Repository: AspenWeb/pando.py

Issue:
Requests for static files should return a 405 if method is unsafe
Reticketing from <https://github.com/AspenWeb/aspen.py/issues/50>.

Any request for a static file with a method other than `GET` or `HEAD` should be rejected with a 405.

Discussion:

Patch:
diff --git a/pando/state_chain.py b/pando/state_chain.py
index 9fb57a43..f7e60513 100644
--- a/pando/state_chain.py
+++ b/pando/state_chain.py
@@ -27,7 +27,7 @@ import traceback
 
 from aspen import resources
 from aspen.exceptions import NotFound, Redirect, UnindexedDirectory
-from aspen.http.resource import NegotiationFailure
+from aspen.http.resource import Static, NegotiationFailure
 from aspen.request_processor.dispatcher import DispatchResult, DispatchStatus
 from first import first as _first
 
@@ -108,21 +108,26 @@ def create_response_object(state):
     state.setdefault('response', Response())
 
 
-@_import_from('aspen.request_processor.algorithm')
-def render_resource():
-    pass
-
-
-def fill_response_with_output(output, response, request_processor):
-    if not isinstance(output.body, bytes):
-        output.charset = request_processor.encode_output_as
-        output.body = output.body.encode(output.charset)
-    response.body = output.body
+def render_response(state, resource, response, request_processor):
+    if isinstance(resource, Static):
+        if state['request'].method == 'GET':
+            response.body = resource.raw
+        elif state['request'].method == 'HEAD':
+            response.headers[b'Content-Length'] = str(len(resource.raw)).encode('ascii')
+        else:
+            raise Response(405)
+        media_type, charset = resource.media_type, resource.charset
+    else:
+        output = resource.render(state)
+        if not isinstance(output.body, bytes):
+            output.charset = request_processor.encode_output_as
+            output.body = output.body.encode(output.charset)
+        media_type, charset = output.media_type, output.charset
+        response.body = output.body
     if b'Content-Type' not in response.headers:
-        ct = output.media_type
-        if output.charset:
-            ct += '; charset=' + output.charset
-        response.headers[b'Content-Type'] = ct.encode('ascii')
+        if charset:
+            media_type += '; charset=' + charset
+        response.headers[b'Content-Type'] = media_type.encode('ascii')
 
 
 def get_response_for_exception(website, exception):
@@ -185,8 +190,7 @@ def delegate_error_to_simplate(website, state, response, request=None, resource=
         wanted += ',text/plain;q=0.2,*/*;q=0.1'
         state['accept_header'] = wanted.lstrip(',')
 
-        output = resource.render(state)
-        fill_response_with_output(output, response, website.request_processor)
+        render_response(state, resource, response, website.request_processor)
 
 
 def log_traceback_for_exception(website, exception):


Test patch:
diff --git a/tests/test_website_flow.py b/tests/test_website_flow.py
index 0916e3c5..1d5d9966 100644
--- a/tests/test_website_flow.py
+++ b/tests/test_website_flow.py
@@ -46,3 +46,30 @@ def test_early_failures_dont_break_everything(harness):
         assert harness.client.GET("/", raise_immediately=False).code == 400
     finally:
         Request.from_wsgi = old_from_wsgi
+
+
+def test_static_resource_GET(harness):
+    harness.fs.www.mk(('file.js', "Hello world!"))
+    r = harness.client.GET('/file.js')
+    assert r.code == 200
+    assert r.body == b"Hello world!"
+
+
+def test_static_resource_HEAD(harness):
+    harness.fs.www.mk(('file.js', "Hello world!"))
+    r = harness.client.HEAD('/file.js')
+    assert r.code == 200
+    assert not r.body
+    assert r.headers[b'Content-Length'] == b'12'
+
+
+def test_static_resource_PUT(harness):
+    harness.fs.www.mk(('file.js', "Hello world!"))
+    r = harness.client.PxT('/file.js', body=b'Malicious JS code.')
+    assert r.code == 405
+
+
+def test_static_resource_unknown_method(harness):
+    harness.fs.www.mk(('file.js', "Hello world!"))
+    r = harness.client.hxt('UNKNOWN', '/file.js')
+    assert r.code == 405