|
Server : Apache System : Linux iad1-shared-b8-43 6.6.49-grsec-jammy+ #10 SMP Thu Sep 12 23:23:08 UTC 2024 x86_64 User : dh_edsupp ( 6597262) PHP Version : 8.2.26 Disable Function : NONE Directory : /lib/python3/dist-packages/django/http/__pycache__/ |
Upload File : |
o
��Ihrm � @ s< d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z ddl
m Z m Z m
Z
mZ ddlmZmZmZ ddlmZ ddlmZ d ZG d
d � d e�ZG d d
� d
e�ZdZdZ dZ e e eg�Z G dd� d�Z G dd� d�Z!G dd� d�Z"G dd� d�Z#G dd� d�Z$dd � Z%d d � Z&G d d � d �Z'd!d"� Z(d#d$� Z)dS )%z�
Multi-part parsing for file uploads.
Exposes one class, ``MultiPartParser``, which feeds chunks of uploaded data to
file upload handlers for processing.
� N)�unquote)�settings)�RequestDataTooBig�SuspiciousMultipartForm�TooManyFieldsSent�TooManyFilesSent)�SkipFile�StopFutureHandlers�
StopUpload)�MultiValueDict)� force_str)�MultiPartParser�MultiPartParserError�InputStreamExhaustedc @ s e Zd ZdS )r N)�__name__�
__module__� __qualname__� r r �=/usr/lib/python3/dist-packages/django/http/multipartparser.pyr s r c @ s e Zd ZdZdS )r z5
No more reads are allowed from this device.
N)r r r �__doc__r r r r r s r �raw�file�fieldc @ sF e Zd ZdZddd�Zdd� Zdd� Zd d
� Zd d � ZeZ d
d� Z
dS )r
z�
A rfc2388 multipart/form-data parser.
``MultiValueDict.parse()`` reads the input stream in ``chunk_size`` chunks
and returns a tuple of ``(MultiValueDict(POST), MultiValueDict(FILES))``.
Nc C s$ |� dd�}|�d�std| ��z t|�d��\}}W n ty+ tdt|� ��w |� d�}|r8t�|�s@tdt|� ��z
t |� d d
��} W n
t
t fyW d
} Y nw | d
k rbtd | ��t |t
�rl|�d�}|| _|| _d d
� |D �}
tdg|
�| _|| _|p�tj| _| | _|| _dS )a�
Initialize the MultiPartParser object.
:META:
The standard ``META`` dictionary in Django request objects.
:input_data:
The raw post data, as a file-like object.
:upload_handlers:
A list of UploadHandler instances that perform operations on the
uploaded data.
:encoding:
The encoding with which to treat the incoming data.
� CONTENT_TYPE� z
multipart/zInvalid Content-Type: %s�asciiz/Invalid non-ASCII Content-Type in multipart: %s�boundaryz!Invalid boundary in multipart: %s�CONTENT_LENGTHr zInvalid content length: %rc S s g | ]}|j r|j �qS r )�
chunk_size)�.0�xr r r �
<listcomp>b s z,MultiPartParser.__init__.<locals>.<listcomp>i���N)�get�
startswithr � parse_header�encode�UnicodeEncodeErrorr �cgi�valid_boundary�int�
ValueError� TypeError�
isinstance�str� _boundary� _input_data�min� _chunk_size�_metar �DEFAULT_CHARSET� _encoding�_content_length�_upload_handlers) �self�META�
input_data�upload_handlers�encoding� content_type�ctypes�optsr �content_length�possible_sizesr r r �__init__4 s8
�
�
zMultiPartParser.__init__c C sL z| � � W S ty% t| d�r$| j�� D ]
\}}|D ]}|�� q q� w )N�_files)�_parse� Exception�hasattrrB �lists�close)r7 �_�files�fileobjr r r �parsej s
��zMultiPartParser.parsec # C s ddl m} | j}| j}| jdkr|| jd�t� fS |D ] }|�| j| j| j| j |�}|dur9|d |d f S q |dd�| _
t� | _ t t
| j| j��}d}dgt|� }d} d}
d} d} d}
�z�t|| j �D �]�\}}}|rz| �||� d}d}
|tv r�tjdur�|
d7 }
tjd |
k r�td ��z|d
d }|d �� }W n tttfy� Y qhw |�d �}|dur�|d �� }t||d
d�}|t k�r'tj dur�tj | } |dkr�|j | d�}| t|�7 } zt � |�}W n t!j"y� |}Y n
w |j | d�}| t|�7 } | t|�d 7 } tj du�r| tj k�rt#d��| j
�$|t||d
d�� qh|t%k�r?| d7 } tj&du�r@| tj&k�r@t'd��|�d�}|�rTt||d
d�}| �(|�}|�sXqh|�ddi f�\}}|�� }|�d�}z t)|�d�d �}W n tt*t+f�y� d}Y nw dgt|� }d}
z�|D ]}z
|�,||||||� W �q� t-�y� Y nw |D ]x}|dk�rd�.|�/� �} t| �d } | dk�r�|� d| �} | �s�n| d�.| �/� �7 } t| �d } | dk�s�zt � | �}W n t0�y } zt1d�| �d} ~ ww t2|�D ] \} }t|�}!|�3||| �}|| |!7 < |du �r$ n�q�q�W n t4�y; | �5� t6|� Y qhw |}qht6|� qhW n t7�ye }" z| �5� |"j8�s[t6| j� W Y d}"~"nd}"~"ww |
�ss|D ]}|�9� �qkt6| j� t:d d � |D �� d| j
_;| j
| j fS ) z�
Parse the POST data and break it into a FILES MultiValueDict and a POST
MultiValueDict.
Return a tuple containing the POST and FILES dictionary, respectively.
r )� QueryDict�r; N� T)�mutable� zRThe number of GET/POST parameters exceeded settings.DATA_UPLOAD_MAX_NUMBER_FIELDS.�content-disposition�namezcontent-transfer-encoding�replace��errors�base64)�sizez;Request body exceeded settings.DATA_UPLOAD_MAX_MEMORY_SIZE.zCThe number of files exceeded settings.DATA_UPLOAD_MAX_NUMBER_FILES.�filenamez content-typer �charsetzcontent-lengthF� � z Could not decode base64 data.c s s � | ]}|� � V qd S �N)�upload_complete)r �handlerr r r � <genexpr>N s � z)MultiPartParser._parse.<locals>.<genexpr>)<� django.httprL r4 r6 r5 r �handle_raw_inputr/ r2 r. �_postrB �
LazyStream� ChunkIterr1 �len�Parser�handle_file_complete� FIELD_TYPESr � DATA_UPLOAD_MAX_NUMBER_FIELDSr �strip�KeyError�
IndexError�AttributeErrorr" r �FIELD�DATA_UPLOAD_MAX_MEMORY_SIZE�readrV � b64decode�binascii�Errorr �
appendlist�FILE� DATA_UPLOAD_MAX_NUMBER_FILESr �sanitize_file_namer) r+ r* �new_filer �join�splitrD r � enumerate�receive_data_chunkr � _close_files�exhaustr
�connection_reset�upload_interrupted�any�_mutable)#r7 rL r; �handlersr^ �result�stream�old_field_name�counters�num_bytes_read�
num_post_keys� num_files� read_size�
uploaded_file� item_type� meta_data� field_stream� disposition�
field_name�transfer_encoding�raw_data�data� file_namer< �content_type_extrarY r? �chunk�stripped_chunk� remaining�
over_chunk�exc�i� chunk_length�er r r rC z s(
��
� �
�
�
�
��
�
��
��� �
��
��
zMultiPartParser._parsec C sJ t | j�D ] \}}|�|| �}|r"| j�t|| jdd�|� dS qdS )zT
Handle all the signaling that takes place when a file is complete.
rS rT N)r{ r6 �
file_completerB rt r r4 )r7 r� r� r� r^ �file_objr r r rg R s ��z$MultiPartParser.handle_file_completec C s6 t �|�}|�d�d }|�d�d }|dv rdS |S )aT
Sanitize the filename of an upload.
Remove all possible path separators, even though that might remove more
than actually required by the target system. Filenames that could
potentially cause problems (current/parent dir) are also discarded.
It should be noted that this function could still return a "filepath"
like "C:some_file.txt" which is handled later on by the storage layer.
So while this function does sanitize filenames to some extent, the
resulting filename should still be considered as untrusted user input.
�/����\> �..r �.N)�html�unescape�rsplit)r7 r� r r r rw ] s
z"MultiPartParser.sanitize_file_namec C s$ | j D ] }t|d�r|j�� qd S )Nr )r6 rE r rG )r7 r^ r r r r} t s
��z MultiPartParser._close_filesr\ ) r r r r rA rK rC rg rw � IE_sanitizer} r r r r r
- s
6 Y r
c @ sT e Zd ZdZddd�Zdd� Zddd�Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dS )rc a!
The LazyStream wrapper allows one to get and "unget" bytes from a stream.
Given a producer object (an iterator that yields bytestrings), the
LazyStream object will support iteration, reading, and keeping a "look-back"
variable in case you need to "unget" some bytes.
Nc C s. || _ d| _d| _|| _d| _|| _g | _dS )z�
Every LazyStream must have a producer when instantiated.
A producer is an iterable that returns a string each time it
is called.
FrZ r N)� _producer�_empty� _leftover�length�position�
_remaining�_unget_history)r7 �producerr� r r r rA � s
zLazyStream.__init__c C s | j S r\ )r� �r7 r r r �tell� s zLazyStream.tellc s � �fdd�}d� |� �S )Nc 3 s� � �d u r� j n�} | d u rd�� �V d S | dkrQ| dks"J d��zt� �}W n
ty2 Y d S w |d | � }� �|| d � � | t|�8 } |V | dksd S d S )NrZ r z0remaining bytes to read should never go negative)r� ry �next�
StopIteration�ungetre )r� r� �emitting�r7 rW r r �parts� s" � � �z LazyStream.read.<locals>.partsrZ )ry )r7 rW r� r r� r rp � s zLazyStream.readc C s: | j r
| j }d| _ nt| j�}g | _| jt|�7 _|S )z�
Used when the exact number of bytes to read is unimportant.
Return whatever chunk is conveniently returned from the iterator.
Useful to avoid unnecessary bookkeeping if performance is an issue.
rZ )r� r� r� r� r� re )r7 �outputr r r �__next__� s
zLazyStream.__next__c C s
g | _ dS )z�
Used to invalidate/disable this lazy stream.
Replace the producer with an empty list. Any leftover bytes that have
already been read will still be reported upon read() and/or next().
N)r� r� r r r rG � s
zLazyStream.closec C � | S r\ r r� r r r �__iter__� � zLazyStream.__iter__c C s8 |sdS | � t|�� | jt|�8 _|| j | _dS )z�
Place bytes back onto the front of the lazy stream.
Future calls to read() will return those bytes first. The
stream position and thus tell() will be rewound.
N)�_update_unget_historyre r� r� )r7 �bytesr r r r� � s
zLazyStream.ungetc sB � g| j dd� | _ t� fdd�| j D ��}|dkr td��dS )aZ
Update the unget history as a sanity check to see if we've pushed
back the same number of bytes in one chunk. If we keep ungetting the
same number of bytes many times (here, 50), we're mostly likely in an
infinite loop of some sort. This is usually caused by a
maliciously-malformed MIME request.
N�1 c s g | ]}|� kr|�qS r r )r �current_number�� num_bytesr r r! � s
�z4LazyStream._update_unget_history.<locals>.<listcomp>�( z�The multipart parser got stuck, which shouldn't happen with normal uploaded files. Check for malicious upload activity; if there is none, report this to the Django developers.)r� re r )r7 r� � number_equalr r� r r� � s ���z LazyStream._update_unget_historyr\ ) r r r r rA r� rp r� rG r� r� r� r r r r rc } s
rc c @ s* e Zd ZdZd
dd�Zdd� Zdd� Zd S ) rd z�
An iterable that will yield chunks of data. Given a file-like object as the
constructor, yield chunks of read operations from that object.
� c C � || _ || _d S r\ )�flor )r7 r� r r r r rA � �
zChunkIter.__init__c C s6 z | j �| j�}W n
ty t� �w |r|S t� �r\ )r� rp r r r� )r7 r� r r r r� � s �zChunkIter.__next__c C r� r\ r r� r r r r� r� zChunkIter.__iter__N)r� )r r r r rA r� r� r r r r rd � s
rd c @ s( e Zd ZdZdd� Zdd� Zdd� ZdS ) �InterBoundaryIterz7
A Producer that will iterate over boundaries.
c C r� r\ )�_streamr. �r7 r� r r r r rA r� zInterBoundaryIter.__init__c C r� r\ r r� r r r r� r� zInterBoundaryIter.__iter__c C s* z
t t| j| j��W S ty t� �w r\ )rc � BoundaryIterr� r. r r� r� r r r r� s
�zInterBoundaryIter.__next__N)r r r r rA r� r� r r r r r� s
r� c @ s0 e Zd ZdZdd� Zdd� Zdd� Zdd � Zd
S ) r� ae
A Producer that is sensitive to boundaries.
Will happily yield bytes until a boundary is found. Will yield the bytes
before the boundary, throw away the boundary bytes themselves, and push the
post-boundary bytes back on the stream.
The future calls to next() after locating the boundary will raise a
StopIteration exception.
c C sF || _ || _d| _t|�d | _| j �d�}|st� �| j �|� d S )NF� rN )r� r. �_donere � _rollbackrp r r� )r7 r� r � unused_charr r r rA % s zBoundaryIter.__init__c C r� r\ r r� r r r r� 4 r� zBoundaryIter.__iter__c
C s� | j rt� �| j}| j}d}g }|D ]}|t|�7 }|�|� ||kr% n|s) nqd| _ |s2t� �d�|�}| �|�}|rT|\}} |�|| d � � d| _ |d |� S |d | � s`d| _ |S |�|| d � � |d | � S )Nr TrZ ) r� r� r� r� re �appendry �_find_boundaryr� )
r7 r� �rollback�
bytes_read�chunksr� r� r �endr� r r r r� 7 s:
�
zBoundaryIter.__next__c C s� |� | j�}|dk r dS |}|t| j� }td|d �}|||d � dkr*|d8 }td|d �}|||d � dkr?|d8 }||fS )a
Find a multipart boundary in data.
Should no boundary exist in the data, return None. Otherwise, return
a tuple containing the indices of the following:
* the end of current encapsulation
* the start of the next encapsulation
r NrN �
�
)�findr. re �max)r7 r� �indexr� r� �lastr r r r� ` s zBoundaryIter._find_boundaryN)r r r r rA r� r� r� r r r r r� s )r� c C s< zt | �}W n ty t| d�}Y nw tj|dd� dS )z Exhaust an iterator or stream.i @ r )�maxlenN)�iterr+ rd � collections�deque)�stream_or_iterable�iteratorr r r r~ y s �r~ c C s� | � |�}|�d�}dd� }|dkr | �|� ti | fS |d|� }| �||d d� � t}i }|�d�D ])}z
||�\} \}
} W n tyK Y q6w | dkrYt}| �d �rYt}|
| f|| < q6|tkri| �|� ||| fS )
zH
Parse one and exactly one stream that encapsulates a boundary.
s
c S sH t | �\}}z
|�dd�\}}W n
ty td| ��w |||ffS )N�:rN zInvalid header: %r)r$ rz r* )�line�main_value_pair�paramsrR �valuer r r �
_parse_header� s � z,parse_boundary_stream.<locals>._parse_headerr� Nr[ s
rQ rX ) rp r� r� �RAWrz r* rn r" ru ) r� �max_header_sizer� �
header_endr� �header�TYPE�outdictr� rR r� r� r r r �parse_boundary_stream� s0
�
r� c @ s e Zd Zdd� Zdd� ZdS )rf c C s || _ d| | _d S )Ns --)r� �
_separatorr� r r r rA � s zParser.__init__c c s* � t | j| j�}|D ]}t|d�V q
d S )Ni )r� r� r� r� )r7 �boundarystream�
sub_streamr r r r� � s
��zParser.__iter__N)r r r rA r� r r r r rf � s rf c C s& t d| �}|�d��� �d�}i }|D ]z}|�d�}|dkr�d}|d|� �� �� �d�}|�d�rB|dd� }|�d �d
krBd }||d d� �� }t|�d
krv|dd � |dd� krdd
krvn n|d d� }|� dd�� dd
�}|r�|�
d �\} }
}t |�� | �� d�}|||< q||fS )z�
Parse the header into a key-value.
Input (line): bytes, output: str for key/name, bytes for values which
will be decoded later.
� ;r r � =FN�*r� � 'rP TrN � "s \\� \s \"rM ) �_parse_header_params�pop�lower�decoder� rj �endswith�countre rS rz r ) r� �plist�key�pdict�pr� � has_encodingrR r� r; �langr r r r$ � s,
4 �r$ c C s� g }| d d� dkrZ| dd � } | � d�}|dkr7| �dd|�d r7| � d|d �}|dkr7| �dd|�d s"|dk r?t| �}| d |� }|�|�� � | |d � } | d d� dks
|S )NrN r� r r� rP )r� r re r� rj )�sr r� �fr r r r� � s
� �
r� )*r rV rr r' r� r� � urllib.parser � django.confr �django.core.exceptionsr r r r � django.core.files.uploadhandlerr r r
�django.utils.datastructuresr �django.utils.encodingr �__all__rD r r r� ru rn � frozensetrh r
rc rd r� r� r~ r� rf r$ r� r r r r �<module> s> Rs` ;