Handle 403 and 404 issues in FileResponse class #8538

steverep · 2024-07-25T21:30:29Z

What do these changes do?

Move the check in the static handler for is_file() (i.e. exists and regular) to the FileResponse.prepare method. Revamp tests for non-regular files to be more realistic and robust.
Add a catch for permission errors when opening the file (which are not handled anywhere currently). Real and mock tests added here as well.
Remove the plain text file from the hello_txt test fixture which automatically now ensures compressed can exist without uncompressed variants.

Are there changes in behavior for the user?

FileResponse class is now more robust.

Is it a substantial burden for the maintainers to support this?

No

Related issue number

Closes #8182

Checklist

I think the code is well written
Unit tests for the changes exist
Documentation reflects the changes
If you provide code modification, please add yourself to CONTRIBUTORS.txt
- The format is <Name> <Surname>.
- Please keep alphabetical order, the file is sorted by names.
Add a new news fragment into the CHANGES/ folder
- name it <issue_or_pr_num>.<type>.rst (e.g. 588.bugfix.rst)
- if you don't have an issue number, change it to the pull request
  number after creating the PR
  - .bugfix: A bug fix for something the maintainers deemed an
    improper undesired behavior that got corrected to match
    pre-agreed expectations.
  - .feature: A new behavior, public APIs. That sort of stuff.
  - .deprecation: A declaration of future API removals and breaking
    changes in behavior.
  - .breaking: When something public is removed in a breaking way.
    Could be deprecated in an earlier release.
  - .doc: Notable updates to the documentation structure or build
    process.
  - .packaging: Notes for downstreams about unobvious side effects
    and tooling. Changes in the test invocation considerations and
    runtime assumptions.
  - .contrib: Stuff that affects the contributor experience. e.g.
    Running tests, building the docs, setting up the development
    environment.
  - .misc: Changes that are hard to assign to any of the above
    categories.
- Make sure to use full sentences with correct case and punctuation,
  for example:
```
Fixed issue with non-ascii contents in doctest text files
-- by :user:`contributor-gh-handle`.
```
  Use the past tense or the present tense a non-imperative mood,
  referring to what's changed compared to the last released version
  of this project.

aiohttp/web_fileresponse.py

CHANGES/8182.bugfix.rst

aiohttp/web_fileresponse.py

codecov · 2024-07-26T04:08:28Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 97.68%. Comparing base (7108d64) to head (3bbdb13).
Report is 917 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #8538   +/-   ##
=======================================
  Coverage   97.67%   97.68%           
=======================================
  Files         107      107           
  Lines       33288    33350   +62     
  Branches     3916     3918    +2     
=======================================
+ Hits        32515    32578   +63     
  Misses        559      559           
+ Partials      214      213    -1

Flag	Coverage Δ
CI-GHA	`97.59% <98.80%> (+<0.01%)`	⬆️
OS-Linux	`97.25% <97.61%> (+<0.01%)`	⬆️
OS-Windows	`95.63% <77.38%> (-0.06%)`	⬇️
OS-macOS	`96.91% <97.61%> (+<0.01%)`	⬆️
Py-3.10.11	`97.06% <98.80%> (+<0.01%)`	⬆️
Py-3.10.14	`97.00% <97.61%> (+<0.01%)`	⬆️
Py-3.11.9	`97.23% <98.80%> (+<0.01%)`	⬆️
Py-3.12.4	`97.36% <98.80%> (+<0.01%)`	⬆️
Py-3.8.10	`95.39% <77.38%> (-0.06%)`	⬇️
Py-3.8.18	`96.89% <97.61%> (+<0.01%)`	⬆️
Py-3.9.13	`97.04% <98.80%> (+<0.01%)`	⬆️
Py-3.9.19	`96.99% <97.61%> (+<0.01%)`	⬆️
Py-pypy7.3.16	`96.56% <97.61%> (+<0.01%)`	⬆️
VM-macos	`96.91% <97.61%> (+<0.01%)`	⬆️
VM-ubuntu	`97.25% <97.61%> (+<0.01%)`	⬆️
VM-windows	`95.63% <77.38%> (-0.06%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

bdraco

Tested on production HA instances. All good

patchback · 2024-07-26T17:52:28Z

Backport to 3.10: 💔 cherry-picking failed — conflicts found

❌ Failed to cleanly apply 4f834b6 on top of patchback/backports/3.10/4f834b646c23f74962e181170a40d872e76f4602/pr-8538

Backporting merged PR #8538 into master

Ensure you have a local repo clone of your fork. Unless you cloned it
from the upstream, this would be your origin remote.
Make sure you have an upstream repo added as a remote too. In these
instructions you'll refer to it by the name upstream. If you don't
have it, here's how you can add it:
```
$ git remote add upstream https://github.com/aio-libs/aiohttp.git
```

Ensure you have the latest copy of upstream and prepare a branch
that will hold the backported code:

$ git fetch upstream
$ git checkout -b patchback/backports/3.10/4f834b646c23f74962e181170a40d872e76f4602/pr-8538 upstream/3.10

Now, cherry-pick PR Handle 403 and 404 issues in FileResponse class #8538 contents into that branch:
```
$ git cherry-pick -x 4f834b646c23f74962e181170a40d872e76f4602
```
If it'll yell at you with something like fatal: Commit 4f834b646c23f74962e181170a40d872e76f4602 is a merge but no -m option was given., add -m 1 as follows instead:
```
$ git cherry-pick -m1 -x 4f834b646c23f74962e181170a40d872e76f4602
```
At this point, you'll probably encounter some merge conflicts. You must
resolve them in to preserve the patch from PR Handle 403 and 404 issues in FileResponse class #8538 as close to the
original as possible.

Push this branch to your fork on GitHub:

$ git push origin patchback/backports/3.10/4f834b646c23f74962e181170a40d872e76f4602/pr-8538

Create a PR, ensure that the CI is green. If it's not — update it so that
the tests and any other checks pass. This is it!
Now relax and wait for the maintainers to process your pull request
when they have some cycles to do reviews. Don't worry — they'll tell you if
any improvements are necessary when the time comes!

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

bdraco · 2024-07-26T17:52:56Z

Thanks @steverep

(cherry picked from commit 4f834b6) Co-authored-by: Steve Repsher <steverep@users.noreply.github.com>

(cherry picked from commit 4f834b6)  ## What do these changes do?  ## Are there changes in behavior for the user?  ## Is it a substantial burden for the maintainers to support this?  ## Related issue number   ## Checklist - [ ] I think the code is well written - [ ] Unit tests for the changes exist - [ ] Documentation reflects the changes - [ ] If you provide code modification, please add yourself to `CONTRIBUTORS.txt` * The format is <Name> <Surname>. * Please keep alphabetical order, the file is sorted by names. - [ ] Add a new news fragment into the `CHANGES/` folder * name it `<issue_or_pr_num>.<type>.rst` (e.g. `588.bugfix.rst`) * if you don't have an issue number, change it to the pull request number after creating the PR * `.bugfix`: A bug fix for something the maintainers deemed an improper undesired behavior that got corrected to match pre-agreed expectations. * `.feature`: A new behavior, public APIs. That sort of stuff. * `.deprecation`: A declaration of future API removals and breaking changes in behavior. * `.breaking`: When something public is removed in a breaking way. Could be deprecated in an earlier release. * `.doc`: Notable updates to the documentation structure or build process. * `.packaging`: Notes for downstreams about unobvious side effects and tooling. Changes in the test invocation considerations and runtime assumptions. * `.contrib`: Stuff that affects the contributor experience. e.g. Running tests, building the docs, setting up the development environment. * `.misc`: Changes that are hard to assign to any of the above categories. * Make sure to use full sentences with correct case and punctuation, for example: ```rst Fixed issue with non-ascii contents in doctest text files -- by :user:`contributor-gh-handle`. ``` Use the past tense or the present tense a non-imperative mood, referring to what's changed compared to the last released version of this project.

Dreamsorcerer · 2024-09-25T00:17:12Z

aiohttp/web_urldispatcher.py

@@ -690,10 +690,7 @@ def _resolve_path_to_response(self, unresolved_path: Path) -> StreamResponse:
        except PermissionError as error:
            raise HTTPForbidden() from error

-        # Not a regular file or does not exist.
-        if not file_path.is_file():
-            raise HTTPNotFound()


This breaks some code in aiohttp-devtools:
https://github.com/aio-libs/aiohttp-devtools/blob/270aa58741b9aad268e32cb7bd755fda4c562731/aiohttp_devtools/runserver/serve.py#L404

Any suggestions on how to proceed?

Handle 403 and 404 issues in FileResponse class

8144a0a

steverep requested review from webknjaz and asvetlov as code owners July 25, 2024 21:30

psf-chronographer bot added the bot:chronographer:provided There is a change note present in this PR label Jul 25, 2024

bdraco added the backport-3.10 label Jul 25, 2024