This file is indexed.

/usr/lib/python2.7/dist-packages/pecan/rest.py is in python-pecan 1.0.2-2ubuntu1.

This file is owned by root:root, with mode 0o644.

The actual contents of the file can be viewed below.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
from inspect import ismethod, getmembers
import warnings

from webob import exc
import six

from .core import abort
from .decorators import expose
from .routing import lookup_controller, handle_lookup_traversal
from .util import iscontroller, getargspec


class RestController(object):
    '''
    A base class for ``REST`` based controllers. Inherit from this class
    to implement a REST controller.

    ``RestController`` implements a set of routing functions which override
    the default pecan routing with behavior consistent with RESTful routing.
    This functionality covers navigation to the requested resource
    controllers, and the appropriate handling of both the common (``GET``,
    ``POST``, ``PUT``, ``DELETE``) as well as custom-defined REST action
    methods.

    For more on developing **RESTful** web applications with Pecan, see
    :ref:`rest`.
    '''
    _custom_actions = {}

    def __new__(cls, *args, **kwargs):
        """
        RestController does not support the `route` argument to
        :func:`~pecan.decorators.expose`

        Implement this with __new__ rather than a metaclass, because it's very
        common for pecan users to mixin RestController (with other bases that
        have their own metaclasses).
        """
        for name, value in getmembers(cls):
            if iscontroller(value) and getattr(value, 'custom_route', None):
                raise ValueError(
                    'Path segments cannot be used in combination with '
                    'pecan.rest.RestController.  Remove the `route` argument '
                    'to @pecan.expose on %s.%s.%s' % (
                        cls.__module__, cls.__name__, value.__name__
                    )
                )

        # object.__new__ will error if called with extra arguments, and either
        # __new__ is overridden or __init__ is not overridden;
        # https://hg.python.org/cpython/file/78d36d54391c/Objects/typeobject.c#l3034
        # In PY3, this is actually a TypeError (in PY2, it just raises
        # a DeprecationWarning)
        new = super(RestController, cls).__new__
        if new is object.__new__:
            return new(cls)
        return new(cls, *args, **kwargs)

    def _get_args_for_controller(self, controller):
        """
        Retrieve the arguments we actually care about.  For Pecan applications
        that utilize thread locals, we should truncate the first argument,
        `self`.  For applications that explicitly pass request/response
        references as the first controller arguments, we should truncate the
        first three arguments, `self, req, resp`.
        """
        argspec = getargspec(controller)
        from pecan import request
        try:
            request.path
        except AttributeError:
            return argspec.args[3:]
        return argspec.args[1:]

    def _handle_bad_rest_arguments(self, controller, remainder, request):
        """
        Ensure that the argspec for a discovered controller actually matched
        the positional arguments in the request path.  If not, raise
        a webob.exc.HTTPBadRequest.
        """
        argspec = self._get_args_for_controller(controller)
        fixed_args = len(argspec) - len(
            request.pecan.get('routing_args', [])
        )
        if len(remainder) < fixed_args:
            # For controllers that are missing intermediate IDs
            # (e.g., /authors/books vs /authors/1/books), return a 404 for an
            # invalid path.
            abort(404)

    def _lookup_child(self, remainder):
        """
        Lookup a child controller with a named path (handling Unicode paths
        properly for Python 2).
        """
        try:
            controller = getattr(self, remainder, None)
        except UnicodeEncodeError:
            return None
        return controller

    @expose()
    def _route(self, args, request=None):
        '''
        Routes a request to the appropriate controller and returns its result.

        Performs a bit of validation - refuses to route delete and put actions
        via a GET request).
        '''
        if request is None:
            from pecan import request
        # convention uses "_method" to handle browser-unsupported methods
        method = request.params.get('_method', request.method).lower()

        # make sure DELETE/PUT requests don't use GET
        if request.method == 'GET' and method in ('delete', 'put'):
            abort(405)

        # check for nested controllers
        result = self._find_sub_controllers(args, request)
        if result:
            return result

        # handle the request
        handler = getattr(
            self,
            '_handle_%s' % method,
            self._handle_unknown_method
        )

        try:
            if len(getargspec(handler).args) == 3:
                result = handler(method, args)
            else:
                result = handler(method, args, request)

            #
            # If the signature of the handler does not match the number
            # of remaining positional arguments, attempt to handle
            # a _lookup method (if it exists)
            #
            argspec = self._get_args_for_controller(result[0])
            num_args = len(argspec)
            if num_args < len(args):
                _lookup_result = self._handle_lookup(args, request)
                if _lookup_result:
                    return _lookup_result
        except (exc.HTTPClientError, exc.HTTPNotFound,
                exc.HTTPMethodNotAllowed) as e:
            #
            # If the matching handler results in a 400, 404, or 405, attempt to
            # handle a _lookup method (if it exists)
            #
            _lookup_result = self._handle_lookup(args, request)
            if _lookup_result:
                return _lookup_result

            # Build a correct Allow: header
            if isinstance(e, exc.HTTPMethodNotAllowed):

                def method_iter():
                    for func in ('get', 'get_one', 'get_all', 'new', 'edit',
                                 'get_delete'):
                        if self._find_controller(func):
                            yield 'GET'
                            break
                    for method in ('HEAD', 'POST', 'PUT', 'DELETE', 'TRACE',
                                   'PATCH'):
                        func = method.lower()
                        if self._find_controller(func):
                            yield method

                e.allow = sorted(method_iter())

            raise

        # return the result
        return result

    def _handle_lookup(self, args, request=None):
        if request is None:
            self._raise_method_deprecation_warning(self.handle_lookup)

        # filter empty strings from the arg list
        args = list(six.moves.filter(bool, args))

        # check for lookup controllers
        lookup = getattr(self, '_lookup', None)
        if args and iscontroller(lookup):
            result = handle_lookup_traversal(lookup, args)
            if result:
                obj, remainder = result
                return lookup_controller(obj, remainder, request)

    def _find_controller(self, *args):
        '''
        Returns the appropriate controller for routing a custom action.
        '''
        for name in args:
            obj = self._lookup_child(name)
            if obj and iscontroller(obj):
                return obj
        return None

    def _find_sub_controllers(self, remainder, request):
        '''
        Identifies the correct controller to route to by analyzing the
        request URI.
        '''
        # need either a get_one or get to parse args
        method = None
        for name in ('get_one', 'get'):
            if hasattr(self, name):
                method = name
                break
        if not method:
            return

        # get the args to figure out how much to chop off
        args = self._get_args_for_controller(getattr(self, method))
        fixed_args = len(args) - len(
            request.pecan.get('routing_args', [])
        )
        var_args = getargspec(getattr(self, method)).varargs

        # attempt to locate a sub-controller
        if var_args:
            for i, item in enumerate(remainder):
                controller = self._lookup_child(item)
                if controller and not ismethod(controller):
                    self._set_routing_args(request, remainder[:i])
                    return lookup_controller(controller, remainder[i + 1:],
                                             request)
        elif fixed_args < len(remainder) and hasattr(
            self, remainder[fixed_args]
        ):
            controller = self._lookup_child(remainder[fixed_args])
            if not ismethod(controller):
                self._set_routing_args(request, remainder[:fixed_args])
                return lookup_controller(
                    controller,
                    remainder[fixed_args + 1:],
                    request
                )

    def _handle_unknown_method(self, method, remainder, request=None):
        '''
        Routes undefined actions (like RESET) to the appropriate controller.
        '''
        if request is None:
            self._raise_method_deprecation_warning(self._handle_unknown_method)

        # try finding a post_{custom} or {custom} method first
        controller = self._find_controller('post_%s' % method, method)
        if controller:
            return controller, remainder

        # if no controller exists, try routing to a sub-controller; note that
        # since this isn't a safe GET verb, any local exposes are 405'd
        if remainder:
            if self._find_controller(remainder[0]):
                abort(405)
            sub_controller = self._lookup_child(remainder[0])
            if sub_controller:
                return lookup_controller(sub_controller, remainder[1:],
                                         request)

        abort(405)

    def _handle_get(self, method, remainder, request=None):
        '''
        Routes ``GET`` actions to the appropriate controller.
        '''
        if request is None:
            self._raise_method_deprecation_warning(self._handle_get)

        # route to a get_all or get if no additional parts are available
        if not remainder or remainder == ['']:
            remainder = list(six.moves.filter(bool, remainder))
            controller = self._find_controller('get_all', 'get')
            if controller:
                self._handle_bad_rest_arguments(controller, remainder, request)
                return controller, []
            abort(405)

        method_name = remainder[-1]
        # check for new/edit/delete GET requests
        if method_name in ('new', 'edit', 'delete'):
            if method_name == 'delete':
                method_name = 'get_delete'
            controller = self._find_controller(method_name)
            if controller:
                return controller, remainder[:-1]

        match = self._handle_custom_action(method, remainder, request)
        if match:
            return match

        controller = self._lookup_child(remainder[0])
        if controller and not ismethod(controller):
            return lookup_controller(controller, remainder[1:], request)

        # finally, check for the regular get_one/get requests
        controller = self._find_controller('get_one', 'get')
        if controller:
            self._handle_bad_rest_arguments(controller, remainder, request)
            return controller, remainder

        abort(405)

    def _handle_delete(self, method, remainder, request=None):
        '''
        Routes ``DELETE`` actions to the appropriate controller.
        '''
        if request is None:
            self._raise_method_deprecation_warning(self._handle_delete)

        if remainder:
            match = self._handle_custom_action(method, remainder, request)
            if match:
                return match

            controller = self._lookup_child(remainder[0])
            if controller and not ismethod(controller):
                return lookup_controller(controller, remainder[1:], request)

        # check for post_delete/delete requests first
        controller = self._find_controller('post_delete', 'delete')
        if controller:
            return controller, remainder

        # if no controller exists, try routing to a sub-controller; note that
        # since this is a DELETE verb, any local exposes are 405'd
        if remainder:
            if self._find_controller(remainder[0]):
                abort(405)
            sub_controller = self._lookup_child(remainder[0])
            if sub_controller:
                return lookup_controller(sub_controller, remainder[1:],
                                         request)

        abort(405)

    def _handle_post(self, method, remainder, request=None):
        '''
        Routes ``POST`` requests.
        '''
        if request is None:
            self._raise_method_deprecation_warning(self._handle_post)

        # check for custom POST/PUT requests
        if remainder:
            match = self._handle_custom_action(method, remainder, request)
            if match:
                return match

            controller = self._lookup_child(remainder[0])
            if controller and not ismethod(controller):
                return lookup_controller(controller, remainder[1:], request)

        # check for regular POST/PUT requests
        controller = self._find_controller(method)
        if controller:
            return controller, remainder

        abort(405)

    def _handle_put(self, method, remainder, request=None):
        return self._handle_post(method, remainder, request)

    def _handle_custom_action(self, method, remainder, request=None):
        if request is None:
            self._raise_method_deprecation_warning(self._handle_custom_action)

        remainder = [r for r in remainder if r]
        if remainder:
            if method in ('put', 'delete'):
                # For PUT and DELETE, additional arguments are supplied, e.g.,
                # DELETE /foo/XYZ
                method_name = remainder[0]
                remainder = remainder[1:]
            else:
                method_name = remainder[-1]
                remainder = remainder[:-1]
            if method.upper() in self._custom_actions.get(method_name, []):
                controller = self._find_controller(
                    '%s_%s' % (method, method_name),
                    method_name
                )
                if controller:
                    return controller, remainder

    def _set_routing_args(self, request, args):
        '''
        Sets default routing arguments.
        '''
        request.pecan.setdefault('routing_args', []).extend(args)

    def _raise_method_deprecation_warning(self, handler):
        warnings.warn(
            (
                "The function signature for %s.%s.%s is changing "
                "in the next version of pecan.\nPlease update to: "
                "`%s(self, method, remainder, request)`." % (
                    self.__class__.__module__,
                    self.__class__.__name__,
                    handler.__name__,
                    handler.__name__
                )
            ),
            DeprecationWarning
        )