Repository: LadybirdBrowser/ladybird
File: Tests/LibWeb/Fixtures/http-test-server.py (Python)

Code before:
    def __init__(self, *arguments, **kwargs):
        super().__init__(*arguments, directory=self.static_directory, **kwargs)

    def end_headers(self):
        if hasattr(self, "_extra_headers"):
            for key, value in self._extra_headers.items():
                self.send_header(key, value)
            del self._extra_headers
        super().end_headers()

    def do_GET(self):
        if self.path.startswith("/static/"):
            # Remove "/static/" prefix and use built-in method
            self.path = self.path[7:]

            # Check for a .headers file alongside the requested file
            file_path = self.translate_path(self.path)
            headers_path = file_path + ".headers"
            if os.path.isfile(headers_path):
                self._extra_headers = {}
                with open(headers_path) as f:
                    for line in f:
                        line = line.strip()
                        if ":" in line:
                            key, _, value = line.partition(":")
                            self._extra_headers[key.strip()] = value.strip()

            return super().do_GET()
        else:
            self.handle_echo()

    def do_POST(self):
        if self.path == "/echo":
            content_length = int(self.headers["Content-Length"])
            post_data = self.rfile.read(content_length)
            data = json.loads(post_data.decode("utf-8"))

            echo = Echo()
            echo.method = data.get("method", None)
            echo.path = data.get("path", None)
            echo.status = data.get("status", None)
            echo.body = data.get("body", None)
            echo.delay_ms = data.get("delay_ms", None)
            echo.headers = data.get("headers", {})
            echo.reason_phrase = data.get("reason_phrase", None)
            echo.reflect_headers_in_body = data.get("reflect_headers_in_body", False)

            is_using_reserved_path = echo.path.startswith("/static") or echo.path.startswith("/echo")

            # Return 400: Bad Request if invalid params are given or a reserved path is given
            if (

Review comment (security):
How does this handle `.headers` files that have multiple headers with the same name (for example: `content-security-policy/generic/no-default-src.sub.html.sub.headers`)?

Code after:
    def __init__(self, *arguments, **kwargs):
        super().__init__(*arguments, directory=self.static_directory, **kwargs)

    def end_headers(self):
        if hasattr(self, "_extra_headers"):
            for key, value in self._extra_headers:
                self.send_header(key, value)
            del self._extra_headers
        super().end_headers()

    def do_GET(self):
        if self.path.startswith("/static/"):
            # Remove "/static/" prefix and use built-in method
            self.path = self.path[7:]

            # Check for a .headers file alongside the requested file
            file_path = self.translate_path(self.path)
            headers_path = file_path + ".headers"
            if os.path.isfile(headers_path):
                self._extra_headers = []
                with open(headers_path) as f:
                    for line in f:
                        line = line.strip()
                        if ":" in line:
                            key, _, value = line.partition(":")
                            self._extra_headers.append((key.strip(), value.strip()))

            return super().do_GET()
        else:
            self.handle_echo()

    def do_POST(self):
        if self.path == "/echo":
            content_length = int(self.headers["Content-Length"])
            post_data = self.rfile.read(content_length)
            data = json.loads(post_data.decode("utf-8"))

            echo = Echo()
            echo.method = data.get("method", None)
            echo.path = data.get("path", None)
            echo.status = data.get("status", None)
            echo.body = data.get("body", None)
            echo.delay_ms = data.get("delay_ms", None)
            echo.headers = data.get("headers", {})
            echo.reason_phrase = data.get("reason_phrase", None)
            echo.reflect_headers_in_body = data.get("reflect_headers_in_body", False)

            is_using_reserved_path = echo.path.startswith("/static") or echo.path.startswith("/echo")

            # Return 400: Bad Request if invalid params are given or a reserved path is given
            if (