diff options
| author | Andrew M. Kuchling <amk@amk.ca> | 2006-05-31 14:08:48 (GMT) |
|---|---|---|
| committer | Andrew M. Kuchling <amk@amk.ca> | 2006-05-31 14:08:48 (GMT) |
| commit | 622f14417521bcc94d39f6da638ee539c2cbaeb7 (patch) | |
| tree | 103f3e45d7e7c49e7fa8ebdc1c00c3df7dad4151 /Lib/DocXMLRPCServer.py | |
| parent | bc09e1086e971d0dd4b846064832d23855eb0cd6 (diff) | |
| download | cpython-622f14417521bcc94d39f6da638ee539c2cbaeb7.zip cpython-622f14417521bcc94d39f6da638ee539c2cbaeb7.tar.gz cpython-622f14417521bcc94d39f6da638ee539c2cbaeb7.tar.bz2 | |
[Bug #1473048]
SimpleXMLRPCServer and DocXMLRPCServer don't look at
the path of the HTTP request at all; you can POST or
GET from / or /RPC2 or /blahblahblah with the same results.
Security scanners that look for /cgi-bin/phf will therefore report
lots of vulnerabilities.
Fix: add a .rpc_paths attribute to the SimpleXMLRPCServer class,
and report a 404 error if the path isn't on the allowed list.
Possibly-controversial aspect of this change: the default makes only
'/' and '/RPC2' legal. Maybe this will break people's applications
(though I doubt it). We could just set the default to an empty tuple,
which would exactly match the current behaviour.
Diffstat (limited to 'Lib/DocXMLRPCServer.py')
| -rw-r--r-- | Lib/DocXMLRPCServer.py | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/Lib/DocXMLRPCServer.py b/Lib/DocXMLRPCServer.py index 259fb18..86ed32b 100644 --- a/Lib/DocXMLRPCServer.py +++ b/Lib/DocXMLRPCServer.py @@ -227,6 +227,10 @@ class DocXMLRPCRequestHandler(SimpleXMLRPCRequestHandler): Interpret all HTTP GET requests as requests for server documentation. """ + # Check that the path is legal + if not self.is_rpc_path_valid(): + self.report_404() + return response = self.server.generate_html_documentation() self.send_response(200) |