mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-09-24 09:23:02 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

gh-133889: Only show the path of the URL in the SimpleHTTPRequestHandler page (GH-134135)

Browse source 
The query and fragment are ambiguous and not used.
This commit is contained in:
Serhiy Storchaka 2025-05-18 21:09:51 +03:00 • committed by GitHub
parent bb32f3c698
commit 5cbc8c632e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 15 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

7
Lib/http/server.py
View file

@ -818,11 +818,14 @@ class SimpleHTTPRequestHandler(BaseHTTPRequestHandler):
return None
list.sort(key=lambda a: a.lower())
r = []
displaypath = self.path
displaypath = displaypath.split('#', 1)[0]
displaypath = displaypath.split('?', 1)[0]
try:
displaypath = urllib.parse.unquote(self.path,
displaypath = urllib.parse.unquote(displaypath,
errors='surrogatepass')
except UnicodeDecodeError:
displaypath = urllib.parse.unquote(self.path)
displaypath = urllib.parse.unquote(displaypath)
displaypath = html.escape(displaypath, quote=False)
enc = sys.getfilesystemencoding()
title = f'Directory listing for {displaypath}'

13
Lib/test/test_httpservers.py
View file

@ -627,13 +627,14 @@ class SimpleHTTPServerTestCase(BaseTestCase):
self.check_list_dir_filename(filename)
os_helper.unlink(os.path.join(self.tempdir, filename))
def test_undecodable_parameter(self):
# sanity check using a valid parameter
def test_list_dir_with_query_and_fragment(self):
prefix = f'listing for {self.base_url}/</'.encode('latin1')
response = self.request(self.base_url + '/#123').read()
self.assertIn(prefix + b'title>', response)
self.assertIn(prefix + b'h1>', response)
response = self.request(self.base_url + '/?x=123').read()
self.assertRegex(response, rf'listing for {self.base_url}/\?x=123'.encode('latin1'))
# now the bogus encoding
response = self.request(self.base_url + '/?x=%bb').read()
self.assertRegex(response, rf'listing for {self.base_url}/\?x=\xef\xbf\xbd'.encode('latin1'))
self.assertIn(prefix + b'title>', response)
self.assertIn(prefix + b'h1>', response)
def test_get_dir_redirect_location_domain_injection_bug(self):
"""Ensure //evil.co/..%2f../../X does not put //evil.co/ in Location.

3
Misc/NEWS.d/next/Library/2025-05-17-12-40-12.gh-issue-133889.Eh-zO4.rst Normal file
View file

@ -0,0 +1,3 @@
The generated directory listing page in
:class:`http.server.SimpleHTTPRequestHandler` now only shows the decoded
path component of the requested URL, and not the query and fragment.