/** * Test validation of the User-Agent header we use to perform test requests. */ public function testUserAgentValidation() { global $base_url; // Logout the user which was logged in during test-setup. $this->drupalLogout(); $system_path = $base_url . '/' . drupal_get_path('module', 'system'); $HTTP_path = $system_path . '/tests/http.php/user/login'; $https_path = $system_path . '/tests/https.php/user/login'; // Generate a valid simpletest User-Agent to pass validation. $this->assertTrue(preg_match('/simpletest\\d+/', $this->databasePrefix, $matches), 'Database prefix contains simpletest prefix.'); $test_ua = drupal_generate_test_ua($matches[0]); $this->additionalCurlOptions = array(CURLOPT_USERAGENT => $test_ua); // Test pages only available for testing. $this->drupalGet($HTTP_path); $this->assertResponse(200, 'Requesting http.php with a legitimate simpletest User-Agent returns OK.'); $this->drupalGet($https_path); $this->assertResponse(200, 'Requesting https.php with a legitimate simpletest User-Agent returns OK.'); // Now slightly modify the HMAC on the header, which should not validate. $this->additionalCurlOptions = array(CURLOPT_USERAGENT => $test_ua . 'X'); $this->drupalGet($HTTP_path); $this->assertResponse(403, 'Requesting http.php with a bad simpletest User-Agent fails.'); $this->drupalGet($https_path); $this->assertResponse(403, 'Requesting https.php with a bad simpletest User-Agent fails.'); // Use a real User-Agent and verify that the special files http.php and // https.php can't be accessed. $this->additionalCurlOptions = array(CURLOPT_USERAGENT => 'Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12'); $this->drupalGet($HTTP_path); $this->assertResponse(403, 'Requesting http.php with a normal User-Agent fails.'); $this->drupalGet($https_path); $this->assertResponse(403, 'Requesting https.php with a normal User-Agent fails.'); }
/** * Event callback for the 'before' event */ public function onBeforeSendRequest(BeforeEvent $event) { // If the database prefix is being used by SimpleTest to run the tests in a copied // database then set the user-agent header to the database prefix so that any // calls to other Drupal pages will run the SimpleTest prefixed database. The // user-agent is used to ensure that multiple testing sessions running at the // same time won't interfere with each other as they would if the database // prefix were stored statically in a file or database variable. if ($test_prefix = drupal_valid_test_ua()) { $event->getRequest()->setHeader('User-Agent', drupal_generate_test_ua($test_prefix)); } }
/** * {@inheritdoc} * * HTTP middleware that replaces the user agent for simpletest requests. */ public function __invoke() { // If the database prefix is being used by SimpleTest to run the tests in a copied // database then set the user-agent header to the database prefix so that any // calls to other Drupal pages will run the SimpleTest prefixed database. The // user-agent is used to ensure that multiple testing sessions running at the // same time won't interfere with each other as they would if the database // prefix were stored statically in a file or database variable. return function ($handler) { return function (RequestInterface $request, array $options) use($handler) { if ($test_prefix = drupal_valid_test_ua()) { $request = $request->withHeader('User-Agent', drupal_generate_test_ua($test_prefix)); } return $handler($request, $options); }; }; }
/** * {@inheritdoc} * * HTTP middleware that replaces the user agent for simpletest requests. */ public function __invoke() { // If the database prefix is being used by SimpleTest to run the tests in a copied // database then set the user-agent header to the database prefix so that any // calls to other Drupal pages will run the SimpleTest prefixed database. The // user-agent is used to ensure that multiple testing sessions running at the // same time won't interfere with each other as they would if the database // prefix were stored statically in a file or database variable. return function ($handler) { return function (RequestInterface $request, array $options) use($handler) { if ($test_prefix = drupal_valid_test_ua()) { $request = $request->withHeader('User-Agent', drupal_generate_test_ua($test_prefix)); } return $handler($request, $options)->then(function (ResponseInterface $response) use($request) { if (!drupal_valid_test_ua()) { return $response; } $headers = $response->getHeaders(); foreach ($headers as $header_name => $header_values) { if (preg_match('/^X-Drupal-Assertion-[0-9]+$/', $header_name, $matches)) { foreach ($header_values as $header_value) { // Call \Drupal\simpletest\WebTestBase::error() with the parameters from // the header. $parameters = unserialize(urldecode($header_value)); if (count($parameters) === 3) { throw new \Exception($parameters[1] . ': ' . $parameters[0] . "\n" . Error::formatBacktrace([$parameters[2]])); } else { throw new \Exception('Error thrown with the wrong amount of parameters.'); } } } } return $response; }); }; }; }
/** * Initializes the cURL connection. * * If the simpletest_httpauth_credentials variable is set, this function will * add HTTP authentication headers. This is necessary for testing sites that * are protected by login credentials from public access. * See the description of $curl_options for other options. */ protected function curlInitialize() { global $base_url; if (!isset($this->curlHandle)) { $this->curlHandle = curl_init(); // Some versions/configurations of cURL break on a NULL cookie jar, so // supply a real file. if (empty($this->cookieFile)) { $this->cookieFile = $this->publicFilesDirectory . '/cookie.jar'; } $curl_options = array(CURLOPT_COOKIEJAR => $this->cookieFile, CURLOPT_URL => $base_url, CURLOPT_FOLLOWLOCATION => FALSE, CURLOPT_RETURNTRANSFER => TRUE, CURLOPT_SSL_VERIFYPEER => FALSE, CURLOPT_SSL_VERIFYHOST => FALSE, CURLOPT_HEADERFUNCTION => array(&$this, 'curlHeaderCallback'), CURLOPT_USERAGENT => $this->databasePrefix, CURLOPT_SAFE_UPLOAD => TRUE); if (isset($this->httpAuthCredentials)) { $curl_options[CURLOPT_HTTPAUTH] = $this->httpAuthMethod; $curl_options[CURLOPT_USERPWD] = $this->httpAuthCredentials; } // curl_setopt_array() returns FALSE if any of the specified options // cannot be set, and stops processing any further options. $result = curl_setopt_array($this->curlHandle, $this->additionalCurlOptions + $curl_options); if (!$result) { throw new \UnexpectedValueException('One or more cURL options could not be set.'); } } // We set the user agent header on each request so as to use the current // time and a new uniqid. if (preg_match('/simpletest\\d+/', $this->databasePrefix, $matches)) { curl_setopt($this->curlHandle, CURLOPT_USERAGENT, drupal_generate_test_ua($matches[0])); } }
/** * Prepare for a request to testing site. * * The testing site is protected via a SIMPLETEST_USER_AGENT cookie that is * checked by drupal_valid_test_ua(). * * @see drupal_valid_test_ua() */ protected function prepareRequest() { $session = $this->getSession(); $session->setCookie('SIMPLETEST_USER_AGENT', drupal_generate_test_ua($this->databasePrefix)); }
/** * Overrides Drupal core HTTP request function with Guzzle. * * @see drupal_http_request() */ function bangpound_drupal_http_request($url, array $options = array()) { $result = new stdClass(); // Parse the URL and make sure we can handle the schema. $uri = @parse_url($url); if ($uri == FALSE) { $result->error = 'unable to parse URL'; $result->code = -1001; return $result; } if (!isset($uri['scheme'])) { $result->error = 'missing schema'; $result->code = -1002; return $result; } timer_start(__FUNCTION__); // Merge the default options. $options += array('headers' => array(), 'method' => 'GET', 'data' => NULL, 'max_redirects' => 3, 'timeout' => 30.0, 'context' => NULL); // Merge the default headers. $options['headers'] += array('User-Agent' => 'Drupal (+http://drupal.org/)'); // Concessions to Guzzle. if (isset($options['data'])) { $options['body'] = $options['data']; } if (!$options['max_redirects']) { $options['allow_redirects'] = FALSE; } // Use a proxy if one is defined and the host is not on the excluded list. $proxy_server = variable_get('proxy_server', ''); if ($proxy_server && _drupal_http_use_proxy($uri['host'])) { // Set the scheme so we open a socket to the proxy server. $uri['scheme'] = 'proxy'; // Set the path to be the full URL. $uri['path'] = $url; // Since the URL is passed as the path, we won't use the parsed query. unset($uri['query']); // Add in username and password to Proxy-Authorization header if needed. if ($proxy_username = variable_get('proxy_username', '')) { $proxy_password = variable_get('proxy_password', ''); $options['headers']['Proxy-Authorization'] = 'Basic ' . base64_encode($proxy_username . (!empty($proxy_password) ? ":" . $proxy_password : '')); } // Some proxies reject requests with any User-Agent headers, while others // require a specific one. $proxy_user_agent = variable_get('proxy_user_agent', ''); // The default value matches neither condition. if ($proxy_user_agent === NULL) { unset($options['headers']['User-Agent']); } elseif ($proxy_user_agent) { $options['headers']['User-Agent'] = $proxy_user_agent; } } // Make sure the socket opened properly. // @todo Migrate error checking. // If the server URL has a user then attempt to use basic authentication. // @todo Migrate authentication. // If the database prefix is being used by SimpleTest to run the tests in a copied // database then set the user-agent header to the database prefix so that any // calls to other Drupal pages will run the SimpleTest prefixed database. The // user-agent is used to ensure that multiple testing sessions running at the // same time won't interfere with each other as they would if the database // prefix were stored statically in a file or database variable. $test_info =& $GLOBALS['drupal_test_info']; if (!empty($test_info['test_run_id'])) { $options['headers']['User-Agent'] = drupal_generate_test_ua($test_info['test_run_id']); } // Calculate how much time is left of the original timeout value. $timeout = $options['timeout'] - timer_read(__FUNCTION__) / 1000; if ($timeout > 0) { /** @see \Guzzle\Http\StaticClient::request() */ static $client; if (!$client) { $client = new \Guzzle\Http\Client(); } $request = $client->createRequest($options['method'], $url, null, null, $options); if ($options['max_redirects']) { $client->getConfig()->set('redirect.max', $options['max_redirects']); } if (isset($options['stream'])) { if ($options['stream'] instanceof \Guzzle\Stream\StreamRequestFactoryInterface) { $response = $options['stream']->fromRequest($request); } elseif ($options['stream'] == true) { $streamFactory = new \Guzzle\Stream\PhpStreamRequestFactory(); $response = $streamFactory->fromRequest($request); } } else { $response = $request->send(); } $result->request = $request->__toString(); } else { $result->code = HTTP_REQUEST_TIMEOUT; $result->error = 'request timed out'; return $result; } if (isset($response)) { // Parse response headers from the response body. // Be tolerant of malformed HTTP responses that separate header and body with // \n\n or \r\r instead of \r\n\r\n. $result->data = $response->getBody(true); // Parse the response status line. $result->protocol = $response->getProtocol() . '/' . $response->getProtocolVersion(); $result->status_message = $response->getReasonPhrase(); $result->headers = array_map(function ($input) { return (string) $input; }, $response->getHeaders()->getAll()); $result->code = $response->getStatusCode(); switch ($result->code) { case 200: // OK // OK case 304: // Not modified break; case 301: // Moved permanently // Moved permanently case 302: // Moved temporarily // Moved temporarily case 307: // Moved temporarily // $result->redirect_code = $code; // $result->redirect_url = $location; break; default: $result->error = $response->getReasonPhrase(); } } return $result; }
/** * Initializes the cURL connection. * * If the simpletest_httpauth_credentials variable is set, this function will * add HTTP authentication headers. This is necessary for testing sites that * are protected by login credentials from public access. * See the description of $curl_options for other options. */ protected function curlInitialize() { global $base_url; if (!isset($this->curlHandle)) { $this->curlHandle = curl_init(); $curl_options = array(CURLOPT_COOKIEJAR => $this->cookieFile, CURLOPT_URL => $base_url, CURLOPT_FOLLOWLOCATION => FALSE, CURLOPT_RETURNTRANSFER => TRUE, CURLOPT_SSL_VERIFYPEER => FALSE, CURLOPT_SSL_VERIFYHOST => FALSE, CURLOPT_HEADERFUNCTION => array(&$this, 'curlHeaderCallback'), CURLOPT_USERAGENT => $this->databasePrefix); if (isset($this->httpauth_credentials)) { $curl_options[CURLOPT_HTTPAUTH] = $this->httpauth_method; $curl_options[CURLOPT_USERPWD] = $this->httpauth_credentials; } curl_setopt_array($this->curlHandle, $this->additionalCurlOptions + $curl_options); // By default, the child session name should be the same as the parent. $this->session_name = session_name(); } // We set the user agent header on each request so as to use the current // time and a new uniqid. if (preg_match('/simpletest\\d+/', $this->databasePrefix, $matches)) { curl_setopt($this->curlHandle, CURLOPT_USERAGENT, drupal_generate_test_ua($matches[0])); } }
/** * Performs an HTTP request. * * This is a flexible and powerful HTTP client implementation. Correctly * handles GET, POST, PUT or any other HTTP requests. Handles redirects. * * @param $url * A string containing a fully qualified URI. * @param array $options * (optional) An array that can have one or more of the following elements: * - headers: An array containing request headers to send as name/value pairs. * - method: A string containing the request method. Defaults to 'GET'. * - data: A string containing the request body, formatted as * 'param=value¶m=value&...'. Defaults to NULL. * - max_redirects: An integer representing how many times a redirect * may be followed. Defaults to 3. * - timeout: A float representing the maximum number of seconds the function * call may take. The default is 30 seconds. If a timeout occurs, the error * code is set to the HTTP_REQUEST_TIMEOUT constant. * - context: A context resource created with stream_context_create(). * * @return object * An object that can have one or more of the following components: * - request: A string containing the request body that was sent. * - code: An integer containing the response status code, or the error code * if an error occurred. * - protocol: The response protocol (e.g. HTTP/1.1 or HTTP/1.0). * - status_message: The status message from the response, if a response was * received. * - redirect_code: If redirected, an integer containing the initial response * status code. * - redirect_url: If redirected, a string containing the URL of the redirect * target. * - error: If an error occurred, the error message. Otherwise not set. * - headers: An array containing the response headers as name/value pairs. * HTTP header names are case-insensitive (RFC 2616, section 4.2), so for * easy access the array keys are returned in lower case. * - data: A string containing the response body that was received. */ public static function _bim_http_request($url, array $options = array()) { $result = new stdClass(); // Parse the URL and make sure we can handle the schema. $uri = @parse_url($url); if ($uri == FALSE) { $result->error = 'unable to parse URL'; $result->code = -1001; return $result; } if (!isset($uri['scheme'])) { $result->error = 'missing schema'; $result->code = -1002; return $result; } bimserverJsonConnector::timer_start(__FUNCTION__); // Merge the default options. $options += array('headers' => array(), 'method' => 'GET', 'data' => NULL, 'max_redirects' => 3, 'timeout' => 30.0, 'context' => NULL); // Merge the default headers. $options['headers'] += array('User-Agent' => 'Drupal (+http://drupal.org/)'); // stream_socket_client() requires timeout to be a float. $options['timeout'] = (double) $options['timeout']; // Use a proxy if one is defined and the host is not on the excluded list. $proxy_server = variable_get('proxy_server', ''); if ($proxy_server && _drupal_http_use_proxy($uri['host'])) { // Set the scheme so we open a socket to the proxy server. $uri['scheme'] = 'proxy'; // Set the path to be the full URL. $uri['path'] = $url; // Since the URL is passed as the path, we won't use the parsed query. unset($uri['query']); // Add in username and password to Proxy-Authorization header if needed. if ($proxy_username = variable_get('proxy_username', '')) { $proxy_password = variable_get('proxy_password', ''); $options['headers']['Proxy-Authorization'] = 'Basic ' . base64_encode($proxy_username . (!empty($proxy_password) ? ":" . $proxy_password : '')); } // Some proxies reject requests with any User-Agent headers, while others // require a specific one. $proxy_user_agent = variable_get('proxy_user_agent', ''); // The default value matches neither condition. if ($proxy_user_agent === NULL) { unset($options['headers']['User-Agent']); } elseif ($proxy_user_agent) { $options['headers']['User-Agent'] = $proxy_user_agent; } } switch ($uri['scheme']) { case 'proxy': // Make the socket connection to a proxy server. $socket = 'tcp://' . $proxy_server . ':' . variable_get('proxy_port', 8080); // The Host header still needs to match the real request. $options['headers']['Host'] = $uri['host']; $options['headers']['Host'] .= isset($uri['port']) && $uri['port'] != 80 ? ':' . $uri['port'] : ''; break; case 'http': case 'feed': $port = isset($uri['port']) ? $uri['port'] : 80; $socket = 'tcp://' . $uri['host'] . ':' . $port; // RFC 2616: "non-standard ports MUST, default ports MAY be included". // We don't add the standard port to prevent from breaking rewrite rules // checking the host that do not take into account the port number. $options['headers']['Host'] = $uri['host'] . ($port != 80 ? ':' . $port : ''); break; case 'https': // Note: Only works when PHP is compiled with OpenSSL support. $port = isset($uri['port']) ? $uri['port'] : 443; $socket = 'ssl://' . $uri['host'] . ':' . $port; $options['headers']['Host'] = $uri['host'] . ($port != 443 ? ':' . $port : ''); break; default: $result->error = 'invalid schema ' . $uri['scheme']; $result->code = -1003; return $result; } if (empty($options['context'])) { $fp = @stream_socket_client($socket, $errno, $errstr, $options['timeout']); } else { // Create a stream with context. Allows verification of a SSL certificate. $fp = @stream_socket_client($socket, $errno, $errstr, $options['timeout'], STREAM_CLIENT_CONNECT, $options['context']); } // Make sure the socket opened properly. if (!$fp) { // When a network error occurs, we use a negative number so it does not // clash with the HTTP status codes. $result->code = -$errno; $result->error = trim($errstr) ? trim($errstr) : t('Error opening socket @socket', array('@socket' => $socket)); // Mark that this request failed. This will trigger a check of the web // server's ability to make outgoing HTTP requests the next time that // requirements checking is performed. // See system_requirements(). //variable_set('_bim_http_request_fails', TRUE); return $result; } // Construct the path to act on. $path = isset($uri['path']) ? $uri['path'] : '/'; if (isset($uri['query'])) { $path .= '?' . $uri['query']; } // Only add Content-Length if we actually have any content or if it is a POST // or PUT request. Some non-standard servers get confused by Content-Length in // at least HEAD/GET requests, and Squid always requires Content-Length in // POST/PUT requests. $content_length = strlen($options['data']); if ($content_length > 0 || $options['method'] == 'POST' || $options['method'] == 'PUT') { $options['headers']['Content-Length'] = $content_length; } // If the server URL has a user then attempt to use basic authentication. if (isset($uri['user'])) { $options['headers']['Authorization'] = 'Basic ' . base64_encode($uri['user'] . (isset($uri['pass']) ? ':' . $uri['pass'] : '******')); } // If the database prefix is being used by SimpleTest to run the tests in a copied // database then set the user-agent header to the database prefix so that any // calls to other Drupal pages will run the SimpleTest prefixed database. The // user-agent is used to ensure that multiple testing sessions running at the // same time won't interfere with each other as they would if the database // prefix were stored statically in a file or database variable. $test_info =& $GLOBALS['drupal_test_info']; if (!empty($test_info['test_run_id'])) { $options['headers']['User-Agent'] = drupal_generate_test_ua($test_info['test_run_id']); } $request = $options['method'] . ' ' . $path . " HTTP/1.0\r\n"; foreach ($options['headers'] as $name => $value) { $request .= $name . ': ' . trim($value) . "\r\n"; } $request .= "\r\n" . $options['data']; $result->request = $request; // Calculate how much time is left of the original timeout value. $timeout = $options['timeout'] - bimserverJsonConnector::timer_read(__FUNCTION__) / 1000; if ($timeout > 0) { stream_set_timeout($fp, floor($timeout), floor(1000000 * fmod($timeout, 1))); fwrite($fp, $request); } // Fetch response. Due to PHP bugs like http://bugs.php.net/bug.php?id=43782 // and http://bugs.php.net/bug.php?id=46049 we can't rely on feof(), but // instead must invoke stream_get_meta_data() each iteration. $info = stream_get_meta_data($fp); $alive = !$info['eof'] && !$info['timed_out']; $response = ''; while ($alive) { // Calculate how much time is left of the original timeout value. $timeout = $options['timeout'] - bimserverJsonConnector::timer_read(__FUNCTION__) / 1000; if ($timeout <= 0) { $info['timed_out'] = TRUE; break; } stream_set_timeout($fp, floor($timeout), floor(1000000 * fmod($timeout, 1))); $chunk = fread($fp, 1024); $response .= $chunk; $info = stream_get_meta_data($fp); $alive = !$info['eof'] && !$info['timed_out'] && $chunk; } fclose($fp); $HTTP_REQUEST_TIMEOUT = 408; if ($info['timed_out']) { $result->code = $HTTP_REQUEST_TIMEOUT; $result->error = 'request timed out'; return $result; } // Parse response headers from the response body. // Be tolerant of malformed HTTP responses that separate header and body with // \n\n or \r\r instead of \r\n\r\n. list($response, $result->data) = preg_split("/\r\n\r\n|\n\n|\r\r/", $response, 2); $response = preg_split("/\r\n|\n|\r/", $response); // Parse the response status line. $response_status_array = bimserverJsonConnector::_bimserver_parse_response_status(trim(array_shift($response))); $result->protocol = $response_status_array['http_version']; $result->status_message = $response_status_array['reason_phrase']; $code = $response_status_array['response_code']; $result->headers = array(); // Parse the response headers. while ($line = trim(array_shift($response))) { list($name, $value) = explode(':', $line, 2); $name = strtolower($name); if (isset($result->headers[$name]) && $name == 'set-cookie') { // RFC 2109: the Set-Cookie response header comprises the token Set- // Cookie:, followed by a comma-separated list of one or more cookies. $result->headers[$name] .= ',' . trim($value); } else { $result->headers[$name] = trim($value); } } $responses = array(100 => 'Continue', 101 => 'Switching Protocols', 200 => 'OK', 201 => 'Created', 202 => 'Accepted', 203 => 'Non-Authoritative Information', 204 => 'No Content', 205 => 'Reset Content', 206 => 'Partial Content', 300 => 'Multiple Choices', 301 => 'Moved Permanently', 302 => 'Found', 303 => 'See Other', 304 => 'Not Modified', 305 => 'Use Proxy', 307 => 'Temporary Redirect', 400 => 'Bad Request', 401 => 'Unauthorized', 402 => 'Payment Required', 403 => 'Forbidden', 404 => 'Not Found', 405 => 'Method Not Allowed', 406 => 'Not Acceptable', 407 => 'Proxy Authentication Required', 408 => 'Request Time-out', 409 => 'Conflict', 410 => 'Gone', 411 => 'Length Required', 412 => 'Precondition Failed', 413 => 'Request Entity Too Large', 414 => 'Request-URI Too Large', 415 => 'Unsupported Media Type', 416 => 'Requested range not satisfiable', 417 => 'Expectation Failed', 500 => 'Internal Server Error', 501 => 'Not Implemented', 502 => 'Bad Gateway', 503 => 'Service Unavailable', 504 => 'Gateway Time-out', 505 => 'HTTP Version not supported'); // RFC 2616 states that all unknown HTTP codes must be treated the same as the // base code in their class. if (!isset($responses[$code])) { $code = floor($code / 100) * 100; } $result->code = $code; switch ($code) { case 200: // OK // OK case 304: // Not modified break; case 301: // Moved permanently // Moved permanently case 302: // Moved temporarily // Moved temporarily case 307: // Moved temporarily $location = $result->headers['location']; $options['timeout'] -= timer_read(__FUNCTION__) / 1000; if ($options['timeout'] <= 0) { $result->code = HTTP_REQUEST_TIMEOUT; $result->error = 'request timed out'; } elseif ($options['max_redirects']) { // Redirect to the new location. $options['max_redirects']--; $result = _bim_http_request($location, $options); $result->redirect_code = $code; } if (!isset($result->redirect_url)) { $result->redirect_url = $location; } break; default: $result->error = $result->status_message; } return $result; }