wsgiref.validate is too restrictive regarding HTTP_CONTENT_LENGTH/TYPE

Bug report

Bug description:

PEP 3333 specifies that certain CGI environment variables must be placed in the environ dictionary.

The environ dictionary is required to contain these CGI environment variables, as defined by the Common Gateway Interface specification

The CONTENT_TYPE and CONTENT_LENGTH environ variables must be set as follows:

CONTENT_TYPE
The contents of any Content-Type fields in the HTTP request. May be empty or absent.
CONTENT_LENGTH
The contents of any Content-Length fields in the HTTP request. May be empty or absent.

Additionally, HTTP headers must be converted to variables as follows:

HTTP_ Variables
Variables corresponding to the client-supplied HTTP request headers (i.e., variables whose names begin with "HTTP_"). The presence or absence of these variables should correspond with the presence or absence of the appropriate HTTP header in the request.

So if the client sends an HTTP Content-Length header, it must be converted into a CONTENT_LENGTH variable, and may be converted into a HTTP_CONTENT_LENGTH variable. However, the CGI specification makes the following additional comment about Content-Length and Content-Type:

The server is not required to create meta-variables for all the header fields that it receives. In particular, it SHOULD remove any header fields carrying authentication information, such as 'Authorization'; or that are available to the script in other variables, such as 'Content-Length' and 'Content-Type'. The server MAY remove header fields that relate solely to client-side communication issues, such as 'Connection'.

In particular note that HTTP_CONTENT_LENGTH should be removed, not must.

On the other hand, wsgiref.validate.validator checks

• That HTTP_CONTENT_TYPE and HTTP_CONTENT_LENGTH are not in the environment (these headers should appear as CONTENT_LENGTH and CONTENT_TYPE).

I believe this is too restrictive because WSGI servers are not required to remove these headers. In particular, nginx (link to the FastCGI documentation, but similar behavior is present for SCGI and UWSGI) passes all HTTP headers by default except Status and X-Accel-.... Instead, the validator should check that if HTTP_CONTENT_TYPE is present that CONTENT_TYPE is also present (and similarly for CONTENT_TYPE).

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Commencez par wsgiref.validate.validator et examinez la manière dont il gère HTTP_CONTENT_TYPE et HTTP_CONTENT_LENGTH dans le dictionnaire environ. Vérifiez, si elles existent, les tests actuels du validateur pour ces variables. Le travail est considéré comme terminé lorsque le validateur accepte l’une ou l’autre variable HTTP_ si la variable CONTENT_ correspondante est présente, tout en continuant à rejeter une variable HTTP_ sans sa contrepartie CONTENT_.