cpython: b1ddcb220a7f (original) (raw)
Mercurial > cpython
changeset 86777:b1ddcb220a7f 3.1
use the collapsed path in the run_cgi method (closes #19435) [#19435]
| Benjamin Peterson benjamin@python.org | |
|---|---|
| date | Wed, 30 Oct 2013 12:43:09 -0400 |
| parents | 713d71048ab9 |
| children | dda1a32748e0 715fd3d8ac93 |
| files | Lib/http/server.py Lib/test/test_httpservers.py Misc/NEWS |
| diffstat | 3 files changed, 16 insertions(+), 5 deletions(-)[+] [-] Lib/http/server.py 9 Lib/test/test_httpservers.py 10 Misc/NEWS 2 |
line wrap: on
line diff
--- a/Lib/http/server.py +++ b/Lib/http/server.py @@ -926,18 +926,17 @@ class CGIHTTPRequestHandler(SimpleHTTPRe def run_cgi(self): """Execute a CGI script."""
path = self.path[](#l1.7) dir, rest = self.cgi_info[](#l1.8)
i = path.find('/', len(dir) + 1)[](#l1.10)
i = rest.find('/')[](#l1.11) while i >= 0:[](#l1.12)
nextdir = path[:i][](#l1.13)nextrest = path[i+1:][](#l1.14)
nextdir = rest[:i][](#l1.15)nextrest = rest[i+1:][](#l1.16)
scriptdir = self.translate_path(nextdir) if os.path.isdir(scriptdir): dir, rest = nextdir, nextrest
i = path.find('/', len(dir) + 1)[](#l1.21)
i = rest.find('/')[](#l1.22) else:[](#l1.23) break[](#l1.24)
--- a/Lib/test/test_httpservers.py +++ b/Lib/test/test_httpservers.py @@ -388,6 +388,11 @@ class CGIHTTPServerTestCase(BaseTestCase else: self.pythonexe = sys.executable
self.nocgi_path = os.path.join(self.parent_dir, 'nocgi.py')[](#l2.7)with open(self.nocgi_path, 'w') as fp:[](#l2.8)fp.write(cgi_file1 % self.pythonexe)[](#l2.9)os.chmod(self.nocgi_path, 0o777)[](#l2.10)
+ self.file1_path = os.path.join(self.cgi_dir, 'file1.py') with open(self.file1_path, 'w') as file1: file1.write(cgi_file1 % self.pythonexe) @@ -406,6 +411,7 @@ class CGIHTTPServerTestCase(BaseTestCase os.chdir(self.cwd) if self.pythonexe != sys.executable: os.remove(self.pythonexe)
os.remove(self.nocgi_path)[](#l2.19) os.remove(self.file1_path)[](#l2.20) os.remove(self.file2_path)[](#l2.21) os.rmdir(self.cgi_dir)[](#l2.22)
@@ -457,6 +463,10 @@ class CGIHTTPServerTestCase(BaseTestCase self.assertEqual((b'Hello World\n', 'text/html', 200), [](#l2.24) (res.read(), res.getheader('Content-type'), res.status))
- def test_issue19435(self):
res = self.request('///////////nocgi.py/../cgi-bin/nothere.sh')[](#l2.28)self.assertEqual(res.status, 404)[](#l2.29)
+ def test_post(self): params = urllib.parse.urlencode( {'spam' : 1, 'eggs' : 'python', 'bacon' : 123456})
--- a/Misc/NEWS +++ b/Misc/NEWS @@ -13,6 +13,8 @@ Core and Builtins Library ------- +- Issue #19435: Fix directory traversal attack on CGIHttpRequestHandler. +