Mirror
/
cpython
mirror of https://github.com/python/cpython
4
1
Fork 0
Code Issues Releases Wiki Activity

merge 3.3 (#21766)

This commit is contained in:
Benjamin Peterson 2014-06-14 18:41:13 -07:00
parent 0220048083 6cd1954c5c
commit a8c75fe31a
3 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Lib/http/server.py
View File

@ -977,7 +977,7 @@ class CGIHTTPRequestHandler(SimpleHTTPRequestHandler):
(and the next character is a '/' or the end of the string). (and the next character is a '/' or the end of the string).
""" """
collapsed_path = _url_collapse_path(self.path) collapsed_path = _url_collapse_path(urllib.parse.unquote(self.path))
dir_sep = collapsed_path.find('/', 1) dir_sep = collapsed_path.find('/', 1)
head, tail = collapsed_path[:dir_sep], collapsed_path[dir_sep+1:] head, tail = collapsed_path[:dir_sep], collapsed_path[dir_sep+1:]
if head in self.cgi_directories: if head in self.cgi_directories:

5
Lib/test/test_httpservers.py
View File

@ -485,6 +485,11 @@ class CGIHTTPServerTestCase(BaseTestCase):
(res.read(), res.getheader('Content-type'), res.status)) (res.read(), res.getheader('Content-type'), res.status))
self.assertEqual(os.environ['SERVER_SOFTWARE'], signature) self.assertEqual(os.environ['SERVER_SOFTWARE'], signature)
def test_urlquote_decoding_in_cgi_check(self):
res = self.request('/cgi-bin%2ffile1.py')
self.assertEqual((b'Hello World\n', 'text/html', 200),
(res.read(), res.getheader('Content-type'), res.status))
class SocketlessRequestHandler(SimpleHTTPRequestHandler): class SocketlessRequestHandler(SimpleHTTPRequestHandler):
def __init__(self): def __init__(self):

3
Misc/NEWS
View File

@ -26,6 +26,9 @@ Library
run_forever() and run_until_complete() methods of asyncio.BaseEventLoop now run_forever() and run_until_complete() methods of asyncio.BaseEventLoop now
raise an exception if the event loop was closed. raise an exception if the event loop was closed.
- Issue #21766: Prevent a security hole in CGIHTTPServer by URL unquoting paths
before checking for a CGI script at that path.
- Issue #21310: Fixed possible resource leak in failed open(). - Issue #21310: Fixed possible resource leak in failed open().
- Issue #21677: Fixed chaining nonnormalized exceptions in io close() methods. - Issue #21677: Fixed chaining nonnormalized exceptions in io close() methods.