improved router, thanks Jonathan

gluon/rewrite.py

@@ -46,9 +46,9 @@ def _router_default():
         domains = None,
         exclusive_domain = False,
         map_hyphen = False,
-        acfe_match = r'\w+$',              # legal app/ctlr/fcn/ext
-        file_match = r'([-+=@$%\w]+[./]?)+$',   # legal static file (path) name
-        args_match = r'([\w@ -]+[=.]?)*$', # legal arg in args
+        acfe_match = r'\w+$',                   # legal app/ctlr/fcn/ext
+        file_match = r'([-+=@$%\w]+[./]?)+$',   # legal static subpath
+        args_match = r'([\w@ -]+[=.]?)*$',      # legal arg in args
     )
     return router
 
@@ -966,6 +966,7 @@ class MapUrlIn(object):
             for name in self.args:
                 bad_static = bad_static or name in ('', '.', '..') or not self.router._file_match.match(name)
         if bad_static:
+            log_rewrite('bad static path=%s' % file)
             raise HTTP(400, thread.routes.error_message % 'invalid request',
                        web2py_error='invalid static file')
         #

gluon/tests/test_router.py

@@ -13,6 +13,7 @@ if os.path.isdir('gluon'):
     sys.path.append(os.path.realpath('gluon')) # running from web2py base
 else:
     sys.path.append(os.path.realpath('../')) # running from gluon/tests/
+    os.environ['web2py_path'] = os.path.realpath('../../')  # for settings
 
 from rewrite import load, filter_url, filter_err, get_effective_router, map_url_out
 from html import URL
@@ -794,6 +795,49 @@ class TestRouter(unittest.TestCase):
         self.assertEqual(filter_err(399), 399)
         self.assertEqual(filter_err(400), 400)
 
+    def test_router_static_path(self):
+        '''
+        Test validation of static paths
+        Stock pattern: file_match = r'([-+=@$%\w]+[./]?)+$'
+
+        '''
+        load(rdict=dict())
+        self.assertEqual(filter_url('http://domain.com/welcome/static/path/to/static'), "%s/applications/welcome/static/path/to/static" % root)
+        self.assertRaises(HTTP, filter_url, 'http://domain.com/welcome/static/bad/path/to/st~tic')
+        self.assertEqual(filter_url('http://domain.com/welcome/static/path/to--/static'), "%s/applications/welcome/static/path/to--/static" % root)
+        self.assertEqual(filter_url('http://domain.com/welcome/static/path/==to--/static'), "%s/applications/welcome/static/path/==to--/static" % root)
+        self.assertEqual(filter_url('http://domain.com/welcome/static/path/-+=@$%/static'), "%s/applications/welcome/static/path/-+=@$%%/static" % root)
+        self.assertRaises(HTTP, filter_url, 'http://domain.com/welcome/static/bad/path/to/.static')
+        self.assertRaises(HTTP, filter_url, 'http://domain.com/welcome/static/bad/path/to/s..tatic')
+        self.assertRaises(HTTP, filter_url, 'http://domain.com/welcome/static/bad/path/to//static')
+        self.assertRaises(HTTP, filter_url, 'http://domain.com/welcome/static/bad/path/to/#static')
+
+        router_static = dict(
+            BASE = dict(
+                file_match = r'([-+=@$%#\w]+[./]?)+$',   # legal static path
+            ),
+        )
+        load(rdict=router_static)
+        self.assertEqual(filter_url('http://domain.com/welcome/static/path/to/#static'), "%s/applications/welcome/static/path/to/#static" % root)
+
+        router_static = dict(
+            BASE = dict(
+                file_match = r'[-+=@$%#.\w]+$',   # legal static path element
+            ),
+        )
+        load(rdict=router_static)
+        self.assertEqual(filter_url('http://domain.com/welcome/static/path/to/static'), "%s/applications/welcome/static/path/to/static" % root)
+        self.assertRaises(HTTP, filter_url, 'http://domain.com/welcome/static/bad/path/to/st~tic')
+        self.assertEqual(filter_url('http://domain.com/welcome/static/path/to--/static'), "%s/applications/welcome/static/path/to--/static" % root)
+        self.assertEqual(filter_url('http://domain.com/welcome/static/path/==to--/static'), "%s/applications/welcome/static/path/==to--/static" % root)
+        self.assertEqual(filter_url('http://domain.com/welcome/static/path/-+=@$%/static'), "%s/applications/welcome/static/path/-+=@$%%/static" % root)
+        self.assertRaises(HTTP, filter_url, 'http://domain.com/welcome/static/bad/path/to//static')
+        self.assertEqual(filter_url('http://domain.com/welcome/static/path/to/#static'), "%s/applications/welcome/static/path/to/#static" % root)
+        self.assertRaises(HTTP, filter_url, 'http://domain.com/welcome/static/bad/path/./static')
+        self.assertRaises(HTTP, filter_url, 'http://domain.com/welcome/static/bad/path/../static')
+        self.assertEqual(filter_url('http://domain.com/welcome/static/path/.../static'), "%s/applications/welcome/static/path/.../static" % root)
+        self.assertEqual(filter_url('http://domain.com/welcome/static/path/to/.static'), "%s/applications/welcome/static/path/to/.static" % root)
+
     def test_router_args(self):
         '''
         Test URL args parsing/generation

gluon/tests/test_routes.py

@@ -13,6 +13,7 @@ if os.path.isdir('gluon'):
     sys.path.append(os.path.realpath('gluon')) # running from web2py base
 else:
     sys.path.append(os.path.realpath('../')) # running from gluon/tests/
+    os.environ['web2py_path'] = os.path.realpath('../../')  # for settings
 
 from rewrite import load, filter_url, filter_err, get_effective_router, regex_filter_out, regex_select
 from html import URL