wsgiref.validate is too restrictive regarding HTTP_CONTENT_LENGTH/TYPE

Bug report

Bug description:

PEP 3333 specifies that certain CGI environment variables must be placed in the environ dictionary.

The environ dictionary is required to contain these CGI environment variables, as defined by the Common Gateway Interface specification

The CONTENT_TYPE and CONTENT_LENGTH environ variables must be set as follows:

CONTENT_TYPE
The contents of any Content-Type fields in the HTTP request. May be empty or absent.
CONTENT_LENGTH
The contents of any Content-Length fields in the HTTP request. May be empty or absent.

Additionally, HTTP headers must be converted to variables as follows:

HTTP_ Variables
Variables corresponding to the client-supplied HTTP request headers (i.e., variables whose names begin with "HTTP_"). The presence or absence of these variables should correspond with the presence or absence of the appropriate HTTP header in the request.

So if the client sends an HTTP Content-Length header, it must be converted into a CONTENT_LENGTH variable, and may be converted into a HTTP_CONTENT_LENGTH variable. However, the CGI specification makes the following additional comment about Content-Length and Content-Type:

The server is not required to create meta-variables for all the header fields that it receives. In particular, it SHOULD remove any header fields carrying authentication information, such as 'Authorization'; or that are available to the script in other variables, such as 'Content-Length' and 'Content-Type'. The server MAY remove header fields that relate solely to client-side communication issues, such as 'Connection'.

In particular note that HTTP_CONTENT_LENGTH should be removed, not must.

On the other hand, wsgiref.validate.validator checks

• That HTTP_CONTENT_TYPE and HTTP_CONTENT_LENGTH are not in the environment (these headers should appear as CONTENT_LENGTH and CONTENT_TYPE).

I believe this is too restrictive because WSGI servers are not required to remove these headers. In particular, nginx (link to the FastCGI documentation, but similar behavior is present for SCGI and UWSGI) passes all HTTP headers by default except Status and X-Accel-.... Instead, the validator should check that if HTTP_CONTENT_TYPE is present that CONTENT_TYPE is also present (and similarly for CONTENT_TYPE).

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

wsgiref.validate.validator から始め、environ 辞書内の HTTP_CONTENT_TYPE と HTTP_CONTENT_LENGTH の扱いを確認してください。これらの変数について、既存の validator テストがあれば確認してください。対応する CONTENT_ 変数が存在する場合はどちらの HTTP_ 変数も validator が受け入れ、対応する CONTENT_ 変数なしの HTTP_ 変数は引き続き拒否するようになれば完了です。