[Python-checkins] cpython (merge 3.1 -> 3.2): merge 3.1 (#19435)

[benjamin.peterson]

http://hg.python.org/cpython/rev/dda1a32748e0
changeset:   86778:dda1a32748e0
branch:      3.2
parent:      85752:ef90c40fe6cf
parent:      86777:b1ddcb220a7f
user:        Benjamin Peterson <benjamin at python.org>
date:        Wed Oct 30 12:48:59 2013 -0400
summary:
  merge 3.1 (#19435)

files:
  Lib/http/server.py           |   9 ++++-----
  Lib/test/test_httpservers.py |  12 ++++++++++++
  Misc/NEWS                    |   2 ++
  3 files changed, 18 insertions(+), 5 deletions(-)


diff --git a/Lib/http/server.py b/Lib/http/server.py
--- a/Lib/http/server.py
+++ b/Lib/http/server.py
@@ -968,18 +968,17 @@
 
     def run_cgi(self):
         """Execute a CGI script."""
-        path = self.path
         dir, rest = self.cgi_info
 
-        i = path.find('/', len(dir) + 1)
+        i = rest.find('/')
         while i >= 0:
-            nextdir = path[:i]
-            nextrest = path[i+1:]
+            nextdir = rest[:i]
+            nextrest = rest[i+1:]
 
             scriptdir = self.translate_path(nextdir)
             if os.path.isdir(scriptdir):
                 dir, rest = nextdir, nextrest
-                i = path.find('/', len(dir) + 1)
+                i = rest.find('/')
             else:
                 break
 
diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
--- a/Lib/test/test_httpservers.py
+++ b/Lib/test/test_httpservers.py
@@ -322,6 +322,7 @@
         self.parent_dir = tempfile.mkdtemp()
         self.cgi_dir = os.path.join(self.parent_dir, 'cgi-bin')
         os.mkdir(self.cgi_dir)
+        self.nocgi_path = None
         self.file1_path = None
         self.file2_path = None
 
@@ -342,6 +343,11 @@
             self.tearDown()
             self.skipTest("Python executable path is not encodable to utf-8")
 
+        self.nocgi_path = os.path.join(self.parent_dir, 'nocgi.py')
+        with open(self.nocgi_path, 'w') as fp:
+            fp.write(cgi_file1 % self.pythonexe)
+        os.chmod(self.nocgi_path, 0o777)
+
         self.file1_path = os.path.join(self.cgi_dir, 'file1.py')
         with open(self.file1_path, 'w', encoding='utf-8') as file1:
             file1.write(cgi_file1 % self.pythonexe)
@@ -359,6 +365,8 @@
             os.chdir(self.cwd)
             if self.pythonexe != sys.executable:
                 os.remove(self.pythonexe)
+            if self.nocgi_path:
+                os.remove(self.nocgi_path)
             if self.file1_path:
                 os.remove(self.file1_path)
             if self.file2_path:
@@ -415,6 +423,10 @@
         self.assertEqual((b'Hello World' + self.linesep, 'text/html', 200),
             (res.read(), res.getheader('Content-type'), res.status))
 
+    def test_issue19435(self):
+        res = self.request('///////////nocgi.py/../cgi-bin/nothere.sh')
+        self.assertEqual(res.status, 404)
+
     def test_post(self):
         params = urllib.parse.urlencode(
             {'spam' : 1, 'eggs' : 'python', 'bacon' : 123456})
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,8 @@
 Library
 -------
 
+- Issue #19435: Fix directory traversal attack on CGIHttpRequestHandler.
+
 - Issue #14984: On POSIX systems, when netrc is called without a filename
   argument (and therefore is reading the user's $HOME/.netrc file), it now
   enforces the same security rules as typical ftp clients: the .netrc file must

-- 
Repository URL: http://hg.python.org/cpython