[Python-checkins] [3.8] gh-81054: Document that SimpleHTTPRequestHandler follows symbolic links (GH-94416) (GH-94495)
ambv
webhook-mailer at python.org
Fri Jul 1 12:42:18 EDT 2022
https://github.com/python/cpython/commit/bd0f2a1955f99dc504d6c7bed495ec2a0ee74859
commit: bd0f2a1955f99dc504d6c7bed495ec2a0ee74859
branch: 3.8
author: Łukasz Langa <lukasz at langa.pl>
committer: ambv <lukasz at langa.pl>
date: 2022-07-01T18:42:13+02:00
summary:
[3.8] gh-81054: Document that SimpleHTTPRequestHandler follows symbolic links (GH-94416) (GH-94495)
(cherry picked from commit 80aaeabb8bd1e6b49598a7e23e0f8d99b3fcecaf)
Co-authored-by: Sam Ezeh <sam.z.ezeh at gmail.com>
files:
M Doc/library/http.server.rst
diff --git a/Doc/library/http.server.rst b/Doc/library/http.server.rst
index d54bd05cddded..0ba509181acd1 100644
--- a/Doc/library/http.server.rst
+++ b/Doc/library/http.server.rst
@@ -20,7 +20,7 @@ This module defines classes for implementing HTTP servers (Web servers).
.. warning::
:mod:`http.server` is not recommended for production. It only implements
- basic security checks.
+ :ref:`basic security checks <http.server-security>`.
One class, :class:`HTTPServer`, is a :class:`socketserver.TCPServer` subclass.
It creates and listens at the HTTP socket, dispatching the requests to a
@@ -477,3 +477,14 @@ the following command uses a specific directory::
the ``--cgi`` option::
python -m http.server --cgi 8000
+
+.. _http.server-security:
+
+Security Considerations
+-----------------------
+
+.. index:: pair: http.server; security
+
+:class:`SimpleHTTPRequestHandler` will follow symbolic links when handling
+requests, this makes it possible for files outside of the specified directory
+to be served.
More information about the Python-checkins
mailing list