GET bad_ abs_path HTTP/1.0

[Andrew Dalke]

I used httplib to test some non-standard HTTP method requests against
my Paste-based web server. (urllib2 can only be used for GET and POST
requests, and I wanted DELETE).

I made a mistake in my code and did

h.request("GET", "missing_slash")

It was supposed to be

h.request("GET", "/missing_slash")

(hence the missing slash).

This gave me a 500 error because one of the first things I do in my
wsgi handler is

mount_point = shift_path_info(environ)

and shift_path_info assumes there is a "/" in the path.

>>> d = dict(PATH_INFO="missing_slash", SCRIPT_NAME="")
>>> shift_path_info(d)
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/Library/Frameworks/Python.framework/Versions/2.5/lib/
python2.5/wsgiref/util.py", line 102, in shift_path_info
name = path_parts[1]
IndexError: list index out of range
>>>

The IndexError gets caught and converted into a 500 Internal Server
Error instead of a 400 Bad Request error, which I expected since it's
the incoming message at fault.

I've been trying to figure out who to blame. The HTTP spec says

Request-URI = "*" | absoluteURI | abs_path | authority

so it's clearly not a bug in BaseHTTPServer, since the BaseHTTPServer
might be implementing a proxy.

The WSGI specification says (upon careful reading) that the incoming
PATH_INFO must be the abs_path, based on the algorithm for
reassembling the original URL, and it must start with a '/'.

Therefore the problem is in httpserver, which doesn't verify that the
incoming path is in the right format for the WSGI PATH_INFO field.

And yes, I know that this is an extremely minor bug that will only be
seen in very rare, almost forced cases. But a 500 error says it's
something wrong with my server code, which just isn't true. It's
something wrong with YOUR server code. ;)

Andrew
da...@dalkescientific.com