From 8d24d77c63bdbf25d68bf0a6cad408d06abf2d00 Mon Sep 17 00:00:00 2001 From: Benjamin Peterson Date: Sat, 14 Jun 2014 18:36:29 -0700 Subject: [PATCH] url unquote the path before checking if it refers to a CGI script (closes #21766) --- Lib/CGIHTTPServer.py | 2 +- Lib/test/test_httpservers.py | 5 +++++ Misc/NEWS | 3 +++ 3 files changed, 9 insertions(+), 1 deletion(-) diff --git a/Lib/CGIHTTPServer.py b/Lib/CGIHTTPServer.py index 50e0f7ae195..2acf9131550 100644 --- a/Lib/CGIHTTPServer.py +++ b/Lib/CGIHTTPServer.py @@ -84,7 +84,7 @@ class CGIHTTPRequestHandler(SimpleHTTPServer.SimpleHTTPRequestHandler): path begins with one of the strings in self.cgi_directories (and the next character is a '/' or the end of the string). """ - collapsed_path = _url_collapse_path(self.path) + collapsed_path = _url_collapse_path(urllib.unquote(self.path)) dir_sep = collapsed_path.find('/', 1) head, tail = collapsed_path[:dir_sep], collapsed_path[dir_sep+1:] if head in self.cgi_directories: diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py index 2390c70a1d6..6a23bb2e0df 100644 --- a/Lib/test/test_httpservers.py +++ b/Lib/test/test_httpservers.py @@ -510,6 +510,11 @@ class CGIHTTPServerTestCase(BaseTestCase): (res.read(), res.getheader('Content-type'), res.status)) self.assertEqual(os.environ['SERVER_SOFTWARE'], signature) + def test_urlquote_decoding_in_cgi_check(self): + res = self.request('/cgi-bin%2ffile1.py') + self.assertEqual((b'Hello World\n', 'text/html', 200), + (res.read(), res.getheader('Content-type'), res.status)) + class SimpleHTTPRequestHandlerTestCase(unittest.TestCase): """ Test url parsing """ diff --git a/Misc/NEWS b/Misc/NEWS index b09bd84f5ea..310d2370f6a 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -25,6 +25,9 @@ Core and Builtins Library ------- +- Issue #21766: Prevent a security hole in CGIHTTPServer by URL unquoting paths + before checking for a CGI script at that path. + - Issue #21310: Fixed possible resource leak in failed open(). - Issue #21304: Backport the key derivation function hashlib.pbkdf2_hmac from