Put os.fstat() call inside the try block ; handle obsolete HTTP date format ; ignore ill-formed values in If-Modified-Since header.

Author: Pierre Quentel

Lib/http/server.py

@@ -688,31 +688,41 @@ def send_head(self):
             self.send_error(HTTPStatus.NOT_FOUND, "File not found")
             return None
 
-        fs = os.fstat(f.fileno())
-            
         try:
+            fs = os.fstat(f.fileno())
             # Use browser cache if possible
             if ("If-Modified-Since" in self.headers
                     and "If-None-Match" not in self.headers):
                 # compare If-Modified-Since and time of last file modification
-                ims = email.utils.parsedate_to_datetime(
-                    self.headers["If-Modified-Since"])
-                if (ims is not None and
-                        ims.tzinfo is datetime.timezone.utc):
-                    # compare to UTC datetime of last modification
-                    last_modif = datetime.datetime.fromtimestamp(fs.st_mtime, 
-                        ims.tzinfo)
-                    # remove microseconds, like in If-Modified-Since
-                    last_modif = last_modif.replace(microsecond=0)
-                    if last_modif <= ims:
-                        self.send_response(HTTPStatus.NOT_MODIFIED)
-                        self.end_headers()
-                        f.close()
-                        return
+                try:
+                    ims = email.utils.parsedate_to_datetime(
+                        self.headers["If-Modified-Since"])
+                except:
+                    # ignore ill-formed values
+                    ims = None
+                if ims is not None:
+                    if ims.tzinfo is None:
+                        # obsolete format with no timezone, cf.
+                        # https://tools.ietf.org/html/rfc7231#section-7.1.1.1
+                        ims = ims.replace(tzinfo=datetime.timezone.utc)
+                    if ims.tzinfo is datetime.timezone.utc:
+                        # compare to UTC datetime of last modification
+                        last_modif = datetime.datetime.fromtimestamp(
+                            fs.st_mtime, datetime.timezone.utc)
+                        # remove microseconds, like in If-Modified-Since
+                        last_modif = last_modif.replace(microsecond=0)
+                        
+                        if last_modif <= ims:
+                            self.send_response(HTTPStatus.NOT_MODIFIED)
+                            self.end_headers()
+                            f.close()
+                            return None
+
             self.send_response(HTTPStatus.OK)
             self.send_header("Content-type", ctype)
             self.send_header("Content-Length", str(fs[6]))
-            self.send_header("Last-Modified", self.date_time_string(fs.st_mtime))
+            self.send_header("Last-Modified", 
+                self.date_time_string(fs.st_mtime))
             self.end_headers()
             return f
         except: