Merge branch 'fixup_tox'

Tox had been failing to properly run without the -r flag (recreate the
virtualenv). This fixes those issues, and fixes up the coverage issues
that exist.

.gitignore

@@ -1,24 +1,30 @@
-WebOb.egg-info
+*$py.class
+*,cover
+*.egg
 *.pyc
 *.pyo
 *.swp
-*~
-TEST*
-testenv
-docs/_build/*
-dist/
-build/
-.coverage
-*.egg
-glob:_coverage
-Session.vim
 *_coverage/**
-*,cover
 *_fixt.py
-*$py.class
+*~
+.*.swp
+.coverage
+.coverage.*
 .tox/
+Session.vim
+TEST*
+WebOb.egg-info
+__pycache__/
+_website/
+build/
+coverage-*.xml
 coverage.xml
-nosetests.xml
+coverage.xml
+dist/
+docs/_build/*
 env*/
-_website/
-__pycache__/
+glob:_coverage
+nosetests-*.xml
+nosetests.xml
+nosetests.xml
+testenv

tests/test_cookies.py

@@ -168,11 +168,6 @@ def test_morsel_repr():
     result = repr(v)
     eq_(result, "<Morsel: a='b'>")
 
-def test_strings_differ():
-    from webob.util import strings_differ
-
-    eq_(strings_differ('test1', 'test'), True)
-
 class TestRequestCookies(unittest.TestCase):
     def _makeOne(self, environ):
         from webob.cookies import RequestCookies

tests/test_util.py

@@ -48,3 +48,47 @@ def test_warn_deprecation_future_version(self):
         from webob.util import warn_deprecation
         warn_deprecation('foo', v[:3], 1)
         self.assertEqual(len(self.warnings), 1)
+
+class Test_strings_differ(unittest.TestCase):
+    def _callFUT(self, *args, **kw):
+        from webob.util import strings_differ
+        return strings_differ(*args, **kw)
+
+    def test_it(self):
+        self.assertFalse(self._callFUT(b'foo', b'foo'))
+        self.assertTrue(self._callFUT(b'123', b'345'))
+        self.assertTrue(self._callFUT(b'1234', b'123'))
+        self.assertTrue(self._callFUT(b'123', b'1234'))
+
+    def test_it_with_internal_comparator(self):
+        result = self._callFUT(b'foo', b'foo', compare_digest=None)
+        self.assertFalse(result)
+
+        result = self._callFUT(b'123', b'abc', compare_digest=None)
+        self.assertTrue(result)
+
+    def test_it_with_external_comparator(self):
+        class DummyComparator(object):
+            called = False
+            def __init__(self, ret_val):
+                self.ret_val = ret_val
+
+            def __call__(self, a, b):
+                self.called = True
+                return self.ret_val
+
+        dummy_compare = DummyComparator(True)
+        result = self._callFUT(b'foo', b'foo', compare_digest=dummy_compare)
+        self.assertTrue(dummy_compare.called)
+        self.assertFalse(result)
+
+        dummy_compare = DummyComparator(False)
+        result = self._callFUT(b'123', b'345', compare_digest=dummy_compare)
+        self.assertTrue(dummy_compare.called)
+        self.assertTrue(result)
+
+        dummy_compare = DummyComparator(False)
+        result = self._callFUT(b'abc', b'abc', compare_digest=dummy_compare)
+        self.assertTrue(dummy_compare.called)
+        self.assertTrue(result)
+

tox.ini

@@ -1,17 +1,51 @@
 [tox]
 envlist =
-    py26,py27,py32,py33,py34,pypy,cover
+    py26,py27,py32,py33,py34,pypy,pypy3,
+    {py2,py3}-cover,coverage
 
 [testenv]
+# Most of these are defaults but if you specify any you can't fall back
+# to defaults for others.
+basepython =
+    py26: python2.6
+    py27: python2.7
+    py32: python3.2
+    py33: python3.3
+    py34: python3.4
+    pypy: pypy
+    pypy3: pypy3
+    py2: python2.7
+    py3: python3.4
+
 commands =
-    python setup.py dev
-    python setup.py nosetests
+    pip install webob[testing]
+    nosetests --with-xunit --xunit-file=nosetests-{envname}.xml {posargs:}
 
-[testenv:cover]
-basepython =
-    python2.6
+[testenv:py2-cover]
 commands =
-    python setup.py dev
-    python setup.py nosetests --with-xunit --with-xcoverage --cover-min-percentage=100
+    pip install webob[testing]
+    coverage run --source=webob {envbindir}/nosetests
+    coverage xml -o coverage-py2.xml
+setenv =
+    COVERAGE_FILE=.coverage.py2
+
+[testenv:py3-cover]
+commands =
+    pip install webob[testing]
+    coverage run --source=webob {envbindir}/nosetests
+    coverage xml -o coverage-py3.xml
+setenv =
+    COVERAGE_FILE=.coverage.py3
+
+[testenv:coverage]
+basepython = python3.4
+commands = 
+    coverage erase
+    coverage combine
+    coverage xml
+    coverage report --show-missing --fail-under=100
 deps =
-    nosexcover
+    coverage
+setenv =
+    COVERAGE_FILE=.coverage
+

webob/util.py

@@ -133,10 +133,10 @@ def warn_deprecation(text, version, stacklevel):
 try:
     # py3.3+ have native comparison support
     from hmac import compare_digest
-except ImportError:
+except ImportError: # pragma: nocover (Python 2.7.7 backported this)
     compare_digest = None
 
-def strings_differ(string1, string2):
+def strings_differ(string1, string2, compare_digest=compare_digest):
     """Check whether two strings differ while avoiding timing attacks.
 
     This function returns True if the given strings differ and False
@@ -146,6 +146,10 @@ def strings_differ(string1, string2):
 
         http://seb.dbzteam.org/crypto/python-oauth-timing-hmac.pdf
 
+    .. versionchanged:: 1.5
+       Support :func:`hmac.compare_digest` if it is available (Python 2.7.7+
+       and Python 3.3+).
+
     """
     len_eq = len(string1) == len(string2)
     if len_eq:
@@ -156,9 +160,10 @@ def strings_differ(string1, string2):
         left = string2
     right = string2
 
-    if compare_digest is not None: # pragma: nocover (Python 3.3+ only)
+    if compare_digest is not None:
         invalid_bits += not compare_digest(left, right)
     else:
         for a, b in zip(left, right):
             invalid_bits += a != b
     return invalid_bits != 0
+