[Python-checkins] bpo-38863: Improve is_cgi() in http.server (GH-17312)
Miss Islington (bot)
webhook-mailer at python.org
Fri Nov 22 04:13:11 EST 2019
https://github.com/python/cpython/commit/91daa9d7224626dad4bb820924c01b3438ca6e3f
commit: 91daa9d7224626dad4bb820924c01b3438ca6e3f
branch: master
author: Siwon Kang <kkangshawn at gmail.com>
committer: Miss Islington (bot) <31488909+miss-islington at users.noreply.github.com>
date: 2019-11-22T01:13:05-08:00
summary:
bpo-38863: Improve is_cgi() in http.server (GH-17312)
is_cgi() function of http.server library does not currently handle a
cgi script if one of the cgi_directories is located at the
sub-directory of given path. Since is_cgi() in CGIHTTPRequestHandler
class separates given path into (dir, rest) based on the first seen
'/', multi-level directories like /sub/dir/cgi-bin/hello.py is divided
into head=/sub, rest=dir/cgi-bin/hello.py then check whether '/sub'
exists in cgi_directories = [..., '/sub/dir/cgi-bin'].
This patch makes the is_cgi() keep expanding dir part to the next '/'
then checking if that expanded path exists in the cgi_directories.
Signed-off-by: Siwon Kang <kkangshawn at gmail.com>
https://bugs.python.org/issue38863
files:
A Misc/NEWS.d/next/Library/2019-11-21-16-30-00.bpo-38863.RkdTjf.rst
M Lib/http/server.py
M Lib/test/test_httpservers.py
diff --git a/Lib/http/server.py b/Lib/http/server.py
index 005dd824f9a71..47a4fcf9a6518 100644
--- a/Lib/http/server.py
+++ b/Lib/http/server.py
@@ -1014,8 +1014,10 @@ def is_cgi(self):
"""
collapsed_path = _url_collapse_path(self.path)
dir_sep = collapsed_path.find('/', 1)
- head, tail = collapsed_path[:dir_sep], collapsed_path[dir_sep+1:]
- if head in self.cgi_directories:
+ while dir_sep > 0 and not collapsed_path[:dir_sep] in self.cgi_directories:
+ dir_sep = collapsed_path.find('/', dir_sep+1)
+ if dir_sep > 0:
+ head, tail = collapsed_path[:dir_sep], collapsed_path[dir_sep+1:]
self.cgi_info = head, tail
return True
return False
diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
index 1c980a2fa66ea..26da71e0b2701 100644
--- a/Lib/test/test_httpservers.py
+++ b/Lib/test/test_httpservers.py
@@ -601,13 +601,20 @@ def setUp(self):
self.parent_dir = tempfile.mkdtemp()
self.cgi_dir = os.path.join(self.parent_dir, 'cgi-bin')
self.cgi_child_dir = os.path.join(self.cgi_dir, 'child-dir')
+ self.sub_dir_1 = os.path.join(self.parent_dir, 'sub')
+ self.sub_dir_2 = os.path.join(self.sub_dir_1, 'dir')
+ self.cgi_dir_in_sub_dir = os.path.join(self.sub_dir_2, 'cgi-bin')
os.mkdir(self.cgi_dir)
os.mkdir(self.cgi_child_dir)
+ os.mkdir(self.sub_dir_1)
+ os.mkdir(self.sub_dir_2)
+ os.mkdir(self.cgi_dir_in_sub_dir)
self.nocgi_path = None
self.file1_path = None
self.file2_path = None
self.file3_path = None
self.file4_path = None
+ self.file5_path = None
# The shebang line should be pure ASCII: use symlink if possible.
# See issue #7668.
@@ -652,6 +659,11 @@ def setUp(self):
file4.write(cgi_file4 % (self.pythonexe, 'QUERY_STRING'))
os.chmod(self.file4_path, 0o777)
+ self.file5_path = os.path.join(self.cgi_dir_in_sub_dir, 'file5.py')
+ with open(self.file5_path, 'w', encoding='utf-8') as file5:
+ file5.write(cgi_file1 % self.pythonexe)
+ os.chmod(self.file5_path, 0o777)
+
os.chdir(self.parent_dir)
def tearDown(self):
@@ -669,8 +681,13 @@ def tearDown(self):
os.remove(self.file3_path)
if self.file4_path:
os.remove(self.file4_path)
+ if self.file5_path:
+ os.remove(self.file5_path)
os.rmdir(self.cgi_child_dir)
os.rmdir(self.cgi_dir)
+ os.rmdir(self.cgi_dir_in_sub_dir)
+ os.rmdir(self.sub_dir_2)
+ os.rmdir(self.sub_dir_1)
os.rmdir(self.parent_dir)
finally:
BaseTestCase.tearDown(self)
@@ -789,6 +806,13 @@ def test_query_with_continuous_slashes(self):
'text/html', HTTPStatus.OK),
(res.read(), res.getheader('Content-type'), res.status))
+ def test_cgi_path_in_sub_directories(self):
+ CGIHTTPRequestHandler.cgi_directories.append('/sub/dir/cgi-bin')
+ res = self.request('/sub/dir/cgi-bin/file5.py')
+ self.assertEqual(
+ (b'Hello World' + self.linesep, 'text/html', HTTPStatus.OK),
+ (res.read(), res.getheader('Content-type'), res.status))
+
class SocketlessRequestHandler(SimpleHTTPRequestHandler):
def __init__(self, directory=None):
diff --git a/Misc/NEWS.d/next/Library/2019-11-21-16-30-00.bpo-38863.RkdTjf.rst b/Misc/NEWS.d/next/Library/2019-11-21-16-30-00.bpo-38863.RkdTjf.rst
new file mode 100644
index 0000000000000..6b621eeea2fb6
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2019-11-21-16-30-00.bpo-38863.RkdTjf.rst
@@ -0,0 +1,2 @@
+Improve :func:`is_cgi` function in :mod:`http.server`, which enables processing
+the case that cgi directory is a child of another directory other than root.
More information about the Python-checkins
mailing list