[Zope-dev] urgent: string exceptions

[Florent Guillaume]

In article <8DEB15B9-6C79-11D7-AFD7-003065D2A224@cuemedia.com> you write:
> "Bad Request" is a special scenario that harkens back to Bobo 
> (ZPublisher).  One of the elements of Bobo was that you could raise 
> HTTP exceptions, and it would be turned into a proper (or as proper as 
> possible) HTTP Response Code, like 302 or 404 or whatever.
> 
> This is some of the oldest code in Zope, and no one's really dealt with 
> it (at least, not for Zope 2), because it's a decent effort to chase 
> down all of the uses of it and patch things all the way down to the 
> core to make use of it.  This is made even more prescient by the fact 
> that this is core core core ZPublisher behavior and is not even really 
> Zope specific, so it's questionable where to put the class based 
> exceptions and where to declare their security options so that they can 
> get used in scripts.
> 
> I'm not saying that it shouldn't be done, but that one has to 
> understand the meaning behind it as well as the depth of the problem.  
> Because of its potential impact, a well-thought proposal would have to 
> be written up by someone who knew ZPublisher and Zope well enough to 
> suggest a solution and document the potential impacts/risks involved 
> with the change.

For those interested, the code is in ZPublisher/HTTPResponse.py.

There is a mapping (status_code) used to produce the return values sent
to the HTTP server. The method exception() is called by
ZPublisher.Publish.publish_module when an exception is caught, and it
uses status_code to decide what to do.

status_code is constructed in such a way that many aliases are allowed,
in particular those without spaces in them:
    for key, val in status_reasons.items():
        status_codes[''.join(val.split(' ')).lower()] = key
        status_codes[val.lower()] = key
        status_codes[key] = key
        status_codes[str(key)] = key

So it's perfectly correct to do:
    BadRequest = 'BadRequest'
    raise BadRequest
Besides, a lot of code already does:
    raise 'BadRequest'

For those interested, is also because of this that you can do a:
    raise 'Redirect', 'http://foo'
and have it work, because exception() knows how to handle all codes from
300 to 399 (of which Redirect is an instance) and set a Location header
for them.


So the cleanup can proceed without fear :-)

Florent


-- 
Florent Guillaume, Nuxeo (Paris, France)
+33 1 40 33 79 87  http://nuxeo.com  mailto:fg@nuxeo.com