r r r r� [ s zBoundaryIter.__iter__c C s� | j r t� �| j}| j}d}g }|D ].}|t|�7 }|�|� ||krJ qZ|s$ qZq$d| _ |sdt� �d�|�}| �|�}|r�|\}} |�|| d � � d| _ |d |� S |d | � s�d| _ |S |�|| d � � |d | � S d S )Nr Tr! ) r� r� r� r� rW �appendrh �_find_boundaryr� ) r4 rp �rollbackZ bytes_read�chunksr� rx r �endr� r r r r� ^ s8 zBoundaryIter.__next__c C s� |� | j�}|dk rdS |}|t| j� }td|d �}|||d � dkrT|d8 }td|d �}|||d � dkr~|d8 }||fS dS )a Find a multipart boundary in data. Should no boundary exist in the data, return None. Otherwise, return a tuple containing the indices of the following: * the end of current encapsulation * the start of the next encapsulation r NrE � � )�findr+ rW �max)r4 rv �indexr� r� �lastr r r r� � s zBoundaryIter._find_boundaryN)r r r r r: r� r� r� r r r r r� @ s )r� c C s< z t | �}W n ty( t| d�}Y n0 tj|dd� dS )z Exhaust an iterator or stream.i @ r )�maxlenN)�iterr* rV � collections�deque)Zstream_or_iterable�iteratorr r r rl � s rl c C s� | � |�}|�d�}|dkr0| �|� ti | fS |d|� }| �||d d� � t}i }|�d�D ]x}z6t|�� �\}} |�dd�\} } dd � | �� D �} W n ty� Y qdY n0 | d kr�t }| � d �r�t }| | f|| < qd|tkr�| �|� ||| fS ) zH Parse one and exactly one stream that encapsulates a boundary. s r~ NrP s �:rE c S s i | ]\}}||� � �qS r )r$ )r �k�vr r r � <dictcomp>� r! z)parse_boundary_stream.<locals>.<dictcomp>rG rN ) r` r� r� �RAWri r �decode�itemsr) r_ r" re ) rp Zmax_header_sizerx Z header_end�headerZTYPEZoutdict�lineZmain_value_pair�paramsrH �valuer r r �parse_boundary_stream� s0 r� c @ s e Zd Zdd� Zdd� ZdS )rX c C s || _ d| | _d S )Ns --)r� � _separatorr� r r r r: � s zParser.__init__c c s( t | j| j�}|D ]}t|d�V qd S )Ni )r� r� r� r� )r4 ZboundarystreamZ sub_streamr r r r� � s zParser.__iter__N)r r r r: r� r r r r rX � s rX ))r rL rb r� r� Z django.confr Zdjango.core.exceptionsr r r r Z django.core.files.uploadhandlerr r r Zdjango.utils.datastructuresr Zdjango.utils.encodingr Zdjango.utils.httpr Zdjango.utils.regex_helperr �__all__r= r r r� re r_ � frozensetrZ r rU rV r� r� rl r� rX r r r r �<module> s8 rw` 5