[Python-checkins] GH-5054: CGIHTTPRequestHandler.run_cgi() HTTP_ACCEPT improperly parsed (#23638)
orsenthil
webhook-mailer at python.org
Sat Dec 5 08:26:28 EST 2020
https://github.com/python/cpython/commit/da3d2abe6be9fcf18cac12ec5d7d9f1180d94b5e
commit: da3d2abe6be9fcf18cac12ec5d7d9f1180d94b5e
branch: master
author: Senthil Kumaran <senthil at uthcode.com>
committer: orsenthil <skumaran at gatech.edu>
date: 2020-12-05T05:26:24-08:00
summary:
GH-5054: CGIHTTPRequestHandler.run_cgi() HTTP_ACCEPT improperly parsed (#23638)
files:
A Misc/NEWS.d/next/Library/2020-12-04-03-51-12.bpo-5054.53StYZ.rst
M Lib/http/server.py
M Lib/test/test_httpservers.py
diff --git a/Lib/http/server.py b/Lib/http/server.py
index c611381177d43..94f730ed3445b 100644
--- a/Lib/http/server.py
+++ b/Lib/http/server.py
@@ -1122,12 +1122,7 @@ def run_cgi(self):
referer = self.headers.get('referer')
if referer:
env['HTTP_REFERER'] = referer
- accept = []
- for line in self.headers.getallmatchingheaders('accept'):
- if line[:1] in "\t\n\r ":
- accept.append(line.strip())
- else:
- accept = accept + line[7:].split(',')
+ accept = self.headers.get_all('accept', ())
env['HTTP_ACCEPT'] = ','.join(accept)
ua = self.headers.get('user-agent')
if ua:
diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
index 2859abb21fc9f..c3d7c8feb1ec0 100644
--- a/Lib/test/test_httpservers.py
+++ b/Lib/test/test_httpservers.py
@@ -3,7 +3,7 @@
Written by Cody A.W. Somerville <cody-somerville at ubuntu.com>,
Josip Dzolonga, and Michael Otteneder for the 2007/08 GHOP contest.
"""
-
+from collections import OrderedDict
from http.server import BaseHTTPRequestHandler, HTTPServer, \
SimpleHTTPRequestHandler, CGIHTTPRequestHandler
from http import server, HTTPStatus
@@ -19,7 +19,7 @@
import email.message
import email.utils
import html
-import http.client
+import http, http.client
import urllib.parse
import tempfile
import time
@@ -588,6 +588,15 @@ def test_html_escape_filename(self):
print(os.environ["%s"])
"""
+cgi_file6 = """\
+#!%s
+import os
+
+print("Content-type: text/plain")
+print()
+print(repr(os.environ))
+"""
+
@unittest.skipIf(hasattr(os, 'geteuid') and os.geteuid() == 0,
"This test can't be run reliably as root (issue #13308).")
@@ -666,6 +675,11 @@ def setUp(self):
file5.write(cgi_file1 % self.pythonexe)
os.chmod(self.file5_path, 0o777)
+ self.file6_path = os.path.join(self.cgi_dir, 'file6.py')
+ with open(self.file6_path, 'w', encoding='utf-8') as file6:
+ file6.write(cgi_file6 % self.pythonexe)
+ os.chmod(self.file6_path, 0o777)
+
os.chdir(self.parent_dir)
def tearDown(self):
@@ -685,6 +699,8 @@ def tearDown(self):
os.remove(self.file4_path)
if self.file5_path:
os.remove(self.file5_path)
+ if self.file6_path:
+ os.remove(self.file6_path)
os.rmdir(self.cgi_child_dir)
os.rmdir(self.cgi_dir)
os.rmdir(self.cgi_dir_in_sub_dir)
@@ -818,6 +834,23 @@ def test_cgi_path_in_sub_directories(self):
finally:
CGIHTTPRequestHandler.cgi_directories.remove('/sub/dir/cgi-bin')
+ def test_accept(self):
+ browser_accept = \
+ 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'
+ tests = (
+ ((('Accept', browser_accept),), browser_accept),
+ ((), ''),
+ # Hack case to get two values for the one header
+ ((('Accept', 'text/html'), ('ACCEPT', 'text/plain')),
+ 'text/html,text/plain'),
+ )
+ for headers, expected in tests:
+ headers = OrderedDict(headers)
+ with self.subTest(headers):
+ res = self.request('/cgi-bin/file6.py', 'GET', headers=headers)
+ self.assertEqual(http.HTTPStatus.OK, res.status)
+ expected = f"'HTTP_ACCEPT': {expected!r}"
+ self.assertIn(expected.encode('ascii'), res.read())
class SocketlessRequestHandler(SimpleHTTPRequestHandler):
diff --git a/Misc/NEWS.d/next/Library/2020-12-04-03-51-12.bpo-5054.53StYZ.rst b/Misc/NEWS.d/next/Library/2020-12-04-03-51-12.bpo-5054.53StYZ.rst
new file mode 100644
index 0000000000000..ad8163c7c1d20
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2020-12-04-03-51-12.bpo-5054.53StYZ.rst
@@ -0,0 +1,5 @@
+CGIHTTPRequestHandler.run_cgi() HTTP_ACCEPT improperly parsed. Replace the
+special purpose getallmatchingheaders with generic get_all method and add
+relevant tests.
+
+Original Patch by Martin Panter. Modified by Senthil Kumaran.
More information about the Python-checkins
mailing list