1import warnings 2 3from .._compat import integer_types 4from .._compat import string_types 5from .._compat import text_type 6from .._compat import to_bytes 7from .._compat import to_native 8from ..datastructures import Headers 9from ..http import dump_cookie 10from ..http import HTTP_STATUS_CODES 11from ..http import remove_entity_headers 12from ..urls import iri_to_uri 13from ..urls import url_join 14from ..utils import get_content_type 15from ..wsgi import ClosingIterator 16from ..wsgi import get_current_url 17 18 19def _run_wsgi_app(*args): 20 """This function replaces itself to ensure that the test module is not 21 imported unless required. DO NOT USE! 22 """ 23 global _run_wsgi_app 24 from ..test import run_wsgi_app as _run_wsgi_app 25 26 return _run_wsgi_app(*args) 27 28 29def _warn_if_string(iterable): 30 """Helper for the response objects to check if the iterable returned 31 to the WSGI server is not a string. 32 """ 33 if isinstance(iterable, string_types): 34 warnings.warn( 35 "Response iterable was set to a string. This will appear to" 36 " work but means that the server will send the data to the" 37 " client one character at a time. This is almost never" 38 " intended behavior, use 'response.data' to assign strings" 39 " to the response object.", 40 stacklevel=2, 41 ) 42 43 44def _iter_encoded(iterable, charset): 45 for item in iterable: 46 if isinstance(item, text_type): 47 yield item.encode(charset) 48 else: 49 yield item 50 51 52def _clean_accept_ranges(accept_ranges): 53 if accept_ranges is True: 54 return "bytes" 55 elif accept_ranges is False: 56 return "none" 57 elif isinstance(accept_ranges, text_type): 58 return to_native(accept_ranges) 59 raise ValueError("Invalid accept_ranges value") 60 61 62class BaseResponse(object): 63 """Base response class. The most important fact about a response object 64 is that it's a regular WSGI application. It's initialized with a couple 65 of response parameters (headers, body, status code etc.) and will start a 66 valid WSGI response when called with the environ and start response 67 callable. 68 69 Because it's a WSGI application itself processing usually ends before the 70 actual response is sent to the server. This helps debugging systems 71 because they can catch all the exceptions before responses are started. 72 73 Here a small example WSGI application that takes advantage of the 74 response objects:: 75 76 from werkzeug.wrappers import BaseResponse as Response 77 78 def index(): 79 return Response('Index page') 80 81 def application(environ, start_response): 82 path = environ.get('PATH_INFO') or '/' 83 if path == '/': 84 response = index() 85 else: 86 response = Response('Not Found', status=404) 87 return response(environ, start_response) 88 89 Like :class:`BaseRequest` which object is lacking a lot of functionality 90 implemented in mixins. This gives you a better control about the actual 91 API of your response objects, so you can create subclasses and add custom 92 functionality. A full featured response object is available as 93 :class:`Response` which implements a couple of useful mixins. 94 95 To enforce a new type of already existing responses you can use the 96 :meth:`force_type` method. This is useful if you're working with different 97 subclasses of response objects and you want to post process them with a 98 known interface. 99 100 Per default the response object will assume all the text data is `utf-8` 101 encoded. Please refer to :doc:`the unicode chapter </unicode>` for more 102 details about customizing the behavior. 103 104 Response can be any kind of iterable or string. If it's a string it's 105 considered being an iterable with one item which is the string passed. 106 Headers can be a list of tuples or a 107 :class:`~werkzeug.datastructures.Headers` object. 108 109 Special note for `mimetype` and `content_type`: For most mime types 110 `mimetype` and `content_type` work the same, the difference affects 111 only 'text' mimetypes. If the mimetype passed with `mimetype` is a 112 mimetype starting with `text/`, the charset parameter of the response 113 object is appended to it. In contrast the `content_type` parameter is 114 always added as header unmodified. 115 116 .. versionchanged:: 0.5 117 the `direct_passthrough` parameter was added. 118 119 :param response: a string or response iterable. 120 :param status: a string with a status or an integer with the status code. 121 :param headers: a list of headers or a 122 :class:`~werkzeug.datastructures.Headers` object. 123 :param mimetype: the mimetype for the response. See notice above. 124 :param content_type: the content type for the response. See notice above. 125 :param direct_passthrough: if set to `True` :meth:`iter_encoded` is not 126 called before iteration which makes it 127 possible to pass special iterators through 128 unchanged (see :func:`wrap_file` for more 129 details.) 130 """ 131 132 #: the charset of the response. 133 charset = "utf-8" 134 135 #: the default status if none is provided. 136 default_status = 200 137 138 #: the default mimetype if none is provided. 139 default_mimetype = "text/plain" 140 141 #: if set to `False` accessing properties on the response object will 142 #: not try to consume the response iterator and convert it into a list. 143 #: 144 #: .. versionadded:: 0.6.2 145 #: 146 #: That attribute was previously called `implicit_seqence_conversion`. 147 #: (Notice the typo). If you did use this feature, you have to adapt 148 #: your code to the name change. 149 implicit_sequence_conversion = True 150 151 #: Should this response object correct the location header to be RFC 152 #: conformant? This is true by default. 153 #: 154 #: .. versionadded:: 0.8 155 autocorrect_location_header = True 156 157 #: Should this response object automatically set the content-length 158 #: header if possible? This is true by default. 159 #: 160 #: .. versionadded:: 0.8 161 automatically_set_content_length = True 162 163 #: Warn if a cookie header exceeds this size. The default, 4093, should be 164 #: safely `supported by most browsers <cookie_>`_. A cookie larger than 165 #: this size will still be sent, but it may be ignored or handled 166 #: incorrectly by some browsers. Set to 0 to disable this check. 167 #: 168 #: .. versionadded:: 0.13 169 #: 170 #: .. _`cookie`: http://browsercookielimits.squawky.net/ 171 max_cookie_size = 4093 172 173 def __init__( 174 self, 175 response=None, 176 status=None, 177 headers=None, 178 mimetype=None, 179 content_type=None, 180 direct_passthrough=False, 181 ): 182 if isinstance(headers, Headers): 183 self.headers = headers 184 elif not headers: 185 self.headers = Headers() 186 else: 187 self.headers = Headers(headers) 188 189 if content_type is None: 190 if mimetype is None and "content-type" not in self.headers: 191 mimetype = self.default_mimetype 192 if mimetype is not None: 193 mimetype = get_content_type(mimetype, self.charset) 194 content_type = mimetype 195 if content_type is not None: 196 self.headers["Content-Type"] = content_type 197 if status is None: 198 status = self.default_status 199 if isinstance(status, integer_types): 200 self.status_code = status 201 else: 202 self.status = status 203 204 self.direct_passthrough = direct_passthrough 205 self._on_close = [] 206 207 # we set the response after the headers so that if a class changes 208 # the charset attribute, the data is set in the correct charset. 209 if response is None: 210 self.response = [] 211 elif isinstance(response, (text_type, bytes, bytearray)): 212 self.set_data(response) 213 else: 214 self.response = response 215 216 def call_on_close(self, func): 217 """Adds a function to the internal list of functions that should 218 be called as part of closing down the response. Since 0.7 this 219 function also returns the function that was passed so that this 220 can be used as a decorator. 221 222 .. versionadded:: 0.6 223 """ 224 self._on_close.append(func) 225 return func 226 227 def __repr__(self): 228 if self.is_sequence: 229 body_info = "%d bytes" % sum(map(len, self.iter_encoded())) 230 else: 231 body_info = "streamed" if self.is_streamed else "likely-streamed" 232 return "<%s %s [%s]>" % (self.__class__.__name__, body_info, self.status) 233 234 @classmethod 235 def force_type(cls, response, environ=None): 236 """Enforce that the WSGI response is a response object of the current 237 type. Werkzeug will use the :class:`BaseResponse` internally in many 238 situations like the exceptions. If you call :meth:`get_response` on an 239 exception you will get back a regular :class:`BaseResponse` object, even 240 if you are using a custom subclass. 241 242 This method can enforce a given response type, and it will also 243 convert arbitrary WSGI callables into response objects if an environ 244 is provided:: 245 246 # convert a Werkzeug response object into an instance of the 247 # MyResponseClass subclass. 248 response = MyResponseClass.force_type(response) 249 250 # convert any WSGI application into a response object 251 response = MyResponseClass.force_type(response, environ) 252 253 This is especially useful if you want to post-process responses in 254 the main dispatcher and use functionality provided by your subclass. 255 256 Keep in mind that this will modify response objects in place if 257 possible! 258 259 :param response: a response object or wsgi application. 260 :param environ: a WSGI environment object. 261 :return: a response object. 262 """ 263 if not isinstance(response, BaseResponse): 264 if environ is None: 265 raise TypeError( 266 "cannot convert WSGI application into response" 267 " objects without an environ" 268 ) 269 response = BaseResponse(*_run_wsgi_app(response, environ)) 270 response.__class__ = cls 271 return response 272 273 @classmethod 274 def from_app(cls, app, environ, buffered=False): 275 """Create a new response object from an application output. This 276 works best if you pass it an application that returns a generator all 277 the time. Sometimes applications may use the `write()` callable 278 returned by the `start_response` function. This tries to resolve such 279 edge cases automatically. But if you don't get the expected output 280 you should set `buffered` to `True` which enforces buffering. 281 282 :param app: the WSGI application to execute. 283 :param environ: the WSGI environment to execute against. 284 :param buffered: set to `True` to enforce buffering. 285 :return: a response object. 286 """ 287 return cls(*_run_wsgi_app(app, environ, buffered)) 288 289 def _get_status_code(self): 290 return self._status_code 291 292 def _set_status_code(self, code): 293 self._status_code = code 294 try: 295 self._status = "%d %s" % (code, HTTP_STATUS_CODES[code].upper()) 296 except KeyError: 297 self._status = "%d UNKNOWN" % code 298 299 status_code = property( 300 _get_status_code, _set_status_code, doc="The HTTP Status code as number" 301 ) 302 del _get_status_code, _set_status_code 303 304 def _get_status(self): 305 return self._status 306 307 def _set_status(self, value): 308 try: 309 self._status = to_native(value) 310 except AttributeError: 311 raise TypeError("Invalid status argument") 312 313 try: 314 self._status_code = int(self._status.split(None, 1)[0]) 315 except ValueError: 316 self._status_code = 0 317 self._status = "0 %s" % self._status 318 except IndexError: 319 raise ValueError("Empty status argument") 320 321 status = property(_get_status, _set_status, doc="The HTTP Status code") 322 del _get_status, _set_status 323 324 def get_data(self, as_text=False): 325 """The string representation of the request body. Whenever you call 326 this property the request iterable is encoded and flattened. This 327 can lead to unwanted behavior if you stream big data. 328 329 This behavior can be disabled by setting 330 :attr:`implicit_sequence_conversion` to `False`. 331 332 If `as_text` is set to `True` the return value will be a decoded 333 unicode string. 334 335 .. versionadded:: 0.9 336 """ 337 self._ensure_sequence() 338 rv = b"".join(self.iter_encoded()) 339 if as_text: 340 rv = rv.decode(self.charset) 341 return rv 342 343 def set_data(self, value): 344 """Sets a new string as response. The value set must either by a 345 unicode or bytestring. If a unicode string is set it's encoded 346 automatically to the charset of the response (utf-8 by default). 347 348 .. versionadded:: 0.9 349 """ 350 # if an unicode string is set, it's encoded directly so that we 351 # can set the content length 352 if isinstance(value, text_type): 353 value = value.encode(self.charset) 354 else: 355 value = bytes(value) 356 self.response = [value] 357 if self.automatically_set_content_length: 358 self.headers["Content-Length"] = str(len(value)) 359 360 data = property( 361 get_data, 362 set_data, 363 doc="A descriptor that calls :meth:`get_data` and :meth:`set_data`.", 364 ) 365 366 def calculate_content_length(self): 367 """Returns the content length if available or `None` otherwise.""" 368 try: 369 self._ensure_sequence() 370 except RuntimeError: 371 return None 372 return sum(len(x) for x in self.iter_encoded()) 373 374 def _ensure_sequence(self, mutable=False): 375 """This method can be called by methods that need a sequence. If 376 `mutable` is true, it will also ensure that the response sequence 377 is a standard Python list. 378 379 .. versionadded:: 0.6 380 """ 381 if self.is_sequence: 382 # if we need a mutable object, we ensure it's a list. 383 if mutable and not isinstance(self.response, list): 384 self.response = list(self.response) 385 return 386 if self.direct_passthrough: 387 raise RuntimeError( 388 "Attempted implicit sequence conversion but the" 389 " response object is in direct passthrough mode." 390 ) 391 if not self.implicit_sequence_conversion: 392 raise RuntimeError( 393 "The response object required the iterable to be a" 394 " sequence, but the implicit conversion was disabled." 395 " Call make_sequence() yourself." 396 ) 397 self.make_sequence() 398 399 def make_sequence(self): 400 """Converts the response iterator in a list. By default this happens 401 automatically if required. If `implicit_sequence_conversion` is 402 disabled, this method is not automatically called and some properties 403 might raise exceptions. This also encodes all the items. 404 405 .. versionadded:: 0.6 406 """ 407 if not self.is_sequence: 408 # if we consume an iterable we have to ensure that the close 409 # method of the iterable is called if available when we tear 410 # down the response 411 close = getattr(self.response, "close", None) 412 self.response = list(self.iter_encoded()) 413 if close is not None: 414 self.call_on_close(close) 415 416 def iter_encoded(self): 417 """Iter the response encoded with the encoding of the response. 418 If the response object is invoked as WSGI application the return 419 value of this method is used as application iterator unless 420 :attr:`direct_passthrough` was activated. 421 """ 422 if __debug__: 423 _warn_if_string(self.response) 424 # Encode in a separate function so that self.response is fetched 425 # early. This allows us to wrap the response with the return 426 # value from get_app_iter or iter_encoded. 427 return _iter_encoded(self.response, self.charset) 428 429 def set_cookie( 430 self, 431 key, 432 value="", 433 max_age=None, 434 expires=None, 435 path="/", 436 domain=None, 437 secure=False, 438 httponly=False, 439 samesite=None, 440 ): 441 """Sets a cookie. The parameters are the same as in the cookie `Morsel` 442 object in the Python standard library but it accepts unicode data, too. 443 444 A warning is raised if the size of the cookie header exceeds 445 :attr:`max_cookie_size`, but the header will still be set. 446 447 :param key: the key (name) of the cookie to be set. 448 :param value: the value of the cookie. 449 :param max_age: should be a number of seconds, or `None` (default) if 450 the cookie should last only as long as the client's 451 browser session. 452 :param expires: should be a `datetime` object or UNIX timestamp. 453 :param path: limits the cookie to a given path, per default it will 454 span the whole domain. 455 :param domain: if you want to set a cross-domain cookie. For example, 456 ``domain=".example.com"`` will set a cookie that is 457 readable by the domain ``www.example.com``, 458 ``foo.example.com`` etc. Otherwise, a cookie will only 459 be readable by the domain that set it. 460 :param secure: If `True`, the cookie will only be available via HTTPS 461 :param httponly: disallow JavaScript to access the cookie. This is an 462 extension to the cookie standard and probably not 463 supported by all browsers. 464 :param samesite: Limits the scope of the cookie such that it will only 465 be attached to requests if those requests are 466 "same-site". 467 """ 468 self.headers.add( 469 "Set-Cookie", 470 dump_cookie( 471 key, 472 value=value, 473 max_age=max_age, 474 expires=expires, 475 path=path, 476 domain=domain, 477 secure=secure, 478 httponly=httponly, 479 charset=self.charset, 480 max_size=self.max_cookie_size, 481 samesite=samesite, 482 ), 483 ) 484 485 def delete_cookie(self, key, path="/", domain=None): 486 """Delete a cookie. Fails silently if key doesn't exist. 487 488 :param key: the key (name) of the cookie to be deleted. 489 :param path: if the cookie that should be deleted was limited to a 490 path, the path has to be defined here. 491 :param domain: if the cookie that should be deleted was limited to a 492 domain, that domain has to be defined here. 493 """ 494 self.set_cookie(key, expires=0, max_age=0, path=path, domain=domain) 495 496 @property 497 def is_streamed(self): 498 """If the response is streamed (the response is not an iterable with 499 a length information) this property is `True`. In this case streamed 500 means that there is no information about the number of iterations. 501 This is usually `True` if a generator is passed to the response object. 502 503 This is useful for checking before applying some sort of post 504 filtering that should not take place for streamed responses. 505 """ 506 try: 507 len(self.response) 508 except (TypeError, AttributeError): 509 return True 510 return False 511 512 @property 513 def is_sequence(self): 514 """If the iterator is buffered, this property will be `True`. A 515 response object will consider an iterator to be buffered if the 516 response attribute is a list or tuple. 517 518 .. versionadded:: 0.6 519 """ 520 return isinstance(self.response, (tuple, list)) 521 522 def close(self): 523 """Close the wrapped response if possible. You can also use the object 524 in a with statement which will automatically close it. 525 526 .. versionadded:: 0.9 527 Can now be used in a with statement. 528 """ 529 if hasattr(self.response, "close"): 530 self.response.close() 531 for func in self._on_close: 532 func() 533 534 def __enter__(self): 535 return self 536 537 def __exit__(self, exc_type, exc_value, tb): 538 self.close() 539 540 def freeze(self): 541 """Call this method if you want to make your response object ready for 542 being pickled. This buffers the generator if there is one. It will 543 also set the `Content-Length` header to the length of the body. 544 545 .. versionchanged:: 0.6 546 The `Content-Length` header is now set. 547 """ 548 # we explicitly set the length to a list of the *encoded* response 549 # iterator. Even if the implicit sequence conversion is disabled. 550 self.response = list(self.iter_encoded()) 551 self.headers["Content-Length"] = str(sum(map(len, self.response))) 552 553 def get_wsgi_headers(self, environ): 554 """This is automatically called right before the response is started 555 and returns headers modified for the given environment. It returns a 556 copy of the headers from the response with some modifications applied 557 if necessary. 558 559 For example the location header (if present) is joined with the root 560 URL of the environment. Also the content length is automatically set 561 to zero here for certain status codes. 562 563 .. versionchanged:: 0.6 564 Previously that function was called `fix_headers` and modified 565 the response object in place. Also since 0.6, IRIs in location 566 and content-location headers are handled properly. 567 568 Also starting with 0.6, Werkzeug will attempt to set the content 569 length if it is able to figure it out on its own. This is the 570 case if all the strings in the response iterable are already 571 encoded and the iterable is buffered. 572 573 :param environ: the WSGI environment of the request. 574 :return: returns a new :class:`~werkzeug.datastructures.Headers` 575 object. 576 """ 577 headers = Headers(self.headers) 578 location = None 579 content_location = None 580 content_length = None 581 status = self.status_code 582 583 # iterate over the headers to find all values in one go. Because 584 # get_wsgi_headers is used each response that gives us a tiny 585 # speedup. 586 for key, value in headers: 587 ikey = key.lower() 588 if ikey == u"location": 589 location = value 590 elif ikey == u"content-location": 591 content_location = value 592 elif ikey == u"content-length": 593 content_length = value 594 595 # make sure the location header is an absolute URL 596 if location is not None: 597 old_location = location 598 if isinstance(location, text_type): 599 # Safe conversion is necessary here as we might redirect 600 # to a broken URI scheme (for instance itms-services). 601 location = iri_to_uri(location, safe_conversion=True) 602 603 if self.autocorrect_location_header: 604 current_url = get_current_url(environ, strip_querystring=True) 605 if isinstance(current_url, text_type): 606 current_url = iri_to_uri(current_url) 607 location = url_join(current_url, location) 608 if location != old_location: 609 headers["Location"] = location 610 611 # make sure the content location is a URL 612 if content_location is not None and isinstance(content_location, text_type): 613 headers["Content-Location"] = iri_to_uri(content_location) 614 615 if 100 <= status < 200 or status == 204: 616 # Per section 3.3.2 of RFC 7230, "a server MUST NOT send a 617 # Content-Length header field in any response with a status 618 # code of 1xx (Informational) or 204 (No Content)." 619 headers.remove("Content-Length") 620 elif status == 304: 621 remove_entity_headers(headers) 622 623 # if we can determine the content length automatically, we 624 # should try to do that. But only if this does not involve 625 # flattening the iterator or encoding of unicode strings in 626 # the response. We however should not do that if we have a 304 627 # response. 628 if ( 629 self.automatically_set_content_length 630 and self.is_sequence 631 and content_length is None 632 and status not in (204, 304) 633 and not (100 <= status < 200) 634 ): 635 try: 636 content_length = sum(len(to_bytes(x, "ascii")) for x in self.response) 637 except UnicodeError: 638 # aha, something non-bytestringy in there, too bad, we 639 # can't safely figure out the length of the response. 640 pass 641 else: 642 headers["Content-Length"] = str(content_length) 643 644 return headers 645 646 def get_app_iter(self, environ): 647 """Returns the application iterator for the given environ. Depending 648 on the request method and the current status code the return value 649 might be an empty response rather than the one from the response. 650 651 If the request method is `HEAD` or the status code is in a range 652 where the HTTP specification requires an empty response, an empty 653 iterable is returned. 654 655 .. versionadded:: 0.6 656 657 :param environ: the WSGI environment of the request. 658 :return: a response iterable. 659 """ 660 status = self.status_code 661 if ( 662 environ["REQUEST_METHOD"] == "HEAD" 663 or 100 <= status < 200 664 or status in (204, 304) 665 ): 666 iterable = () 667 elif self.direct_passthrough: 668 if __debug__: 669 _warn_if_string(self.response) 670 return self.response 671 else: 672 iterable = self.iter_encoded() 673 return ClosingIterator(iterable, self.close) 674 675 def get_wsgi_response(self, environ): 676 """Returns the final WSGI response as tuple. The first item in 677 the tuple is the application iterator, the second the status and 678 the third the list of headers. The response returned is created 679 specially for the given environment. For example if the request 680 method in the WSGI environment is ``'HEAD'`` the response will 681 be empty and only the headers and status code will be present. 682 683 .. versionadded:: 0.6 684 685 :param environ: the WSGI environment of the request. 686 :return: an ``(app_iter, status, headers)`` tuple. 687 """ 688 headers = self.get_wsgi_headers(environ) 689 app_iter = self.get_app_iter(environ) 690 return app_iter, self.status, headers.to_wsgi_list() 691 692 def __call__(self, environ, start_response): 693 """Process this response as WSGI application. 694 695 :param environ: the WSGI environment. 696 :param start_response: the response callable provided by the WSGI 697 server. 698 :return: an application iterator 699 """ 700 app_iter, status, headers = self.get_wsgi_response(environ) 701 start_response(status, headers) 702 return app_iter 703