[Python-checkins] cpython (2.7): use the collapsed path in the run_cgi method (closes #19435)
benjamin.peterson
python-checkins at python.org
Wed Oct 30 17:51:29 CET 2013
http://hg.python.org/cpython/rev/e4fe8fcaef0d
changeset: 86775:e4fe8fcaef0d
branch: 2.7
parent: 86766:bcbe4099206f
user: Benjamin Peterson <benjamin at python.org>
date: Wed Oct 30 12:43:09 2013 -0400
summary:
use the collapsed path in the run_cgi method (closes #19435)
files:
Lib/CGIHTTPServer.py | 9 ++++-----
Lib/test/test_httpservers.py | 10 ++++++++++
Misc/NEWS | 5 +++++
3 files changed, 19 insertions(+), 5 deletions(-)
diff --git a/Lib/CGIHTTPServer.py b/Lib/CGIHTTPServer.py
--- a/Lib/CGIHTTPServer.py
+++ b/Lib/CGIHTTPServer.py
@@ -105,18 +105,17 @@
def run_cgi(self):
"""Execute a CGI script."""
- path = self.path
dir, rest = self.cgi_info
- i = path.find('/', len(dir) + 1)
+ i = rest.find('/')
while i >= 0:
- nextdir = path[:i]
- nextrest = path[i+1:]
+ nextdir = rest[:i]
+ nextrest = rest[i+1:]
scriptdir = self.translate_path(nextdir)
if os.path.isdir(scriptdir):
dir, rest = nextdir, nextrest
- i = path.find('/', len(dir) + 1)
+ i = rest.find('/')
else:
break
diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
--- a/Lib/test/test_httpservers.py
+++ b/Lib/test/test_httpservers.py
@@ -396,6 +396,11 @@
else:
self.pythonexe = sys.executable
+ self.nocgi_path = os.path.join(self.parent_dir, 'nocgi.py')
+ with open(self.nocgi_path, 'w') as fp:
+ fp.write(cgi_file1 % self.pythonexe)
+ os.chmod(self.nocgi_path, 0777)
+
self.file1_path = os.path.join(self.cgi_dir, 'file1.py')
with open(self.file1_path, 'w') as file1:
file1.write(cgi_file1 % self.pythonexe)
@@ -414,6 +419,7 @@
os.chdir(self.cwd)
if self.pythonexe != sys.executable:
os.remove(self.pythonexe)
+ os.remove(self.nocgi_path)
os.remove(self.file1_path)
os.remove(self.file2_path)
os.rmdir(self.cgi_dir)
@@ -468,6 +474,10 @@
self.assertEqual(('Hello World\n', 'text/html', 200),
(res.read(), res.getheader('Content-type'), res.status))
+ def test_issue19435(self):
+ res = self.request('///////////nocgi.py/../cgi-bin/nothere.sh')
+ self.assertEqual(res.status, 404)
+
def test_post(self):
params = urllib.urlencode({'spam' : 1, 'eggs' : 'python', 'bacon' : 123456})
headers = {'Content-type' : 'application/x-www-form-urlencoded'}
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -6,6 +6,11 @@
*Release date: 2013-11-02*
+Library
+-------
+
+- Issue #19435: Fix directory traversal attack on CGIHttpRequestHandler.
+
IDLE
----
--
Repository URL: http://hg.python.org/cpython
More information about the Python-checkins
mailing list