Skip to content

Commit 2062fce

Browse files
miss-islingtonethanfurmangpsheadJelleZijlstra
authored
[3.8] gh-104049: do not expose on-disk location from SimpleHTTPRequestHandler (GH-104067) (#104121)
Do not expose the local server's on-disk location from `SimpleHTTPRequestHandler` when generating a directory index. (unnecessary information disclosure) (cherry picked from commit c7c3a60) Co-authored-by: Ethan Furman <[email protected]> Co-authored-by: Gregory P. Smith <[email protected]> Co-authored-by: Jelle Zijlstra <[email protected]>
1 parent 47ec96a commit 2062fce

File tree

3 files changed

+11
-1
lines changed

3 files changed

+11
-1
lines changed

Lib/http/server.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -786,7 +786,7 @@ def list_directory(self, path):
786786
displaypath = urllib.parse.unquote(self.path,
787787
errors='surrogatepass')
788788
except UnicodeDecodeError:
789-
displaypath = urllib.parse.unquote(path)
789+
displaypath = urllib.parse.unquote(self.path)
790790
displaypath = html.escape(displaypath, quote=False)
791791
enc = sys.getfilesystemencoding()
792792
title = 'Directory listing for %s' % displaypath

Lib/test/test_httpservers.py

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -414,6 +414,14 @@ def test_undecodable_filename(self):
414414
self.check_status_and_reason(response, HTTPStatus.OK,
415415
data=support.TESTFN_UNDECODABLE)
416416

417+
def test_undecodable_parameter(self):
418+
# sanity check using a valid parameter
419+
response = self.request(self.base_url + '/?x=123').read()
420+
self.assertRegex(response, f'listing for {self.base_url}/\?x=123'.encode('latin1'))
421+
# now the bogus encoding
422+
response = self.request(self.base_url + '/?x=%bb').read()
423+
self.assertRegex(response, f'listing for {self.base_url}/\?x=\xef\xbf\xbd'.encode('latin1'))
424+
417425
def test_get_dir_redirect_location_domain_injection_bug(self):
418426
"""Ensure //evil.co/..%2f../../X does not put //evil.co/ in Location.
419427
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Do not expose the local on-disk location in directory indexes
2+
produced by :class:`http.client.SimpleHTTPRequestHandler`.

0 commit comments

Comments
 (0)