diff options
| author | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2022-06-21 21:36:55 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-06-21 21:36:55 (GMT) |
| commit | 5715382d3a89ca118ce2e224d8c69550d21fe51b (patch) | |
| tree | 46ebc130ad6c07de319b0a9f7078766e2f6e4b22 /Lib/http/server.py | |
| parent | 1b8aa7aafd2ac07836777707fd9ba5ffb353eb0c (diff) | |
| download | cpython-5715382d3a89ca118ce2e224d8c69550d21fe51b.zip cpython-5715382d3a89ca118ce2e224d8c69550d21fe51b.tar.gz cpython-5715382d3a89ca118ce2e224d8c69550d21fe51b.tar.bz2 | |
gh-87389: Fix an open redirection vulnerability in http.server. (GH-93879)
Fix an open redirection vulnerability in the `http.server` module when
an URI path starts with `//` that could produce a 301 Location header
with a misleading target. Vulnerability discovered, and logic fix
proposed, by Hamza Avvan (@hamzaavvan).
Test and comments authored by Gregory P. Smith [Google].
(cherry picked from commit 4abab6b603dd38bec1168e9a37c40a48ec89508e)
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Diffstat (limited to 'Lib/http/server.py')
| -rw-r--r-- | Lib/http/server.py | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/Lib/http/server.py b/Lib/http/server.py index 58abadf..e8517a7 100644 --- a/Lib/http/server.py +++ b/Lib/http/server.py @@ -330,6 +330,13 @@ class BaseHTTPRequestHandler(socketserver.StreamRequestHandler): return False self.command, self.path = command, path + # gh-87389: The purpose of replacing '//' with '/' is to protect + # against open redirect attacks possibly triggered if the path starts + # with '//' because http clients treat //path as an absolute URI + # without scheme (similar to http://path) rather than a path. + if self.path.startswith('//'): + self.path = '/' + self.path.lstrip('/') # Reduce to a single / + # Examine the headers and look for a Connection directive. try: self.headers = http.client.parse_headers(self.rfile, |