cpython: 5d8042ab3361 (original) (raw)
Mercurial > cpython
changeset 101046:5d8042ab3361
Issue #26657: Merge http.server fix from 3.5 [#26657]
| Martin Panter vadmium+py@gmail.com | |
|---|---|
| date | Mon, 18 Apr 2016 07:16:17 +0000 |
| parents | 7d9f7d7a21ae(current diff)8054a68dfce2(diff) |
| children | 43567d214534 |
| files | Lib/http/server.py Lib/test/test_httpservers.py Misc/NEWS |
| diffstat | 3 files changed, 26 insertions(+), 3 deletions(-)[+] [-] Lib/http/server.py 6 Lib/test/test_httpservers.py 19 Misc/NEWS 4 |
line wrap: on
line diff
--- a/Lib/http/server.py +++ b/Lib/http/server.py @@ -768,9 +768,9 @@ class SimpleHTTPRequestHandler(BaseHTTPR words = filter(None, words) path = os.getcwd() for word in words:
drive, word = os.path.splitdrive(word)[](#l1.7)head, word = os.path.split(word)[](#l1.8)if word in (os.curdir, os.pardir): continue[](#l1.9)
if os.path.dirname(word) or word in (os.curdir, os.pardir):[](#l1.10)# Ignore components that are not a simple file/directory name[](#l1.11)continue[](#l1.12) path = os.path.join(path, word)[](#l1.13) if trailing_slash:[](#l1.14) path += '/'[](#l1.15)
--- a/Lib/test/test_httpservers.py +++ b/Lib/test/test_httpservers.py @@ -12,6 +12,7 @@ import os import sys import re import base64 +import ntpath import shutil import urllib.parse import html @@ -960,6 +961,24 @@ class SimpleHTTPRequestHandlerTestCase(u path = self.handler.translate_path('//filename?foo=bar') self.assertEqual(path, self.translated)
- def test_windows_colon(self):
with support.swap_attr(server.os, 'path', ntpath):[](#l2.16)path = self.handler.translate_path('c:c:c:foo/filename')[](#l2.17)path = path.replace(ntpath.sep, os.sep)[](#l2.18)self.assertEqual(path, self.translated)[](#l2.19)
path = self.handler.translate_path('\\c:../filename')[](#l2.21)path = path.replace(ntpath.sep, os.sep)[](#l2.22)self.assertEqual(path, self.translated)[](#l2.23)
path = self.handler.translate_path('c:\\c:..\\foo/filename')[](#l2.25)path = path.replace(ntpath.sep, os.sep)[](#l2.26)self.assertEqual(path, self.translated)[](#l2.27)
path = self.handler.translate_path('c:c:foo\\c:c:bar/filename')[](#l2.29)path = path.replace(ntpath.sep, os.sep)[](#l2.30)self.assertEqual(path, self.translated)[](#l2.31)
+ class MiscTestCase(unittest.TestCase): def test_all(self):
--- a/Misc/NEWS +++ b/Misc/NEWS @@ -245,6 +245,10 @@ Core and Builtins Library ------- +- Issue #26657: Fix directory traversal vulnerability with http.server on