Stowage/cpython
2
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2026-01-04 14:32:21 +00:00
Code Issues Projects Releases Packages Wiki Activity

[3.13] gh-134098: Fix handling %-encoded trailing slash in SimpleHTTPRequestHandler (GH-134099) (GH-134124)

Browse source 
(cherry picked from commit 2f1ecb3bc4)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
This commit is contained in:
Miss Islington (bot) 2025-05-17 09:33:42 +02:00 • committed by GitHub
parent 6dae082584
commit bc0dc9d4ef
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 17 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
Lib/http/server.py
View file

@ -701,7 +701,7 @@ def send_head(self):
f = None
if os.path.isdir(path):
parts = urllib.parse.urlsplit(self.path)
if not parts.path.endswith('/'):
if not parts.path.endswith(('/', '%2f', '%2F')):
# redirect browser - doing basically what apache does
self.send_response(HTTPStatus.MOVED_PERMANENTLY)
new_parts = (parts[0], parts[1], parts[2] + '/',
@ -840,14 +840,14 @@ def translate_path(self, path):
"""
# abandon query parameters
path = path.split('?',1)[0]
path = path.split('#',1)[0]
path = path.split('#', 1)[0]
path = path.split('?', 1)[0]
# Don't forget explicit trailing slash when normalizing. Issue17324
trailing_slash = path.rstrip().endswith('/')
try:
path = urllib.parse.unquote(path, errors='surrogatepass')
except UnicodeDecodeError:
path = urllib.parse.unquote(path)
trailing_slash = path.endswith('/')
path = posixpath.normpath(path)
words = path.split('/')
words = filter(None, words)

11
Lib/test/test_httpservers.py
View file

@ -581,10 +581,19 @@ def test_get(self):
# check for trailing "/" which should return 404. See Issue17324
response = self.request(self.base_url + '/test/')
self.check_status_and_reason(response, HTTPStatus.NOT_FOUND)
response = self.request(self.base_url + '/test%2f')
self.check_status_and_reason(response, HTTPStatus.NOT_FOUND)
response = self.request(self.base_url + '/test%2F')
self.check_status_and_reason(response, HTTPStatus.NOT_FOUND)
response = self.request(self.base_url + '/')
self.check_status_and_reason(response, HTTPStatus.OK)
response = self.request(self.base_url + '%2f')
self.check_status_and_reason(response, HTTPStatus.OK)
response = self.request(self.base_url + '%2F')
self.check_status_and_reason(response, HTTPStatus.OK)
response = self.request(self.base_url)
self.check_status_and_reason(response, HTTPStatus.MOVED_PERMANENTLY)
self.assertEqual(response.getheader("Location"), self.base_url + "/")
self.assertEqual(response.getheader("Content-Length"), "0")
response = self.request(self.base_url + '/?hi=2')
self.check_status_and_reason(response, HTTPStatus.OK)
@ -690,6 +699,8 @@ def test_path_without_leading_slash(self):
self.check_status_and_reason(response, HTTPStatus.OK)
response = self.request(self.tempdir_name)
self.check_status_and_reason(response, HTTPStatus.MOVED_PERMANENTLY)
self.assertEqual(response.getheader("Location"),
self.tempdir_name + "/")
response = self.request(self.tempdir_name + '/?hi=2')
self.check_status_and_reason(response, HTTPStatus.OK)
response = self.request(self.tempdir_name + '?hi=1')

2
Misc/NEWS.d/next/Library/2025-05-16-20-10-25.gh-issue-134098.YyTkKr.rst Normal file
View file

@ -0,0 +1,2 @@
Fix handling paths that end with a percent-encoded slash (``%2f`` or
``%2F``) in :class:`http.server.SimpleHTTPRequestHandler`.