Ignore response body if status code doesn't allow a body #202
Conversation
This is used to test if a response should have a message body or not. 1xx, 204 and 304 should not have message bodies.
This shouldn't be allowed.
For responses that should not include a message body, we now explicitly ignore the body from the application and no longer send it on to the requesting client. We also log a warning to let developers/users know.
| content_length_header = headerval | ||
| else: | ||
| del response_headers[i] | ||
| continue # pragma: no cover |
There was a problem hiding this comment.
deletion while iteration - sure this is ok?
There was a problem hiding this comment.
We do the same thing here: https://github.com/Pylons/waitress/pull/202/files/f9ad8bbb56aab91dd2847e4137b0e94bea1791c8#diff-6965458a8fd3a611b9b9d416d9cdff67L277
and that code has been around for years.
There was a problem hiding this comment.
I guess I need to find out if enumerate creates a copy of the list or if it iterates over the list internally.
There was a problem hiding this comment.
This will break in subtle ways if there is more than one Content-Length header set (which is illegal, but possible)
There was a problem hiding this comment.
FWIW, enumerate has generator semantics (see PEP 279).
There was a problem hiding this comment.
Then the other code and this code are both subtly broken... will fix
We don't want to delete items from a list while iterating over the list.
| if not date_header: | ||
| response_headers.append(('Date', build_http_date(self.start_time))) | ||
|
|
||
| self.response_headers = response_headers |
There was a problem hiding this comment.
Not strictly required in this function, but required for testing.
This is a follow-up to #166 and fixes the issue presented in #197.
This goes a step further than just making sure waitress doesn't generate any extra headers/content, it also removes it even if the application sent data it shouldn't have. This will help make sure that message bodies are not accidentally sent with HTTP status codes that SHOULD NOT contain message bodies.
Closes #197