diff options
| author | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2023-05-22 10:40:50 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-05-22 10:40:50 (GMT) |
| commit | b53d0ff4312cc2a67b9c5752844b140c08514648 (patch) | |
| tree | 3deb249e119fac73e382c2637e8a985068872773 /Lib/test/test_httpservers.py | |
| parent | d1645ce4f1075d0a6ce051aa10f54f35489aa605 (diff) | |
| download | cpython-b53d0ff4312cc2a67b9c5752844b140c08514648.zip cpython-b53d0ff4312cc2a67b9c5752844b140c08514648.tar.gz cpython-b53d0ff4312cc2a67b9c5752844b140c08514648.tar.bz2 | |
[3.9] gh-104049: do not expose on-disk location from SimpleHTTPRequestHandler (GH-104067) (#104120)
Do not expose the local server's on-disk location from `SimpleHTTPRequestHandler` when generating a directory index. (unnecessary information disclosure)
(cherry picked from commit c7c3a60c88de61a79ded9fdaf6bc6a29da4efb9a)
Co-authored-by: Ethan Furman <ethan@stoneleaf.us>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com>
Diffstat (limited to 'Lib/test/test_httpservers.py')
| -rw-r--r-- | Lib/test/test_httpservers.py | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py index db9ee29..153206d 100644 --- a/Lib/test/test_httpservers.py +++ b/Lib/test/test_httpservers.py @@ -415,6 +415,14 @@ class SimpleHTTPServerTestCase(BaseTestCase): self.check_status_and_reason(response, HTTPStatus.OK, data=support.TESTFN_UNDECODABLE) + def test_undecodable_parameter(self): + # sanity check using a valid parameter + response = self.request(self.base_url + '/?x=123').read() + self.assertRegex(response, f'listing for {self.base_url}/\?x=123'.encode('latin1')) + # now the bogus encoding + response = self.request(self.base_url + '/?x=%bb').read() + self.assertRegex(response, f'listing for {self.base_url}/\?x=\xef\xbf\xbd'.encode('latin1')) + def test_get_dir_redirect_location_domain_injection_bug(self): """Ensure //evil.co/..%2f../../X does not put //evil.co/ in Location. |