fix(cookies) re-doing is_ascii_encodable

Also renaming httponly to http_only (still called httponly in
the cookie, ofc)
This commit is contained in:
Henrik Tudborg
2015-04-19 14:35:18 +02:00
parent 39b0f6f1ab
commit 6d75a68139
3 changed files with 23 additions and 21 deletions

View File

@@ -146,7 +146,7 @@ class Response(object):
self.stream_len = stream_len self.stream_len = stream_len
def set_cookie(self, name, value, expires=None, max_age=None, def set_cookie(self, name, value, expires=None, max_age=None,
domain=None, path=None, secure=True, httponly=True): domain=None, path=None, secure=True, http_only=True):
"""Set a response cookie. """Set a response cookie.
Note: Note:
@@ -177,8 +177,8 @@ class Response(object):
server whenever it sends back this cookie. server whenever it sends back this cookie.
Warning: You will also need to enforce HTTPS for the cookies Warning: You will also need to enforce HTTPS for the cookies
to be transfered securely. to be transfered securely.
httponly (bool) (default: True): http_only (bool) (default: True):
The attribute httponly specifies that the cookie The attribute http_only specifies that the cookie
is only transferred in HTTP requests, and is not accessible is only transferred in HTTP requests, and is not accessible
through JavaScript. This is intended to mitigate some forms through JavaScript. This is intended to mitigate some forms
of cross-site scripting. of cross-site scripting.
@@ -241,8 +241,8 @@ class Response(object):
if secure: if secure:
self._cookies[name]["secure"] = secure self._cookies[name]["secure"] = secure
if httponly: if http_only:
self._cookies[name]["httponly"] = httponly self._cookies[name]["httponly"] = http_only
def unset_cookie(self, name): def unset_cookie(self, name):
"""Unset a cookie from the response """Unset a cookie from the response

View File

@@ -11,7 +11,6 @@
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and # See the License for the specific language governing permissions and
# limitations under the License. # limitations under the License.
import six
def header_property(name, doc, transform=None): def header_property(name, doc, transform=None):
@@ -64,15 +63,18 @@ def format_range(value):
def is_ascii_encodable(s): # pragma: no cover def is_ascii_encodable(s): # pragma: no cover
""" check if argument encodes to ascii without error """Check if argument encodes to ascii without error."""
""" try:
if isinstance(s, six.text_type): s.encode("ascii")
try: except UnicodeEncodeError:
s.encode("ascii") # NOTE(tbug): Py2 and Py3 will raise this if string contained
return True # chars that could not be ascii encoded
except UnicodeEncodeError: return False
return False except UnicodeDecodeError:
elif six.PY2 and isinstance(s, str): # NOTE(tbug): py2 will raise this if type is str
return True # and contains non-ascii chars
else: return False
raise ValueError("argument was not a string type") except AttributeError:
# NOTE(tbug): s is probably not a string type
return False
return True

View File

@@ -29,18 +29,18 @@ class CookieResource:
def on_head(self, req, resp): def on_head(self, req, resp):
resp.set_cookie("foo", "bar", max_age=300) resp.set_cookie("foo", "bar", max_age=300)
resp.set_cookie("bar", "baz", httponly=False) resp.set_cookie("bar", "baz", http_only=False)
resp.set_cookie("bad", "cookie") resp.set_cookie("bad", "cookie")
resp.unset_cookie("bad") resp.unset_cookie("bad")
def on_post(self, req, resp): def on_post(self, req, resp):
e = datetime(year=2050, month=1, day=1) # naive e = datetime(year=2050, month=1, day=1) # naive
resp.set_cookie("foo", "bar", httponly=False, secure=False, expires=e) resp.set_cookie("foo", "bar", http_only=False, secure=False, expires=e)
resp.unset_cookie("bad") resp.unset_cookie("bad")
def on_put(self, req, resp): def on_put(self, req, resp):
e = datetime(year=2050, month=1, day=1, tzinfo=GMT_PLUS_ONE) # aware e = datetime(year=2050, month=1, day=1, tzinfo=GMT_PLUS_ONE) # aware
resp.set_cookie("foo", "bar", httponly=False, secure=False, expires=e) resp.set_cookie("foo", "bar", http_only=False, secure=False, expires=e)
resp.unset_cookie("bad") resp.unset_cookie("bad")