fixup! Fix: Frame Injection (azul-private#12)

DataBiosphere · Mar 10, 2023 · 01c25a7 · 01c25a7
1 parent 2503f72
commit 01c25a7
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 24 deletions.
diff --git a/src/azul/chalice.py b/src/azul/chalice.py
@@ -99,7 +99,7 @@ def __init__(self,
             self._specs: Optional[MutableJSON] = None
         super().__init__(app_name, debug=config.debug > 0, configure_logs=False)
         # Middleware is invoked in order of registration
-        self.register_middleware(self._wrapping_middleware, 'http')
+        self.register_middleware(self._error_wrapping_middleware, 'http')
         self.register_middleware(self._logging_middleware, 'http')
         self.register_middleware(self._lambda_context_middleware, 'all')
         self.register_middleware(self._authentication_middleware, 'http')
@@ -121,13 +121,13 @@ def patched_event_source_handler(self_, event, context):
         if old_handler.__code__ != patched_event_source_handler.__code__:
             chalice.app.EventSourceHandler.__call__ = patched_event_source_handler
 
-    def _wrapping_middleware(self, event, get_response):
+    def _error_wrapping_middleware(self, event, get_response):
         response = get_response(event)
         if response.status_code >= 400:
             parsed = parse_accept_header(event.headers.get('accept'))
             text_html = parsed.find('text/html')
             star_star = parsed.find('*/*')
-            if -1 < text_html and (star_star == -1 or text_html < star_star):
+            if text_html > -1 and (star_star == -1 or text_html < star_star):
                 response.body = (
                     '<html>'
                     f'<head>Status {response.status_code}</head>'

diff --git a/test/service/test_response.py b/test/service/test_response.py
@@ -2205,32 +2205,29 @@ def test_version(self):
                             self.assertEqual(expected_json, response.json()['git'])
 
     def test_response_error_escaping(self):
-        expected = {
-            'unescaped': json.dumps({
-                'Code': 'NotFoundError',
-                'Message': "Unable to find file 'foo', version None in catalog 'test'"
-            }, separators=(',', ':')),
-            'escaped': (
-                "<html><head>Status 404</head><body><pre>{"
-                "'Code': 'NotFoundError', "
-                "'Message': \"Unable to find file 'foo', version None in catalog 'test'\""
-                "}</pre></body></html>"
-            )
-        }
-        test_data = [
-            (None, 'unescaped'),
-            ('*/*', 'unescaped'),
-            ('*/*,text/html', 'unescaped'),
-            ('text/html', 'escaped'),
-            ('text/html,*/*', 'escaped'),
-        ]
+        unescaped = json.dumps({
+            'Code': 'NotFoundError',
+            'Message': "Unable to find file 'foo', version None in catalog 'test'"
+        }, separators=(',', ':'))
+        escaped = (
+            "<html><head>Status 404</head><body><pre>{"
+            "'Code': 'NotFoundError', "
+            "'Message': \"Unable to find file 'foo', version None in catalog 'test'\""
+            "}</pre></body></html>"
+        )
         url = self.base_url.set(path='repository/files/foo',
                                 args=dict(catalog=self.catalog))
-        for accept, response_type in test_data:
+        for accept, expect_escaped in [
+            (None, False),
+            ('*/*', False),
+            ('*/*,text/html', False),
+            ('text/html', True),
+            ('text/html,*/*', True),
+        ]:
             headers = {'accept': accept}
             with self.subTest(headers=headers):
                 response = requests.get(str(url), headers=headers)
-                self.assertEqual(expected[response_type], response.text)
+                self.assertEqual(escaped if expect_escaped else unescaped, response.text)
 
 
 class TestFileTypeSummaries(DCP1TestCase, WebServiceTestCase):