Ticket #1953: test_safemultipart.py

"""Tests the SafeMultipartFilter for handling dodgy multipart requests."""

from turbogears import config, controllers, expose, testutil
from webtest import TestRequest

class TestRoot(controllers.RootController):

    @expose()
    def flashupload(self, filedata, upload, filename):
        return dict(
            filedata = filedata.file.read(),
            filename = filename,
            upload = upload,
        )

class SafeMultipartFilterTest(testutil.TGTest):

    def setUp(self):
        config.update({
            '/flashupload': {
                'safempfilter.on': True
            }
        })
        self.root = TestRoot
        super(SafeMultipartFilterTest, self).setUp()

    def test_flash_upload(self):
        """SafeMultipartFilter correctly handles file uploads from Flash client
        """
        headers = [
            ('Accept', 'text/*'),
            ('Content-Type', 'multipart/form-data; '
                 'boundary=----------KM7Ij5cH2KM7Ef1gL6ae0ae0cH2gL6'),
            ('User-Agent', 'Shockwave Flash'),
            ('Host', 'www.example.com:8080'),
            ('Content-Length', '499'),
            ('Connection', 'Keep-Alive'),
            ('Cache-Control', 'no-cache'),
            ]
        filedata = ('<?xml version="1.0" encoding="UTF-8"?>\r\n'
                    '<projectDescription>\r\n'
                    '</projectDescription>\r\n')
        body = (
            '------------KM7Ij5cH2KM7Ef1gL6ae0ae0cH2gL6\r\n'
            'Content-Disposition: form-data; name="filename"\r\n'
            '\r\n'
            '.project\r\n'
            '------------KM7Ij5cH2KM7Ef1gL6ae0ae0cH2gL6\r\n'
            'Content-Disposition: form-data; '
                'name="filedata"; filename=".project"\r\n'
            'Content-Type: application/octet-stream\r\n'
            '\r\n'
            + filedata +
            '\r\n'
            '------------KM7Ij5cH2KM7Ef1gL6ae0ae0cH2gL6\r\n'
            'Content-Disposition: form-data; name="upload"\r\n'
            '\r\n'
            'Submit Query\r\n'
            # Flash apps omit the trailing \r\n on the last line:
            '------------KM7Ij5cH2KM7Ef1gL6ae0ae0cH2gL6--'
            )
        environ = self.app._make_environ(dict(REQUEST_METHOD='POST'))
        req = TestRequest.blank('/flashupload', environ)
        req.headers.update(dict(headers))
        req.body = body
        print repr(str(req))
        response = self.app.do_request(req, 200, True)
        print response
        assert response.raw['upload'] == 'Submit Query'
        assert response.raw['filename'] == '.project'
        assert response.raw['filedata'] == filedata