Fix for bug/1238895: normalize plain text mime types.

Change-Id: Iec5f37a37055a41816ec00eef009eb0c05b328c8

barbican/crypto/extension_manager.py

@@ -159,17 +159,17 @@ def normalize_before_encryption(unencrypted, content_type, content_encoding,
         raise CryptoNoPayloadProvidedException()
 
     # Validate and normalize content-type.
-    if not mime_types.is_supported(content_type):
+    normalized_mime = mime_types.normalize_content_type(content_type)
+    if not mime_types.is_supported(normalized_mime):
         raise CryptoContentTypeNotSupportedException(content_type)
-    content_type = mime_types.normalize_content_type(content_type)
 
     # Process plain-text type.
-    if content_type in mime_types.PLAIN_TEXT:
+    if normalized_mime in mime_types.PLAIN_TEXT:
         # normalize text to binary string
         unencrypted = unencrypted.encode('utf-8')
 
     # Process binary type.
-    elif content_type in mime_types.BINARY:
+    elif normalized_mime in mime_types.BINARY:
         # payload has to be decoded
         if mime_types.is_base64_processing_needed(content_type,
                                                   content_encoding):
@@ -188,7 +188,7 @@ def normalize_before_encryption(unencrypted, content_type, content_encoding,
     else:
         raise CryptoContentTypeNotSupportedException(content_type)
 
-    return unencrypted, content_type
+    return unencrypted, normalized_mime
 
 
 def analyze_before_decryption(content_type):

barbican/crypto/mime_types.py

@@ -25,6 +25,7 @@ from barbican.common import utils
 PLAIN_TEXT = ['text/plain',
               'text/plain;charset=utf-8',
               'text/plain; charset=utf-8']
+PLAIN_TEXT_CHARSETS = ['utf-8']
 BINARY = ['application/octet-stream']
 SUPPORTED = PLAIN_TEXT + BINARY
 
@@ -57,7 +58,20 @@ CTYPES_TO_ENCODINGS = {'text/plain': None,
 
 def normalize_content_type(mime_type):
     """Normalize the supplied content-type to an internal form."""
-    return INTERNAL_CTYPES.get(mime_type)
+    stripped = map(lambda x: x.strip(), mime_type.split(';'))
+    mime = stripped[0].lower()
+    if len(stripped) > 1:
+        # mime type includes charset
+        charset_type = stripped[1].lower()
+        if '=' not in charset_type:
+            # charset is malformed
+            return mime_type
+        else:
+            charset = map(lambda x: x.strip(), charset_type.split('='))[1]
+            if charset not in PLAIN_TEXT_CHARSETS:
+                # unsupported charset
+                return mime_type
+    return INTERNAL_CTYPES.get(mime, mime_type)
 
 
 def is_supported(mime_type):

barbican/tests/crypto/test_extension_manager.py

@@ -128,6 +128,16 @@ class WhenTestingNormalizeBeforeEncryptionForText(unittest.TestCase):
                          content)
         self.assertEqual(self.unencrypted.encode('utf-8'), unenc)
 
+    def test_raises_on_bogus_content_type(self):
+        content_type = 'text/plain; charset=ISO-8859-1'
+        with self.assertRaises(em.CryptoContentTypeNotSupportedException):
+            unenc, content = em.normalize_before_encryption(
+                self.unencrypted,
+                content_type,
+                self.content_encoding,
+                self.enforce_text_only
+            )
+
 
 class WhenTestingAnalyzeBeforeDecryption(unittest.TestCase):
 

barbican/tests/crypto/test_mime_types.py

@@ -88,3 +88,39 @@ class WhenTestingAugmentFieldsWithContentTypes(unittest.TestCase):
         content_types = fields['content_types']
         self.assertIn('default', content_types)
         self.assertEqual(self.datum.content_type, content_types['default'])
+
+
+class WhenTestingNormalizationOfMIMETypes(unittest.TestCase):
+
+    def test_plain_text_normalization(self):
+        mimes = ['text/plain',
+                 '   text/plain  ',
+                 'text/plain;charset=utf-8',
+                 'text/plain;charset=UTF-8',
+                 'text/plain; charset=utf-8',
+                 'text/plain; charset=UTF-8',
+                 'text/plain;  charset=utf-8',
+                 'text/plain;  charset=UTF-8',
+                 'text/plain ; charset = utf-8',
+                 'text/plain ; charset = UTF-8']
+        for mime in mimes:
+            self._test_plain_text_mime_type(mime)
+
+    def _test_plain_text_mime_type(self, mime):
+        r = mime_types.normalize_content_type(mime)
+        self.assertEqual(r, 'text/plain')
+
+    def test_unsupported_charset_in_plain_text_mime(self):
+        mime = 'text/plain; charset=ISO-8859-1'
+        r = mime_types.normalize_content_type(mime)
+        self.assertEqual(r, mime)
+
+    def test_binary_normalization(self):
+        mime = 'application/octet-stream'
+        r = mime_types.normalize_content_type(mime)
+        self.assertEqual(r, 'application/octet-stream')
+
+    def test_bogus_mime_normalization(self):
+        mime = 'something/bogus'
+        r = mime_types.normalize_content_type(mime)
+        self.assertEqual(r, 'something/bogus')

rpmbuild/package_dependencies.sh

@@ -13,7 +13,8 @@ fpm -s python -t rpm pysqlite
 fpm -s python -t rpm eventlet
 fpm -s python -t rpm oslo.config
 fpm -s python -t rpm iso8601
-fpm -s python -t rpm kombu
+# pin kombu because v3.0 breaks celery
+fpm -s python -t rpm -v 2.5.15 kombu
 fpm -s python -t rpm webob
 # --> # python-webob.noarch 0.9.6.1-3.el6 exists, but is incompatible
 # fpm -s python -t rpm PasteDeploy

tools/pip-requires

@@ -1,10 +1,10 @@
 falcon>=0.1.1
 wsgiref>=0.1.2
-pysqlite>=2.6.3
+pysqlite>=2.6.0
 eventlet>=0.12.1
 oslo.config>=1.1.0
 iso8601>=0.1.4
-kombu>=2.5.9
+kombu<3.0.0
 webob>=1.2.3
 PasteDeploy>=1.5.0
 Celery>=3.0.19