Added functions for validating ip and port

tests/test_utils.py

@@ -0,0 +1,30 @@
+import unittest
+
+from webssh.utils import (is_valid_ipv4_address, is_valid_ipv6_address,
+                          is_valid_port, to_str)
+
+
+class TestUitls(unittest.TestCase):
+
+    def test_to_str(self):
+        b = b'hello'
+        u = u'hello'
+        self.assertEqual(to_str(b), u)
+        self.assertEqual(to_str(u), u)
+
+    def test_is_valid_ipv4_address(self):
+        self.assertFalse(is_valid_ipv4_address('127.0.0'))
+        self.assertFalse(is_valid_ipv4_address(b'127.0.0'))
+        self.assertTrue(is_valid_ipv4_address('127.0.0.1'))
+        self.assertTrue(is_valid_ipv4_address(b'127.0.0.1'))
+
+    def test_is_valid_ipv6_address(self):
+        self.assertFalse(is_valid_ipv6_address('abc'))
+        self.assertFalse(is_valid_ipv6_address(b'abc'))
+        self.assertTrue(is_valid_ipv6_address('::1'))
+        self.assertTrue(is_valid_ipv6_address(b'::1'))
+
+    def test_is_valid_port(self):
+        self.assertTrue(is_valid_port(80))
+        self.assertFalse(is_valid_port(0))
+        self.assertFalse(is_valid_port(65536))

webssh/handler.py

@@ -12,6 +12,8 @@ import tornado.web
 from tornado.ioloop import IOLoop
 from tornado.util import basestring_type
 from webssh.worker import Worker, recycle_worker, workers
+from webssh.utils import (is_valid_ipv4_address, is_valid_ipv6_address,
+                          is_valid_port)
 
 try:
     from concurrent.futures import Future
@@ -40,16 +42,17 @@ class MixinHandler(object):
         ip = self.request.headers.get('X-Real-Ip')
         port = self.request.headers.get('X-Real-Port')
 
-        if ip is None and port is None:
+        if ip is None and port is None:  # suppose the server doesn't use nginx
             return
 
-        try:
-            port = int(port)
-        except (TypeError, ValueError):
-            pass
-        else:
-            if ip:  # does not validate ip and port here
-                return (ip, port)
+        if is_valid_ipv4_address(ip) or is_valid_ipv6_address(ip):
+            try:
+                port = int(port)
+            except (TypeError, ValueError):
+                pass
+            else:
+                if is_valid_port(port):
+                    return (ip, port)
 
         logging.warning('Bad nginx configuration.')
         return False
@@ -101,10 +104,10 @@ class IndexHandler(MixinHandler, tornado.web.RequestHandler):
         try:
             port = int(value)
         except ValueError:
-            port = 0
-
-        if 0 < port < 65536:
-            return port
+            pass
+        else:
+            if is_valid_port(port):
+                return port
 
         raise ValueError('Invalid port {}'.format(value))
 
@@ -135,7 +138,7 @@ class IndexHandler(MixinHandler, tornado.web.RequestHandler):
         except paramiko.SSHException:
             result = None
         else:
-            data = stdout.read().decode()
+            data = stdout.read().decode('utf-8')
             result = parse_encoding(data)
 
         return result if result else 'utf-8'

webssh/utils.py

@@ -0,0 +1,29 @@
+import ipaddress
+
+
+def to_str(s):
+    if isinstance(s, bytes):
+        return s.decode('utf-8')
+    return s
+
+
+def is_valid_ipv4_address(ipstr):
+    ipstr = to_str(ipstr)
+    try:
+        ipaddress.IPv4Address(ipstr)
+    except ipaddress.AddressValueError:
+        return False
+    return True
+
+
+def is_valid_ipv6_address(ipstr):
+    ipstr = to_str(ipstr)
+    try:
+        ipaddress.IPv6Address(ipstr)
+    except ipaddress.AddressValueError:
+        return False
+    return True
+
+
+def is_valid_port(port):
+    return 0 < port < 65536