Merge lp:~cjwatson/lazr.restful/url-dereferencing-server-url into lp:lazr.restful

[Colin Watson]

Fix dereferencing of URLs that redirect within HTTPS requests.

URLDereferencingMixin.dereference_url didn't necessarily set SERVER_URL, so the request machinery defaulted to http:// URLs. This could cause dereferencing failures depending on the strictness of the IAbsoluteURL adapter being used.

[Tom Wardill (twom)]

review: Approve

=== modified file 'NEWS.rst'
--- NEWS.rst	2020-07-08 14:50:01 +0000
+++ NEWS.rst	2020-09-01 13:34:53 +0000
@@ -2,6 +2,11 @@
 NEWS for lazr.restful
 =====================
 
+0.22.2
+======
+
+Fix dereferencing of URLs that redirect within HTTPS requests.
+
 0.22.1 (2020-07-08)
 ===================
 

=== modified file 'src/lazr/restful/docs/webservice-marshallers.rst'
--- src/lazr/restful/docs/webservice-marshallers.rst	2020-08-10 15:05:58 +0000
+++ src/lazr/restful/docs/webservice-marshallers.rst	2020-09-01 13:34:53 +0000
@@ -718,6 +718,15 @@
     >>> print(cookbook.name)
     Mastering the Art of French Cooking
 
+    >>> from lazr.restful.interfaces import IWebServiceConfiguration
+    >>> webservice_configuration = getUtility(IWebServiceConfiguration)
+    >>> webservice_configuration.use_https = True
+    >>> cookbook = reference_marshaller.marshall_from_json_data(
+    ...     '/cookbooks/featured')
+    >>> print(cookbook.name)
+    Mastering the Art of French Cooking
+    >>> webservice_configuration.use_https = False
+
 Collections
 -----------
 

=== modified file 'src/lazr/restful/example/base/traversal.py'
--- src/lazr/restful/example/base/traversal.py	2020-02-04 13:17:32 +0000
+++ src/lazr/restful/example/base/traversal.py	2020-09-01 13:34:53 +0000
@@ -13,7 +13,11 @@
     ]
 
 
-from six.moves.urllib.parse import unquote
+from six.moves.urllib.parse import (
+    unquote,
+    urlparse,
+    )
+from zope.component import getUtility
 from zope.publisher.interfaces import IPublishTraverse, NotFound
 from zope.publisher.interfaces.browser import IDefaultBrowserLayer
 from zope.traversing.browser import absoluteURL, AbsoluteURL
@@ -21,6 +25,7 @@
 import grokcore.component
 
 from lazr.restful.example.base.interfaces import ICookbookSet, IHasGet
+from lazr.restful.interfaces import IWebServiceConfiguration
 from lazr.restful.simple import (
     RootResourceAbsoluteURL,
     SimulatedWebsiteRequest,
@@ -73,6 +78,16 @@
     grokcore.component.implements(IPublishTraverse)
 
     def publishTraverse(self, request, name):
+        # XXX cjwatson 2020-09-01:
+        # lazr.restful.simple.RootResourceAbsoluteURL is a bit too
+        # permissive, and is happy to generate URLs even if the request
+        # protocol disagrees with the webservice configuration.  We should
+        # perhaps fix this, although it could be a compatibility break.  For
+        # now, check coherence here for testing purposes.
+        config = getUtility(IWebServiceConfiguration)
+        root_url = request.getApplicationURL()
+        if config.use_https != (urlparse(root_url).scheme == 'https'):
+            raise NotFound(self.context, name, request)
         if name == 'featured':
             url = absoluteURL(self.context.featured, request)
             return RedirectResource(url, request)

=== modified file 'src/lazr/restful/marshallers.py'
--- src/lazr/restful/marshallers.py	2020-08-17 11:46:51 +0000
+++ src/lazr/restful/marshallers.py	2020-09-01 13:34:53 +0000
@@ -122,6 +122,9 @@
         server_url = self.request.get('SERVER_URL')
         if server_url is not None:
             environ['SERVER_URL'] = server_url
+        else:
+            environ['SERVER_URL'] = '%s://%s' % (
+                site_protocol, full_request_host)
         request = config.createRequest(BytesIO(), environ)
         request.setTraversalStack(path_parts)
         root = request.publication.getApplication(self.request)