cpython: 544b654d000c (original) (raw)

Mercurial > cpython

changeset 86779:544b654d000c 3.3

merge 3.2 (#19435) [#19435]

Benjamin Peterson benjamin@python.org
date	Wed, 30 Oct 2013 12:50:18 -0400
parents	7fa3e824a4ee(current diff)dda1a32748e0(diff)
children	493a99acaf00 518cb39bb625
files	Lib/http/server.py Lib/test/test_httpservers.py Misc/NEWS
diffstat	3 files changed, 17 insertions(+), 5 deletions(-)[+] [-] Lib/http/server.py 9 Lib/test/test_httpservers.py 12 Misc/NEWS 1

line wrap: on

line diff

--- a/Lib/http/server.py +++ b/Lib/http/server.py @@ -987,18 +987,17 @@ class CGIHTTPRequestHandler(SimpleHTTPRe def run_cgi(self): """Execute a CGI script."""

   path = self.path[](#l1.7)
   dir, rest = self.cgi_info[](#l1.8)

   i = path.find('/', len(dir) + 1)[](#l1.10)

   i = rest.find('/')[](#l1.11)
   while i >= 0:[](#l1.12)

```
       nextdir = path[:i][](#l1.13)
```
```
       nextrest = path[i+1:][](#l1.14)
```

```
       nextdir = rest[:i][](#l1.15)
```
```
       nextrest = rest[i+1:][](#l1.16)
```

scriptdir = self.translate_path(nextdir) if os.path.isdir(scriptdir): dir, rest = nextdir, nextrest

           i = path.find('/', len(dir) + 1)[](#l1.21)

           i = rest.find('/')[](#l1.22)
       else:[](#l1.23)
           break[](#l1.24)

--- a/Lib/test/test_httpservers.py +++ b/Lib/test/test_httpservers.py @@ -325,6 +325,7 @@ class CGIHTTPServerTestCase(BaseTestCase self.parent_dir = tempfile.mkdtemp() self.cgi_dir = os.path.join(self.parent_dir, 'cgi-bin') os.mkdir(self.cgi_dir)

   self.nocgi_path = None[](#l2.7)
   self.file1_path = None[](#l2.8)
   self.file2_path = None[](#l2.9)

@@ -345,6 +346,11 @@ class CGIHTTPServerTestCase(BaseTestCase self.tearDown() self.skipTest("Python executable path is not encodable to utf-8")

   self.nocgi_path = os.path.join(self.parent_dir, 'nocgi.py')[](#l2.15)

   with open(self.nocgi_path, 'w') as fp:[](#l2.16)

       fp.write(cgi_file1 % self.pythonexe)[](#l2.17)

   os.chmod(self.nocgi_path, 0o777)[](#l2.18)

+ self.file1_path = os.path.join(self.cgi_dir, 'file1.py') with open(self.file1_path, 'w', encoding='utf-8') as file1: file1.write(cgi_file1 % self.pythonexe) @@ -362,6 +368,8 @@ class CGIHTTPServerTestCase(BaseTestCase os.chdir(self.cwd) if self.pythonexe != sys.executable: os.remove(self.pythonexe)

```
       if self.nocgi_path:[](#l2.27)
```

           os.remove(self.nocgi_path)[](#l2.28)
       if self.file1_path:[](#l2.29)
           os.remove(self.file1_path)[](#l2.30)
       if self.file2_path:[](#l2.31)

@@ -418,6 +426,10 @@ class CGIHTTPServerTestCase(BaseTestCase self.assertEqual((b'Hello World' + self.linesep, 'text/html', 200), (res.read(), res.getheader('Content-type'), res.status))

def test_issue19435(self):

   res = self.request('///////////nocgi.py/../cgi-bin/nothere.sh')[](#l2.37)

   self.assertEqual(res.status, 404)[](#l2.38)

+ def test_post(self): params = urllib.parse.urlencode( {'spam' : 1, 'eggs' : 'python', 'bacon' : 123456})

--- a/Misc/NEWS +++ b/Misc/NEWS @@ -13,6 +13,7 @@ Core and Builtins Library ------- +- Issue #19435: Fix directory traversal attack on CGIHttpRequestHandler. What's New in Python 3.3.3 release candidate 1?