1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
|
import os
def main(request, response):
if b'origin' in request.headers:
origin = request.headers[b'origin']
response.headers.set(b'Access-Control-Allow-Origin', origin)
tao = request.GET.first(b'tao')
img = request.GET.first(b'img') if b'img' in request.GET else None
if tao == b'zero':
# zero TAO value, fail
pass
elif tao == b'wildcard':
# wildcard, pass
response.headers.set(b'Timing-Allow-Origin', b'*')
elif tao == b'null':
# null, fail unless it's an opaque origin
response.headers.set(b'Timing-Allow-Origin', b'null')
elif tao == b'Null':
# case-insensitive null, fail
response.headers.set(b'Timing-Allow-Origin', b'Null')
elif tao == b'origin':
# case-sensitive match for origin, pass
response.headers.set(b'Timing-Allow-Origin', origin)
elif tao.startswith(b'origin_port'):
# case-sensitive match for origin and port, pass
origin_parts = origin.split(b':')
host = origin_parts[0] + b':' + origin_parts[1]
port = tao.split(b'origin_port_')[1]
response.headers.set(b'Timing-Allow-Origin', host + b':' + port)
elif tao == b'space':
# space separated list of origin and wildcard, fail
response.headers.set(b'Timing-Allow-Origin', (origin + b' *'))
elif tao == b'multi':
# more than one TAO values, separated by comma, pass
response.headers.set(b'Timing-Allow-Origin', origin)
response.headers.append(b'Timing-Allow-Origin', b'*')
elif tao == b'multi_wildcard':
# multiple wildcards, separated by comma, pass
response.headers.set(b'Timing-Allow-Origin', b'*')
response.headers.append(b'Timing-Allow-Origin', b'*')
elif tao == b'match_origin':
# contains a match of origin, separated by comma, pass
response.headers.set(b'Timing-Allow-Origin', origin)
response.headers.append(b'Timing-Allow-Origin', b"fake")
elif tao == b'match_wildcard':
# contains a wildcard, separated by comma, pass
response.headers.set(b'Timing-Allow-Origin', b"fake")
response.headers.append(b'Timing-Allow-Origin', b'*')
elif tao == b'uppercase':
# non-case-sensitive match for origin, fail
response.headers.set(b'Timing-Allow-Origin', origin.upper())
else:
pass
response.status = 200
if img:
response.headers.set(b"Content-Type", b"image/png")
with open(request.doc_root + "/resource-timing/resources/blue.png", "rb") as f:
response.content = f.read()
f.close()
else:
response.headers.set(b"Content-Type", b"text/plain")
response.content = "TEST"
|
