(original) (raw)

changeset: 86778:dda1a32748e0 branch: 3.2 parent: 85752:ef90c40fe6cf parent: 86777:b1ddcb220a7f user: Benjamin Peterson benjamin@python.org date: Wed Oct 30 12:48:59 2013 -0400 files: Lib/http/server.py Lib/test/test_httpservers.py Misc/NEWS description: merge 3.1 (#19435) diff -r ef90c40fe6cf -r dda1a32748e0 Lib/http/server.py --- a/Lib/http/server.py Wed Sep 18 08:53:26 2013 -0400 +++ b/Lib/http/server.py Wed Oct 30 12:48:59 2013 -0400 @@ -968,18 +968,17 @@ def run_cgi(self): """Execute a CGI script.""" - path = self.path dir, rest = self.cgi_info - i = path.find('/', len(dir) + 1) + i = rest.find('/') while i >= 0: - nextdir = path[:i] - nextrest = path[i+1:] + nextdir = rest[:i] + nextrest = rest[i+1:] scriptdir = self.translate_path(nextdir) if os.path.isdir(scriptdir): dir, rest = nextdir, nextrest - i = path.find('/', len(dir) + 1) + i = rest.find('/') else: break diff -r ef90c40fe6cf -r dda1a32748e0 Lib/test/test_httpservers.py --- a/Lib/test/test_httpservers.py Wed Sep 18 08:53:26 2013 -0400 +++ b/Lib/test/test_httpservers.py Wed Oct 30 12:48:59 2013 -0400 @@ -322,6 +322,7 @@ self.parent_dir = tempfile.mkdtemp() self.cgi_dir = os.path.join(self.parent_dir, 'cgi-bin') os.mkdir(self.cgi_dir) + self.nocgi_path = None self.file1_path = None self.file2_path = None @@ -342,6 +343,11 @@ self.tearDown() self.skipTest("Python executable path is not encodable to utf-8") + self.nocgi_path = os.path.join(self.parent_dir, 'nocgi.py') + with open(self.nocgi_path, 'w') as fp: + fp.write(cgi_file1 % self.pythonexe) + os.chmod(self.nocgi_path, 0o777) + self.file1_path = os.path.join(self.cgi_dir, 'file1.py') with open(self.file1_path, 'w', encoding='utf-8') as file1: file1.write(cgi_file1 % self.pythonexe) @@ -359,6 +365,8 @@ os.chdir(self.cwd) if self.pythonexe != sys.executable: os.remove(self.pythonexe) + if self.nocgi_path: + os.remove(self.nocgi_path) if self.file1_path: os.remove(self.file1_path) if self.file2_path: @@ -415,6 +423,10 @@ self.assertEqual((b'Hello World' + self.linesep, 'text/html', 200), (res.read(), res.getheader('Content-type'), res.status)) + def test_issue19435(self): + res = self.request('///////////nocgi.py/../cgi-bin/nothere.sh') + self.assertEqual(res.status, 404) + def test_post(self): params = urllib.parse.urlencode( {'spam' : 1, 'eggs' : 'python', 'bacon' : 123456}) diff -r ef90c40fe6cf -r dda1a32748e0 Misc/NEWS --- a/Misc/NEWS Wed Sep 18 08:53:26 2013 -0400 +++ b/Misc/NEWS Wed Oct 30 12:48:59 2013 -0400 @@ -10,6 +10,8 @@ Library ------- +- Issue #19435: Fix directory traversal attack on CGIHttpRequestHandler. + - Issue #14984: On POSIX systems, when netrc is called without a filename argument (and therefore is reading the user's $HOME/.netrc file), it now enforces the same security rules as typical ftp clients: the .netrc file must /benjamin@python.org