Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit d70846b

Browse files
orsenthilorsenthil
committed
3.2 - Issue 10484 - Incorporate improvements to CGI module - Suggested by Glenn Linderman. Refactor code and tests
1 parent f6cd9b2 commit d70846b

2 files changed

Lines changed: 56 additions & 51 deletions

File tree

‎Lib/http/server.py‎

Lines changed: 28 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -825,44 +825,47 @@ def guess_type(self, path):
825825

826826
# Utilities for CGIHTTPRequestHandler
827827

828-
# TODO(gregory.p.smith): Move this into an appropriate library.
829-
def _url_collapse_path_split(path):
828+
def _url_collapse_path(path):
830829
"""
831830
Given a URL path, remove extra '/'s and '.' path elements and collapse
832-
any '..' references.
831+
any '..' references and returns a colllapsed path.
833832
834833
Implements something akin to RFC-2396 5.2 step 6 to parse relative paths.
834+
The utility of this function is limited to is_cgi method and helps
835+
preventing some security attacks.
835836
836837
Returns: A tuple of (head, tail) where tail is everything after the final /
837838
and head is everything before it. Head will always start with a '/' and,
838839
if it contains anything else, never have a trailing '/'.
839840
840841
Raises: IndexError if too many '..' occur within the path.
842+
841843
"""
842844
# Similar to os.path.split(os.path.normpath(path)) but specific to URL
843845
# path semantics rather than local operating system semantics.
844-
path_parts = []
845-
for part in path.split('/'):
846-
if part == '.':
847-
path_parts.append('')
848-
else:
849-
path_parts.append(part)
850-
# Filter out blank non trailing parts before consuming the '..'.
851-
path_parts = [part for part in path_parts[:-1] if part] + path_parts[-1:]
846+
path_parts = path.split('/')
847+
head_parts = []
848+
for part in path_parts[:-1]:
849+
if part == '..':
850+
head_parts.pop() # IndexError if more '..' than prior parts
851+
elif part and part != '.':
852+
head_parts.append( part )
852853
if path_parts:
853854
tail_part = path_parts.pop()
855+
if tail_part:
856+
if tail_part == '..':
857+
head_parts.pop()
858+
tail_part = ''
859+
elif tail_part == '.':
860+
tail_part = ''
854861
else:
855862
tail_part = ''
856-
head_parts = []
857-
for part in path_parts:
858-
if part == '..':
859-
head_parts.pop()
860-
else:
861-
head_parts.append(part)
862-
if tail_part and tail_part == '..':
863-
head_parts.pop()
864-
tail_part = ''
865-
return ('/' + '/'.join(head_parts), tail_part)
863+
864+
splitpath = ('/' + '/'.join(head_parts), tail_part)
865+
collapsed_path = "/".join(splitpath)
866+
867+
return collapsed_path
868+
866869

867870

868871
nobody = None
@@ -943,16 +946,15 @@ def is_cgi(self):
943946
(and the next character is a '/' or the end of the string).
944947
945948
"""
946-
947-
splitpath = _url_collapse_path_split(self.path)
948-
joined_path = '/'.join(splitpath)
949-
dir_sep = joined_path.find('/',1)
950-
head, tail = joined_path[:dir_sep], joined_path[dir_sep+1:]
949+
collapsed_path = _url_collapse_path(self.path)
950+
dir_sep = collapsed_path.find('/', 1)
951+
head, tail = collapsed_path[:dir_sep], collapsed_path[dir_sep+1:]
951952
if head in self.cgi_directories:
952953
self.cgi_info = head, tail
953954
return True
954955
return False
955956

957+
956958
cgi_directories = ['/cgi-bin', '/htbin']
957959

958960
def is_executable(self, path):

‎Lib/test/test_httpservers.py‎

Lines changed: 28 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -366,41 +366,44 @@ def tearDown(self):
366366
finally:
367367
BaseTestCase.tearDown(self)
368368

369-
def test_url_collapse_path_split(self):
369+
def test_url_collapse_path(self):
370+
# verify tail is the last portion and head is the rest on proper urls
370371
test_vectors = {
371-
'': ('/', ''),
372+
'': '//',
372373
'..': IndexError,
373374
'/.//..': IndexError,
374-
'/': ('/', ''),
375-
'//': ('/', ''),
376-
'/\\': ('/', '\\'),
377-
'/.//': ('/', ''),
378-
'cgi-bin/file1.py': ('/cgi-bin', 'file1.py'),
379-
'/cgi-bin/file1.py': ('/cgi-bin', 'file1.py'),
380-
'a': ('/', 'a'),
381-
'/a': ('/', 'a'),
382-
'//a': ('/', 'a'),
383-
'./a': ('/', 'a'),
384-
'./C:/': ('/C:', ''),
385-
'/a/b': ('/a', 'b'),
386-
'/a/b/': ('/a/b', ''),
387-
'/a/b/c/..': ('/a/b', ''),
388-
'/a/b/c/../d': ('/a/b', 'd'),
389-
'/a/b/c/../d/e/../f': ('/a/b/d', 'f'),
390-
'/a/b/c/../d/e/../../f': ('/a/b', 'f'),
391-
'/a/b/c/../d/e/.././././..//f': ('/a/b', 'f'),
375+
'/': '//',
376+
'//': '//',
377+
'/\\': '//\\',
378+
'/.//': '//',
379+
'cgi-bin/file1.py': '/cgi-bin/file1.py',
380+
'/cgi-bin/file1.py': '/cgi-bin/file1.py',
381+
'a': '//a',
382+
'/a': '//a',
383+
'//a': '//a',
384+
'./a': '//a',
385+
'./C:/': '/C:/',
386+
'/a/b': '/a/b',
387+
'/a/b/': '/a/b/',
388+
'/a/b/.': '/a/b/',
389+
'/a/b/c/..': '/a/b/',
390+
'/a/b/c/../d': '/a/b/d',
391+
'/a/b/c/../d/e/../f': '/a/b/d/f',
392+
'/a/b/c/../d/e/../../f': '/a/b/f',
393+
'/a/b/c/../d/e/.././././..//f': '/a/b/f',
392394
'../a/b/c/../d/e/.././././..//f': IndexError,
393-
'/a/b/c/../d/e/../../../f': ('/a', 'f'),
394-
'/a/b/c/../d/e/../../../../f': ('/', 'f'),
395+
'/a/b/c/../d/e/../../../f': '/a/f',
396+
'/a/b/c/../d/e/../../../../f': '//f',
395397
'/a/b/c/../d/e/../../../../../f': IndexError,
396-
'/a/b/c/../d/e/../../../../f/..': ('/', ''),
398+
'/a/b/c/../d/e/../../../../f/..': '//',
399+
'/a/b/c/../d/e/../../../../f/../.': '//',
397400
}
398401
for path, expected in test_vectors.items():
399402
if isinstance(expected, type) and issubclass(expected, Exception):
400403
self.assertRaises(expected,
401-
server._url_collapse_path_split, path)
404+
server._url_collapse_path, path)
402405
else:
403-
actual = server._url_collapse_path_split(path)
406+
actual = server._url_collapse_path(path)
404407
self.assertEqual(expected, actual,
405408
msg='path = %r\nGot: %r\nWanted: %r' %
406409
(path, actual, expected))

0 commit comments

Comments
 (0)