classification
Title: cgi.py invalid REQUEST_METHOD set
Type: behavior Stage: test needed
Components: Library (Lib) Versions: Python 2.6
process
Status: closed Resolution: works for me
Dependencies: Superseder:
Assigned To: loewis Nosy List: ajaksu2, georg.brandl, jimjjewett, joesalmeri, loewis, sf-robot
Priority: normal Keywords: easy, patch

Created on 2005-03-08 16:04 by joesalmeri, last changed 2009-04-05 17:49 by georg.brandl. This issue is now closed.

Files
File name Uploaded Description Edit
cdif joesalmeri, 2005-03-08 16:04 context diff for cgi.py
Messages (9)
msg47894 - (view) Author: Joe (joesalmeri) Date: 2005-03-08 16:04
Python Version 2.4
OS Windows XP SP 2 + WindowsUpdates
Patch for lastest CVS Tree

When the environment does not have a correctly set 
REQUEST_METHOD cgi.py prompts
for key=value pairs by reading from sys.stdin.  After the 
values are read from sys.stdin they are never stored in 
the FieldStorage.list attribute like they are
when the FieldStorage.read_urlencoded or 
FieldStorage.read_multi methods are called.

This causes a problem when FieldStorage.keys() is 
called because although the values were read from 
sys.stdin they were never stored in FieldStorage.list.

Although you could argue that REQUEST_METHOD 
should have been set correctly in the first place, it still 
seems like if cgi.py is going to handle that situation by
actually reading the values from sys.stdin it should 
store them too.

This fix stores the values read.
msg47895 - (view) Author: Jim Jewett (jimjjewett) Date: 2005-03-14 22:54
Logged In: YES 
user_id=764593

+1 on supporting use without a REQUEST_METHOD, if only 
to match Perl on "what happens if my .cgi was called straight 
from the command line"?
 
msg47896 - (view) Author: Martin v. Löwis (loewis) * (Python committer) Date: 2007-03-06 13:23
I must be completely missing the point of this patch. 

Where in the code does it currently prompt for key=value pairs if REQUEST_METHOD is not correctly set?

By "not correctly set", do you mean "not set" or "set incorrectly"? If the latter, to what value?

You seem to be modifying the read_single function. This is meant to read a single body of the CGI request (as sent by the HTTP client), not the key-value-pairs.

I've tried to come up with a demo application of this new functionality, but failed: I couldn't make this new code do anything useful. What Python script should I use, how should I invoke it, what environment variables should I give, and what standard input?

Tentatively rejecting the patch.
msg47897 - (view) Author: SourceForge Robot (sf-robot) Date: 2007-03-21 02:20
This Tracker item was closed automatically by the system. It was
previously set to a Pending status, and the original submitter
did not respond within 14 days (the time period specified by
the administrator of this Tracker).
msg47898 - (view) Author: Joe (joesalmeri) Date: 2007-04-02 13:54
It been a long time since I submitted this patch but I meant that REQUEST_METHOD is not set although I believe it also happens when it is set incorrectly.

Regarding your question with the prompting I thought I explained that in the original post but here are more details:

When the REQUEST_METHOD is not set the __init__ method for the FieldStorage class ends up setting the self.fp to sys.stdin.

When the read_single method is called it calls self.read_lines().  Since self.fp is equal to sys.stdin at that point and since there is not input pending on stdin it ends up prompting for input until it reaches EOF.

The bug was that although it prompted for input by reading from sys.stdin, the values that it read were never stored in FieldStorage like they are when the values are read from the normal sources.  

Since someone went to the trouble of coding cgi.py to read the values from stdin when the REQUEST_METHOD was invalid it seems to make sense to store them.

As jimjjewett point out this addresses the issue of allowing a cgi script to be called from the command line which is useful for debugging of if no web server is running.

Since it is counter-intuitive to read the values or not store them the other option would be not to set self.fp = sys.stdin and instead through an error that REQUEST_METHOD was not set properly however, it seems more benefitial to read from sys.stdin and then store the values read in FieldStorage.

Does that make more sense now?

Thanks.










msg47899 - (view) Author: Joe (joesalmeri) Date: 2007-04-02 14:14
Test Script that shows problem:

# Start of Script
import cgi
import os

os.environ['REQUEST_METHOD'] = 'cgi'

field = cgi.FieldStorage()

print field
print field.keys()

for k in field.keys():
    print k, field[k]

# End Of Script

When you run that script it will hang because it is waiting on the read from self.fp (sys.stdin), press ctrl-z (EOF) on Windows and hit enter (or you could enter some key/value pairs but they are not stored in FieldStorage).

cgi.py will then fail as follows:

^Z
FieldStorage(None, None, '')
Traceback (most recent call last):
  File "Q:\cgifix\FixTest\t2.py", line 9, in ?
    print field.keys()
  File "P:\SW\Python\lib\cgi.py", line 601, in keys
    raise TypeError, "not indexable"
TypeError: not indexable

Now modify the above script to use the NEW cgi.py I provided.
When prompted for the values on sys.stdin enter your pairs
enter the following (press enter after each line)

a=1
b=2
c=3

now press ctrl-z (EOF) and enter and you will see that cgi.py has been patch to fix the bug.

FieldStorage(None, None, 'a=1\nb=2\nc=3\n')
['a', 'b', 'c']
a MiniFieldStorage('a', '1')
b MiniFieldStorage('b', '2')
c MiniFieldStorage('c', '3')

I hope that makes the problem and solution more clear so that this can be included in the next release.

Thanks!



msg47900 - (view) Author: Joe (joesalmeri) Date: 2007-05-02 16:12
Was the test script sufficient or did you need any more information?
msg82184 - (view) Author: Daniel Diniz (ajaksu2) Date: 2009-02-15 23:38
Confirmed in trunk.
msg85538 - (view) Author: Georg Brandl (georg.brandl) * (Python committer) Date: 2009-04-05 17:49
Turns out this is caused by setting REQUEST_METHOD to 'cgi', which is
completely unmotivated.  Not doing this lets the example script work fine.
History
Date User Action Args
2009-04-05 17:49:41georg.brandlsetstatus: open -> closed

nosy: + georg.brandl
messages: + msg85538

resolution: works for me
2009-02-15 23:38:52ajaksu2setversions: + Python 2.6, - Python 2.4
nosy: + ajaksu2
messages: + msg82184
keywords: + easy
type: behavior
stage: test needed
2005-03-08 16:04:12joesalmericreate