diff options
author | Martin Panter <vadmium+py@gmail.com> | 2016-04-18 03:45:18 (GMT) |
---|---|---|
committer | Martin Panter <vadmium+py@gmail.com> | 2016-04-18 03:45:18 (GMT) |
commit | 0cf2cf2b7d726d12a6046441e4067d32c7dd4feb (patch) | |
tree | c07ed6b3fb63988a39ce96fb2ab4eda7ede9020a /Lib | |
parent | 9a118f1dc3f23ead28f31fdc5144ad5ce01e5b7f (diff) | |
download | cpython-0cf2cf2b7d726d12a6046441e4067d32c7dd4feb.zip cpython-0cf2cf2b7d726d12a6046441e4067d32c7dd4feb.tar.gz cpython-0cf2cf2b7d726d12a6046441e4067d32c7dd4feb.tar.bz2 |
Issue #26657: Fix SimpleHTTPServer Windows directory traversal vulnerability
Based on patch by Philipp Hagemeister. This fixes a regression caused by
revision 6b314f5c9404.
Diffstat (limited to 'Lib')
-rw-r--r-- | Lib/SimpleHTTPServer.py | 6 | ||||
-rw-r--r-- | Lib/test/test_httpservers.py | 20 |
2 files changed, 23 insertions, 3 deletions
diff --git a/Lib/SimpleHTTPServer.py b/Lib/SimpleHTTPServer.py index 783d0ac..c140a27 100644 --- a/Lib/SimpleHTTPServer.py +++ b/Lib/SimpleHTTPServer.py @@ -167,9 +167,9 @@ class SimpleHTTPRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler): words = filter(None, words) path = os.getcwd() for word in words: - drive, word = os.path.splitdrive(word) - head, word = os.path.split(word) - if word in (os.curdir, os.pardir): continue + if os.path.dirname(word) or word in (os.curdir, os.pardir): + # Ignore components that are not a simple file/directory name + continue path = os.path.join(path, word) if trailing_slash: path += '/' diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py index 8dab627..672c187 100644 --- a/Lib/test/test_httpservers.py +++ b/Lib/test/test_httpservers.py @@ -8,6 +8,7 @@ import os import sys import re import base64 +import ntpath import shutil import urllib import httplib @@ -604,6 +605,25 @@ class SimpleHTTPRequestHandlerTestCase(unittest.TestCase): path = self.handler.translate_path('//filename?foo=bar') self.assertEqual(path, self.translated) + def test_windows_colon(self): + import SimpleHTTPServer + with test_support.swap_attr(SimpleHTTPServer.os, 'path', ntpath): + path = self.handler.translate_path('c:c:c:foo/filename') + path = path.replace(ntpath.sep, os.sep) + self.assertEqual(path, self.translated) + + path = self.handler.translate_path('\\c:../filename') + path = path.replace(ntpath.sep, os.sep) + self.assertEqual(path, self.translated) + + path = self.handler.translate_path('c:\\c:..\\foo/filename') + path = path.replace(ntpath.sep, os.sep) + self.assertEqual(path, self.translated) + + path = self.handler.translate_path('c:c:foo\\c:c:bar/filename') + path = path.replace(ntpath.sep, os.sep) + self.assertEqual(path, self.translated) + def test_main(verbose=None): try: |