From a02e18a43f61543c911c82698d3cf44c8c11a0c2 Mon Sep 17 00:00:00 2001 From: Martin Panter Date: Sat, 3 Oct 2015 05:38:07 +0000 Subject: [PATCH 1/2] Issue #25232: Fix CGIRequestHandler's splitting of URL query Patch from Xiang Zhang. --- Lib/http/server.py | 6 +----- Lib/test/test_httpservers.py | 24 ++++++++++++++++++++++++ Misc/ACKS | 1 + Misc/NEWS | 3 +++ 4 files changed, 29 insertions(+), 5 deletions(-) diff --git a/Lib/http/server.py b/Lib/http/server.py index ce0f6cfe77f..9a7c976b4f0 100644 --- a/Lib/http/server.py +++ b/Lib/http/server.py @@ -1032,11 +1032,7 @@ class CGIHTTPRequestHandler(SimpleHTTPRequestHandler): break # find an explicit query string, if present. - i = rest.rfind('?') - if i >= 0: - rest, query = rest[:i], rest[i+1:] - else: - query = '' + rest, _, query = rest.partition('?') # dissect the part after the directory name into a script name & # a possible additional path, to be stored in PATH_INFO. diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py index 74e07143eb4..d50a9ac2598 100644 --- a/Lib/test/test_httpservers.py +++ b/Lib/test/test_httpservers.py @@ -366,6 +366,16 @@ print("%%s, %%s, %%s" %% (form.getfirst("spam"), form.getfirst("eggs"), form.getfirst("bacon"))) """ +cgi_file4 = """\ +#!%s +import os + +print("Content-type: text/html") +print() + +print(os.environ["%s"]) +""" + @unittest.skipIf(hasattr(os, 'geteuid') and os.geteuid() == 0, "This test can't be run reliably as root (issue #13308).") @@ -387,6 +397,7 @@ class CGIHTTPServerTestCase(BaseTestCase): self.file1_path = None self.file2_path = None self.file3_path = None + self.file4_path = None # The shebang line should be pure ASCII: use symlink if possible. # See issue #7668. @@ -425,6 +436,11 @@ class CGIHTTPServerTestCase(BaseTestCase): file3.write(cgi_file1 % self.pythonexe) os.chmod(self.file3_path, 0o777) + self.file4_path = os.path.join(self.cgi_dir, 'file4.py') + with open(self.file4_path, 'w', encoding='utf-8') as file4: + file4.write(cgi_file4 % (self.pythonexe, 'QUERY_STRING')) + os.chmod(self.file4_path, 0o777) + os.chdir(self.parent_dir) def tearDown(self): @@ -440,6 +456,8 @@ class CGIHTTPServerTestCase(BaseTestCase): os.remove(self.file2_path) if self.file3_path: os.remove(self.file3_path) + if self.file4_path: + os.remove(self.file4_path) os.rmdir(self.cgi_child_dir) os.rmdir(self.cgi_dir) os.rmdir(self.parent_dir) @@ -541,6 +559,12 @@ class CGIHTTPServerTestCase(BaseTestCase): self.assertEqual((b'Hello World' + self.linesep, 'text/html', 200), (res.read(), res.getheader('Content-type'), res.status)) + def test_query_with_multiple_question_mark(self): + res = self.request('/cgi-bin/file4.py?a=b?c=d') + self.assertEqual( + (b'a=b?c=d' + self.linesep, 'text/html', 200), + (res.read(), res.getheader('Content-type'), res.status)) + class SocketlessRequestHandler(SimpleHTTPRequestHandler): def __init__(self): diff --git a/Misc/ACKS b/Misc/ACKS index 6b4af4439d8..9e2c57de7af 100644 --- a/Misc/ACKS +++ b/Misc/ACKS @@ -1531,6 +1531,7 @@ Thomas Wouters Daniel Wozniak Heiko Wundram Doug Wyatt +Xiang Zhang Robert Xiao Florent Xicluna Hirokazu Yamamoto diff --git a/Misc/NEWS b/Misc/NEWS index 99185d181f8..f033f3c209f 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -90,6 +90,9 @@ Core and Builtins Library ------- +- Issue #25232: Fix CGIRequestHandler to split the query from the URL at the + first question mark (?) rather than the last. Patch from Xiang Zhang. + - Issue #22958: Constructor and update method of weakref.WeakValueDictionary now accept the self and the dict keyword arguments. From cb29e8c0e5dc67c5f73926ea0c540612ca40714a Mon Sep 17 00:00:00 2001 From: Martin Panter Date: Sat, 3 Oct 2015 05:55:46 +0000 Subject: [PATCH 2/2] Issue #24657: Prevent CGIRequestHandler from collapsing the URL query Initial patch from Xiang Zhang. Also fix out-of-date _url_collapse_path() doc string. --- Lib/http/server.py | 13 +++++++++---- Lib/test/test_httpservers.py | 7 +++++++ Misc/NEWS | 3 +++ 3 files changed, 19 insertions(+), 4 deletions(-) diff --git a/Lib/http/server.py b/Lib/http/server.py index 9a7c976b4f0..a97aa312dc9 100644 --- a/Lib/http/server.py +++ b/Lib/http/server.py @@ -887,13 +887,15 @@ def _url_collapse_path(path): The utility of this function is limited to is_cgi method and helps preventing some security attacks. - Returns: A tuple of (head, tail) where tail is everything after the final / - and head is everything before it. Head will always start with a '/' and, - if it contains anything else, never have a trailing '/'. + Returns: The reconstituted URL, which will always start with a '/'. Raises: IndexError if too many '..' occur within the path. """ + # Query component should not be involved. + path, _, query = path.partition('?') + path = urllib.parse.unquote(path) + # Similar to os.path.split(os.path.normpath(path)) but specific to URL # path semantics rather than local operating system semantics. path_parts = path.split('/') @@ -914,6 +916,9 @@ def _url_collapse_path(path): else: tail_part = '' + if query: + tail_part = '?'.join((tail_part, query)) + splitpath = ('/' + '/'.join(head_parts), tail_part) collapsed_path = "/".join(splitpath) @@ -995,7 +1000,7 @@ class CGIHTTPRequestHandler(SimpleHTTPRequestHandler): (and the next character is a '/' or the end of the string). """ - collapsed_path = _url_collapse_path(urllib.parse.unquote(self.path)) + collapsed_path = _url_collapse_path(self.path) dir_sep = collapsed_path.find('/', 1) head, tail = collapsed_path[:dir_sep], collapsed_path[dir_sep+1:] if head in self.cgi_directories: diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py index d50a9ac2598..6e5f2db7fdd 100644 --- a/Lib/test/test_httpservers.py +++ b/Lib/test/test_httpservers.py @@ -565,6 +565,13 @@ class CGIHTTPServerTestCase(BaseTestCase): (b'a=b?c=d' + self.linesep, 'text/html', 200), (res.read(), res.getheader('Content-type'), res.status)) + def test_query_with_continuous_slashes(self): + res = self.request('/cgi-bin/file4.py?k=aa%2F%2Fbb&//q//p//=//a//b//') + self.assertEqual( + (b'k=aa%2F%2Fbb&//q//p//=//a//b//' + self.linesep, + 'text/html', 200), + (res.read(), res.getheader('Content-type'), res.status)) + class SocketlessRequestHandler(SimpleHTTPRequestHandler): def __init__(self): diff --git a/Misc/NEWS b/Misc/NEWS index f033f3c209f..1c8bc491e65 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -93,6 +93,9 @@ Library - Issue #25232: Fix CGIRequestHandler to split the query from the URL at the first question mark (?) rather than the last. Patch from Xiang Zhang. +- Issue #24657: Prevent CGIRequestHandler from collapsing slashes in the + query part of the URL as if it were a path. Patch from Xiang Zhang. + - Issue #22958: Constructor and update method of weakref.WeakValueDictionary now accept the self and the dict keyword arguments.