summaryrefslogtreecommitdiffstats
path: root/Lib/http
Commit message (Collapse)AuthorAgeFilesLines
* [3.10] gh-104049: do not expose on-disk location from ↵Miss Islington (bot)2023-05-091-1/+1
| | | | | | | | | | | | | | | SimpleHTTPRequestHandler (GH-104067) (#104119) gh-104049: do not expose on-disk location from SimpleHTTPRequestHandler (GH-104067) Do not expose the local server's on-disk location from `SimpleHTTPRequestHandler` when generating a directory index. (unnecessary information disclosure) --------- (cherry picked from commit c7c3a60c88de61a79ded9fdaf6bc6a29da4efb9a) Co-authored-by: Ethan Furman <ethan@stoneleaf.us> Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com>
* [3.10] gh-103112: Add http.client.HTTPResponse.read docstring and fix pydoc ↵Miss Islington (bot)2023-03-291-0/+1
| | | | | | | | | | output (GH-103113) (#103120) (cherry picked from commit d052a383f1a0c599c176a12c73a761ca00436d8b) Co-authored-by: Bernhard Wagner <github.comNotification20120125@xmlizer.net> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com> Co-authored-by: Terry Jan Reedy <tjreedy@udel.edu> Co-authored-by: Éric <merwok@netwok.org>
* [3.10] gh-100474: Fix handling of dirs named index.html in http.server ↵Miss Islington (bot)2022-12-241-1/+1
| | | | | (GH-100504) Co-authored-by: James Frost <git@frost.cx>
* gh-100001: Also escape \s in http.server log messages. (GH-100038)Miss Islington (bot)2022-12-051-0/+1
| | | | | | | | | | Also \ escape \s in the http.server BaseHTTPRequestHandler.log_message so that it is technically possible to parse the line and reconstruct what the original data was. Without this a \xHH is ambiguious as to if it is a hex replacement we put in or the characters r"\x" came through in the original request line. (cherry picked from commit 7e29398407dbd53b714702abb89aa2fd7baca48a) Co-authored-by: Gregory P. Smith <greg@krypto.org>
* gh-100001: Omit control characters in http.server stderr logs. (GH-100002)Miss Islington (bot)2022-12-051-1/+10
| | | | | | Replace control characters in http.server.BaseHTTPRequestHandler.log_message with an escaped \xHH sequence to avoid causing problems for the terminal the output is printed to. (cherry picked from commit d8ab0a4dfa48f881b4ac9ab857d2e9de42f72828) Co-authored-by: Gregory P. Smith <greg@krypto.org>
* Document that MozillaCookieJar works for curl's cookie files (GH-91852)Miss Islington (bot)2022-10-031-1/+1
| | | | | | MozillaCookieJar works for curl's cookies (cherry picked from commit 0ea8b925d096629852d1045c2c53ff6ad63199cc) Co-authored-by: Boris Verkhovskiy <boris.verk@gmail.com>
* Run Tools/scripts/reindent.py (#94225) (#94291)Victor Stinner2022-06-261-1/+1
| | | | | | | Reindent files which were not properly formatted (PEP 8: 4 spaces). Remove also some trailing spaces. (cherry picked from commit e87ada48a9e5d9d03f9759138869216df0d7383a)
* gh-87389: Fix an open redirection vulnerability in http.server. (GH-93879)Miss Islington (bot)2022-06-211-0/+7
| | | | | | | | | | | Fix an open redirection vulnerability in the `http.server` module when an URI path starts with `//` that could produce a 301 Location header with a misleading target. Vulnerability discovered, and logic fix proposed, by Hamza Avvan (@hamzaavvan). Test and comments authored by Gregory P. Smith [Google]. (cherry picked from commit 4abab6b603dd38bec1168e9a37c40a48ec89508e) Co-authored-by: Gregory P. Smith <greg@krypto.org>
* bpo-46436: Fix command-line option -d/--directory in module http.server ↵Miss Islington (bot)2022-02-141-13/+14
| | | | | | | | | | | | | (GH-30701) Fix command-line option -d/--directory in http.server main function that was ignored when combined with --cgi. Automerge-Triggered-By: GH:merwok (cherry picked from commit 2d080347d74078a55c47715d232d1ab8dc8cd603) Co-authored-by: Géry Ogam <gery.ogam@gmail.com> Co-authored-by: Géry Ogam <gery.ogam@gmail.com>
* bpo-45328: Avoid failure in OSs without TCP_NODELAY support (GH-28646) ↵Miss Islington (bot)2021-10-061-1/+7
| | | | | | | | | (GH-28771) Operating systems without support for TCP_NODELAY will raise an OSError when trying to set the socket option, but the show can still go on. (cherry picked from commit 0571b934f5f9198c3461a7b631d7073ac0a5676f) Co-authored-by: rtobar <rtobarc@gmail.com>
* [3.10] bpo-44559: [Enum] revert enum module to 3.9 (GH-27010)Ethan Furman2021-07-041-3/+2
| | | * [Enum] revert enum module to 3.9
* bpo-43972: Set content-length to 0 for http.server.SimpleHTTPRequestHandler ↵Miss Islington (bot)2021-05-061-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | 301s (GH-25705) * Set content-length for simple http server 301s When http.server.SimpleHTTPRequestHandler sends a 301 (Moved Permanently) due to a missing file, it does not set a Content-Length of 0. Unfortunately, certain clients can be left waiting for the connection to be closed in this circumstance, even though no body will be sent. At time of writing, both curl and Firefox demonstrate this behavior. * Test Content-Length on simple http server redirect When serving a redirect, the SimpleHTTPRequestHandler will now send `Content-Length: 0`. Several tests for http.server already cover various behaviors and checks including redirection. This change only adds one check for the expected Content-Length on the simplest case for a redirect. * Add news entry for SimpleHTTPRequestHandler fix * Clarify the specific kind of 301 Co-authored-by: Senthil Kumaran <skumaran@gatech.edu> (cherry picked from commit fb427255614fc1f740e7785554c1da8ca39116c2) Co-authored-by: Stephen Rosen <sirosen@globus.org>
* bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 100 ↵Miss Islington (bot)2021-05-051-17/+21
| | | | | | | | | | Continue (GH-25916) (GH-25931) Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response. Co-authored-by: Gregory P. Smith <greg@krypto.org> (cherry picked from commit 47895e31b6f626bc6ce47d175fe9d43c1098909d) Co-authored-by: Gen Xu <xgbarry@gmail.com>
* bpo-37363: Add audit events to the `http.client` module (GH-21321)Saiyang Gou2021-04-231-0/+4
| | | | | Add audit events to the `http.client` module Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
* bpo-38659: [Enum] add _simple_enum decorator (GH-25497)Ethan Furman2021-04-211-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | add: * `_simple_enum` decorator to transform a normal class into an enum * `_test_simple_enum` function to compare * `_old_convert_` to enable checking `_convert_` generated enums `_simple_enum` takes a normal class and converts it into an enum: @simple_enum(Enum) class Color: RED = 1 GREEN = 2 BLUE = 3 `_old_convert_` works much like` _convert_` does, using the original logic: # in a test file import socket, enum CheckedAddressFamily = enum._old_convert_( enum.IntEnum, 'AddressFamily', 'socket', lambda C: C.isupper() and C.startswith('AF_'), source=_socket, ) `_test_simple_enum` takes a traditional enum and a simple enum and compares the two: # in the REPL or the same module as Color class CheckedColor(Enum): RED = 1 GREEN = 2 BLUE = 3 _test_simple_enum(CheckedColor, Color) _test_simple_enum(CheckedAddressFamily, socket.AddressFamily) Any important differences will raise a TypeError
* Revert "bpo-38659: [Enum] add _simple_enum decorator (GH-25285)" (GH-25476)Ethan Furman2021-04-201-4/+2
| | | This reverts commit dbac8f40e81eb0a29dc833e6409a1abf47467da6.
* bpo-38659: [Enum] add _simple_enum decorator (GH-25285)Ethan Furman2021-04-201-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | add: _simple_enum decorator to transform a normal class into an enum _test_simple_enum function to compare _old_convert_ to enable checking _convert_ generated enums _simple_enum takes a normal class and converts it into an enum: @simple_enum(Enum) class Color: RED = 1 GREEN = 2 BLUE = 3 _old_convert_ works much like _convert_ does, using the original logic: # in a test file import socket, enum CheckedAddressFamily = enum._old_convert_( enum.IntEnum, 'AddressFamily', 'socket', lambda C: C.isupper() and C.startswith('AF_'), source=_socket, ) test_simple_enum takes a traditional enum and a simple enum and compares the two: # in the REPL or the same module as Color class CheckedColor(Enum): RED = 1 GREEN = 2 BLUE = 3 _test_simple_enum(CheckedColor, Color) _test_simple_enum(CheckedAddressFamily, socket.AddressFamily) Any important differences will raise a TypeError
* Update client.py (GH-24827)Géry Ogam2021-03-131-3/+0
|
* bpo-43332: Buffer proxy connection setup packets before sending. (GH-24780)Gregory P. Smith2021-03-081-10/+11
| | | | | | We now buffer the CONNECT request + tunnel HTTP headers into a single send call. This prevents the OS from generating multiple network packets for connection setup when not necessary, improving efficiency.
* Fix typo in docstring (GH-23515)Fernando Toledo2020-12-211-1/+1
|
* GH-5054: CGIHTTPRequestHandler.run_cgi() HTTP_ACCEPT improperly parsed (#23638)Senthil Kumaran2020-12-051-6/+1
|
* Remove the conditional for setting query. (#23604)Senthil Kumaran2020-12-031-2/+1
|
* bpo-42413: socket.timeout is now an alias of TimeoutError (GH-23413)Christian Heimes2020-11-201-1/+1
| | | Signed-off-by: Christian Heimes <christian@python.org>
* bpo-40968: Send http/1.1 ALPN extension (#20959)Christian Heimes2020-11-131-0/+3
| | | Signed-off-by: Christian Heimes <christian@python.org>
* bpo-38976: Add support for HTTP Only flag in MozillaCookieJar (#17471)Jacob Neil Taylor2020-10-231-14/+26
| | | | | Add support for HTTP Only flag in MozillaCookieJar Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
* bpo-39603: Prevent header injection in http methods (GH-18485)AMIR2020-07-181-0/+15
| | | reject control chars in http method in http.client.putrequest to prevent http header injection
* bpo-41002: Optimize HTTPResponse.read with a given amount (GH-20943)Bruce Merry2020-06-251-10/+25
| | | | | I've done the implementation for both non-chunked and chunked reads. I haven't benchmarked chunked reads because I don't currently have a convenient way to generate a high-bandwidth chunked stream, but I don't see any reason that it shouldn't enjoy the same benefits that the non-chunked case does. I've used the benchmark attached to the bpo bug to verify that performance now matches the unsized read case. Automerge-Triggered-By: @methane
* bpo-39481: PEP 585 for a variety of modules (GH-19423)Batuhan Taşkaya2020-04-101-0/+3
| | | | | | | | | | - concurrent.futures - ctypes - http.cookies - multiprocessing - queue - tempfile - unittest.case - urllib.parse
* bpo-40094: CGIHTTPRequestHandler logs exit code (GH-19285)Victor Stinner2020-04-021-2/+3
| | | | | | | CGIHTTPRequestHandler of http.server now logs the CGI script exit code, rather than the CGI script exit status of os.waitpid(). For example, if the script is killed by signal 11, it now logs: "CGI script exit code -11."
* bpo-39507: Add HTTP status 418 "I'm a Teapot" (GH-18291)Ross2020-03-151-0/+3
|
* bpo-38576: Disallow control characters in hostnames in http.client (GH-18995)Ashwin Ramaswami2020-03-141-0/+10
| | | | Add host validation for control characters for more CVE-2019-18348 protection.
* bpo-39509: Update HTTP status code to follow IANA (GH-18294)Dong-hee Na2020-03-141-0/+4
| | | Add status codes 103 EARLY_HINTS and 425 TOO_EARLY.
* bpo-35292: Avoid calling mimetypes.init when http.server is imported (GH-17822)An Long2020-01-081-13/+10
|
* bpo-38907: Suppress any exception when attempting to set V6ONLY. (GH-17864)Jason R. Coombs2020-01-061-1/+5
| | | Fixes error attempting to bind to IPv4 address.
* bpo-38907: In http.server script, restore binding to IPv4 on Windows. (GH-17851)Jason R. Coombs2020-01-061-1/+13
|
* bpo-38804: Fix REDoS in http.cookiejar (GH-17157)bcaller2019-11-221-6/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The regex http.cookiejar.LOOSE_HTTP_DATE_RE was vulnerable to regular expression denial of service (REDoS). LOOSE_HTTP_DATE_RE.match is called when using http.cookiejar.CookieJar to parse Set-Cookie headers returned by a server. Processing a response from a malicious HTTP server can lead to extreme CPU usage and execution will be blocked for a long time. The regex contained multiple overlapping \s* capture groups. Ignoring the ?-optional capture groups the regex could be simplified to \d+-\w+-\d+(\s*\s*\s*)$ Therefore, a long sequence of spaces can trigger bad performance. Matching a malicious string such as LOOSE_HTTP_DATE_RE.match("1-c-1" + (" " * 2000) + "!") caused catastrophic backtracking. The fix removes ambiguity about which \s* should match a particular space. You can create a malicious server which responds with Set-Cookie headers to attack all python programs which access it e.g. from http.server import BaseHTTPRequestHandler, HTTPServer def make_set_cookie_value(n_spaces): spaces = " " * n_spaces expiry = f"1-c-1{spaces}!" return f"b;Expires={expiry}" class Handler(BaseHTTPRequestHandler): def do_GET(self): self.log_request(204) self.send_response_only(204) # Don't bother sending Server and Date n_spaces = ( int(self.path[1:]) # Can GET e.g. /100 to test shorter sequences if len(self.path) > 1 else 65506 # Max header line length 65536 ) value = make_set_cookie_value(n_spaces) for i in range(99): # Not necessary, but we can have up to 100 header lines self.send_header("Set-Cookie", value) self.end_headers() if __name__ == "__main__": HTTPServer(("", 44020), Handler).serve_forever() This server returns 99 Set-Cookie headers. Each has 65506 spaces. Extracting the cookies will pretty much never complete. Vulnerable client using the example at the bottom of https://docs.python.org/3/library/http.cookiejar.html : import http.cookiejar, urllib.request cj = http.cookiejar.CookieJar() opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj)) r = opener.open("http://localhost:44020/") The popular requests library was also vulnerable without any additional options (as it uses http.cookiejar by default): import requests requests.get("http://localhost:44020/") * Regression test for http.cookiejar REDoS If we regress, this test will take a very long time. * Improve performance of http.cookiejar.ISO_DATE_RE A string like "444444" + (" " * 2000) + "A" could cause poor performance due to the 2 overlapping \s* groups, although this is not as serious as the REDoS in LOOSE_HTTP_DATE_RE was.
* bpo-38863: Improve is_cgi() in http.server (GH-17312)Siwon Kang2019-11-221-2/+4
| | | | | | | | | | | | | | | | | | | is_cgi() function of http.server library does not currently handle a cgi script if one of the cgi_directories is located at the sub-directory of given path. Since is_cgi() in CGIHTTPRequestHandler class separates given path into (dir, rest) based on the first seen '/', multi-level directories like /sub/dir/cgi-bin/hello.py is divided into head=/sub, rest=dir/cgi-bin/hello.py then check whether '/sub' exists in cgi_directories = [..., '/sub/dir/cgi-bin']. This patch makes the is_cgi() keep expanding dir part to the next '/' then checking if that expanded path exists in the cgi_directories. Signed-off-by: Siwon Kang <kkangshawn@gmail.com> https://bugs.python.org/issue38863
* bpo-38216, bpo-36274: Allow subclasses to separately override validation and ↵Jason R. Coombs2019-09-281-9/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | encoding behavior (GH-16448) * bpo-38216: Allow bypassing input validation * bpo-36274: Also allow the URL encoding to be overridden. * bpo-38216, bpo-36274: Add tests demonstrating a hook for overriding validation, test demonstrating override encoding, and a test to capture expectation of the interface for the URL. * Call with skip_host to avoid tripping on the host checking in the URL. * Remove obsolete comment. * Make _prepare_path_encoding its own attr. This makes overriding just that simpler. Also, don't use the := operator to make backporting easier. * Add a news entry. * _prepare_path_encoding -> _encode_prepared_path() * Once again separate the path validation and request encoding, drastically simplifying the behavior. Drop the guarantee that all processing happens in _prepare_path.
* bpo-12144: Handle cookies with expires attribute in CookieJar.make_cookies ↵Xtreak2019-09-131-2/+1
| | | | | | | | | | | | | | (GH-13921) Handle time comparison for cookies with `expires` attribute when `CookieJar.make_cookies` is called. Co-authored-by: Demian Brecht <demianbrecht@gmail.com> https://bugs.python.org/issue12144 Automerge-Triggered-By: @asvetlov
* bpo-35640: Allow passing PathLike arguments to SimpleHTTPRequestHandler ↵Géry Ogam2019-09-111-1/+1
| | | | (GH-11398)
* bpo-26589: Add http status code 451 (GH-15413)Raymond Hettinger2019-08-231-0/+5
|
* Correct description of HTTP status code 308. (GH-15078)Florian Wendelborn2019-08-031-1/+1
| | | Permanent redirect was explained as a temporary redirect.
* bpo-37440: Enable TLS 1.3 post-handshake auth in http.client (GH-14448)Christian Heimes2019-07-011-0/+7
| | | | | | Post-handshake authentication is required for conditional client cert authentication with TLS 1.3. https://bugs.python.org/issue37440
* bpo-36793: Remove unneeded __str__ definitions. (GH-13081)Serhiy Storchaka2019-05-061-2/+1
| | | | Classes that define __str__ the same as __repr__ can just inherit it from object.
* bpo-30458: Use InvalidURL instead of ValueError. (GH-13044)Gregory P. Smith2019-05-011-1/+1
| | | Use http.client.InvalidURL instead of ValueError as the new error case's exception.
* bpo-30458: Disallow control chars in http URLs. (GH-12755)Gregory P. Smith2019-05-011-0/+14
| | | Disallow control chars in http URLs in urllib.urlopen. This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected.
* bpo-36050: optimize HTTPResponse.read() (GH-12698)Inada Naoki2019-04-061-32/+10
| | | | * No need to chunking for now. * No need to partial read caused by EINTR for now.
* bpo-36522: Print all values for headers with multiple values. (GH-12681)Matt Houglum2019-04-041-2/+2
|
* bpo-35647: Fix path check in cookiejar (#11436)Xtreak2019-03-101-5/+9
| | | | | | | | | | | | * Refactor cookie path check as per RFC 6265 * Add tests for prefix match of path * Add news entry * Fix set_ok_path and refactor tests * Use slice for last letter
* bpo-35121: prefix dot in domain for proper subdomain validation (GH-10258)Xtreak2019-03-101-2/+11
| | | Don't send cookies of domain A without Domain attribute to domain B when domain A is a suffix match of domain B while using a cookiejar with `http.cookiejar.DefaultCookiePolicy` policy. Patch by Karthikeyan Singaravelan.
generated by cgit v0.12 at 2024-11-28 11:19:39 (GMT)