An interpreted, interactive, object-oriented programming language
CentOS Sources
2017-08-01 71084d584ff953f5463757ec6536406320560b4d
commit | author | age
f63228 1
CS 2 # HG changeset patch
3 # User Benjamin Peterson <benjamin@python.org>
4 # Date 1402796189 25200
5 # Node ID b4bab078876811c7d95231d08aa6fa7142fdda66
6 # Parent  bb8b0c7fefd0c5ed99b3f336178a4f9554a1d0ef
7 url unquote the path before checking if it refers to a CGI script (closes #21766)
8
9 diff --git a/Lib/CGIHTTPServer.py b/Lib/CGIHTTPServer.py
10 --- a/Lib/CGIHTTPServer.py
11 +++ b/Lib/CGIHTTPServer.py
12 @@ -84,7 +84,7 @@ class CGIHTTPRequestHandler(SimpleHTTPSe
13          path begins with one of the strings in self.cgi_directories
14          (and the next character is a '/' or the end of the string).
15          """
16 -        collapsed_path = _url_collapse_path(self.path)
17 +        collapsed_path = _url_collapse_path(urllib.unquote(self.path))
18          dir_sep = collapsed_path.find('/', 1)
19          head, tail = collapsed_path[:dir_sep], collapsed_path[dir_sep+1:]
20          if head in self.cgi_directories:
21 diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
22 --- a/Lib/test/test_httpservers.py
23 +++ b/Lib/test/test_httpservers.py
24 @@ -510,6 +510,11 @@ class CGIHTTPServerTestCase(BaseTestCase
25                  (res.read(), res.getheader('Content-type'), res.status))
26          self.assertEqual(os.environ['SERVER_SOFTWARE'], signature)
27  
28 +    def test_urlquote_decoding_in_cgi_check(self):
29 +        res = self.request('/cgi-bin%2ffile1.py')
30 +        self.assertEqual((b'Hello World\n', 'text/html', 200),
31 +                (res.read(), res.getheader('Content-type'), res.status))
32 +
33  
34  class SimpleHTTPRequestHandlerTestCase(unittest.TestCase):
35      """ Test url parsing """