From 91daa9d7224626dad4bb820924c01b3438ca6e3f Mon Sep 17 00:00:00 2001 From: Siwon Kang Date: Fri, 22 Nov 2019 18:13:05 +0900 Subject: [PATCH] bpo-38863: Improve is_cgi() in http.server (GH-17312) is_cgi() function of http.server library does not currently handle a cgi script if one of the cgi_directories is located at the sub-directory of given path. Since is_cgi() in CGIHTTPRequestHandler class separates given path into (dir, rest) based on the first seen '/', multi-level directories like /sub/dir/cgi-bin/hello.py is divided into head=/sub, rest=dir/cgi-bin/hello.py then check whether '/sub' exists in cgi_directories = [..., '/sub/dir/cgi-bin']. This patch makes the is_cgi() keep expanding dir part to the next '/' then checking if that expanded path exists in the cgi_directories. Signed-off-by: Siwon Kang https://bugs.python.org/issue38863 --- Lib/http/server.py | 6 +++-- Lib/test/test_httpservers.py | 24 +++++++++++++++++++ .../2019-11-21-16-30-00.bpo-38863.RkdTjf.rst | 2 ++ 3 files changed, 30 insertions(+), 2 deletions(-) create mode 100644 Misc/NEWS.d/next/Library/2019-11-21-16-30-00.bpo-38863.RkdTjf.rst diff --git a/Lib/http/server.py b/Lib/http/server.py index 005dd824f9a..47a4fcf9a65 100644 --- a/Lib/http/server.py +++ b/Lib/http/server.py @@ -1014,8 +1014,10 @@ class CGIHTTPRequestHandler(SimpleHTTPRequestHandler): """ collapsed_path = _url_collapse_path(self.path) dir_sep = collapsed_path.find('/', 1) - head, tail = collapsed_path[:dir_sep], collapsed_path[dir_sep+1:] - if head in self.cgi_directories: + while dir_sep > 0 and not collapsed_path[:dir_sep] in self.cgi_directories: + dir_sep = collapsed_path.find('/', dir_sep+1) + if dir_sep > 0: + head, tail = collapsed_path[:dir_sep], collapsed_path[dir_sep+1:] self.cgi_info = head, tail return True return False diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py index 1c980a2fa66..26da71e0b27 100644 --- a/Lib/test/test_httpservers.py +++ b/Lib/test/test_httpservers.py @@ -601,13 +601,20 @@ class CGIHTTPServerTestCase(BaseTestCase): self.parent_dir = tempfile.mkdtemp() self.cgi_dir = os.path.join(self.parent_dir, 'cgi-bin') self.cgi_child_dir = os.path.join(self.cgi_dir, 'child-dir') + self.sub_dir_1 = os.path.join(self.parent_dir, 'sub') + self.sub_dir_2 = os.path.join(self.sub_dir_1, 'dir') + self.cgi_dir_in_sub_dir = os.path.join(self.sub_dir_2, 'cgi-bin') os.mkdir(self.cgi_dir) os.mkdir(self.cgi_child_dir) + os.mkdir(self.sub_dir_1) + os.mkdir(self.sub_dir_2) + os.mkdir(self.cgi_dir_in_sub_dir) self.nocgi_path = None self.file1_path = None self.file2_path = None self.file3_path = None self.file4_path = None + self.file5_path = None # The shebang line should be pure ASCII: use symlink if possible. # See issue #7668. @@ -652,6 +659,11 @@ class CGIHTTPServerTestCase(BaseTestCase): file4.write(cgi_file4 % (self.pythonexe, 'QUERY_STRING')) os.chmod(self.file4_path, 0o777) + self.file5_path = os.path.join(self.cgi_dir_in_sub_dir, 'file5.py') + with open(self.file5_path, 'w', encoding='utf-8') as file5: + file5.write(cgi_file1 % self.pythonexe) + os.chmod(self.file5_path, 0o777) + os.chdir(self.parent_dir) def tearDown(self): @@ -669,8 +681,13 @@ class CGIHTTPServerTestCase(BaseTestCase): os.remove(self.file3_path) if self.file4_path: os.remove(self.file4_path) + if self.file5_path: + os.remove(self.file5_path) os.rmdir(self.cgi_child_dir) os.rmdir(self.cgi_dir) + os.rmdir(self.cgi_dir_in_sub_dir) + os.rmdir(self.sub_dir_2) + os.rmdir(self.sub_dir_1) os.rmdir(self.parent_dir) finally: BaseTestCase.tearDown(self) @@ -789,6 +806,13 @@ class CGIHTTPServerTestCase(BaseTestCase): 'text/html', HTTPStatus.OK), (res.read(), res.getheader('Content-type'), res.status)) + def test_cgi_path_in_sub_directories(self): + CGIHTTPRequestHandler.cgi_directories.append('/sub/dir/cgi-bin') + res = self.request('/sub/dir/cgi-bin/file5.py') + self.assertEqual( + (b'Hello World' + self.linesep, 'text/html', HTTPStatus.OK), + (res.read(), res.getheader('Content-type'), res.status)) + class SocketlessRequestHandler(SimpleHTTPRequestHandler): def __init__(self, directory=None): diff --git a/Misc/NEWS.d/next/Library/2019-11-21-16-30-00.bpo-38863.RkdTjf.rst b/Misc/NEWS.d/next/Library/2019-11-21-16-30-00.bpo-38863.RkdTjf.rst new file mode 100644 index 00000000000..6b621eeea2f --- /dev/null +++ b/Misc/NEWS.d/next/Library/2019-11-21-16-30-00.bpo-38863.RkdTjf.rst @@ -0,0 +1,2 @@ +Improve :func:`is_cgi` function in :mod:`http.server`, which enables processing +the case that cgi directory is a child of another directory other than root.