wsgiref.validate is too restrictive regarding HTTP_CONTENT_LENGTH/TYPE

Bug report

Bug description:

PEP 3333 specifies that certain CGI environment variables must be placed in the environ dictionary.

The environ dictionary is required to contain these CGI environment variables, as defined by the Common Gateway Interface specification

The CONTENT_TYPE and CONTENT_LENGTH environ variables must be set as follows:

CONTENT_TYPE
The contents of any Content-Type fields in the HTTP request. May be empty or absent.
CONTENT_LENGTH
The contents of any Content-Length fields in the HTTP request. May be empty or absent.

Additionally, HTTP headers must be converted to variables as follows:

HTTP_ Variables
Variables corresponding to the client-supplied HTTP request headers (i.e., variables whose names begin with "HTTP_"). The presence or absence of these variables should correspond with the presence or absence of the appropriate HTTP header in the request.

So if the client sends an HTTP Content-Length header, it must be converted into a CONTENT_LENGTH variable, and may be converted into a HTTP_CONTENT_LENGTH variable. However, the CGI specification makes the following additional comment about Content-Length and Content-Type:

The server is not required to create meta-variables for all the header fields that it receives. In particular, it SHOULD remove any header fields carrying authentication information, such as 'Authorization'; or that are available to the script in other variables, such as 'Content-Length' and 'Content-Type'. The server MAY remove header fields that relate solely to client-side communication issues, such as 'Connection'.

In particular note that HTTP_CONTENT_LENGTH should be removed, not must.

On the other hand, wsgiref.validate.validator checks

• That HTTP_CONTENT_TYPE and HTTP_CONTENT_LENGTH are not in the environment (these headers should appear as CONTENT_LENGTH and CONTENT_TYPE).

I believe this is too restrictive because WSGI servers are not required to remove these headers. In particular, nginx (link to the FastCGI documentation, but similar behavior is present for SCGI and UWSGI) passes all HTTP headers by default except Status and X-Accel-.... Instead, the validator should check that if HTTP_CONTENT_TYPE is present that CONTENT_TYPE is also present (and similarly for CONTENT_TYPE).

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

從 wsgiref.validate.validator 開始，檢查它如何處理 environ 字典中的 HTTP_CONTENT_TYPE 和 HTTP_CONTENT_LENGTH。如果有針對這些變數的現有 validator 測試，請檢查它們。當對應的 CONTENT_ 變數存在時 validator 接受任一 HTTP_ 變數，同時仍拒絕沒有對應 CONTENT_ 變數的 HTTP_ 變數時，即表示完成。