Commit5cbc8c6

authored

gh-133889: Only show the path of the URL in the SimpleHTTPRequestHandler page (GH-134135)

The query and fragment are ambiguous and not used.

1 parentbb32f3c commit5cbc8c6Copy full SHA for 5cbc8c6

File tree

+15

-8

lines changed

+15

-8

lines changed

Lines changed: 5 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -818,11 +818,14 @@ def list_directory(self, path):`
`818`	`818`	`returnNone`
`819`	`819`	`list.sort(key=lambdaa:a.lower())`
`820`	`820`	`r= []`
	`821`	`+displaypath=self.path`
	`822`	`+displaypath=displaypath.split('#',1)[0]`
	`823`	`+displaypath=displaypath.split('?',1)[0]`
`821`	`824`	`try:`
`822`		`-displaypath=urllib.parse.unquote(self.path,`
	`825`	`+displaypath=urllib.parse.unquote(displaypath,`
`823`	`826`	`errors='surrogatepass')`
`824`	`827`	`exceptUnicodeDecodeError:`
`825`		`-displaypath=urllib.parse.unquote(self.path)`
	`828`	`+displaypath=urllib.parse.unquote(displaypath)`
`826`	`829`	`displaypath=html.escape(displaypath,quote=False)`
`827`	`830`	`enc=sys.getfilesystemencoding()`
`828`	`831`	`title=f'Directory listing for{displaypath}'`

Lines changed: 7 additions & 6 deletions

Original file line number	Diff line number	Diff line change
`@@ -627,13 +627,14 @@ def test_list_dir_escape_filename(self):`
`627`	`627`	`self.check_list_dir_filename(filename)`
`628`	`628`	`os_helper.unlink(os.path.join(self.tempdir,filename))`
`629`	`629`
`630`		`-deftest_undecodable_parameter(self):`
`631`		`-# sanity check using a valid parameter`
	`630`	`+deftest_list_dir_with_query_and_fragment(self):`
	`631`	`+prefix=f'listing for{self.base_url}/</'.encode('latin1')`
	`632`	`+response=self.request(self.base_url+'/#123').read()`
	`633`	`+self.assertIn(prefix+b'title>',response)`
	`634`	`+self.assertIn(prefix+b'h1>',response)`
`632`	`635`	`response=self.request(self.base_url+'/?x=123').read()`
`633`		`-self.assertRegex(response,rf'listing for{self.base_url}/\?x=123'.encode('latin1'))`
`634`		`-# now the bogus encoding`
`635`		`-response=self.request(self.base_url+'/?x=%bb').read()`
`636`		`-self.assertRegex(response,rf'listing for{self.base_url}/\?x=\xef\xbf\xbd'.encode('latin1'))`
	`636`	`+self.assertIn(prefix+b'title>',response)`
	`637`	`+self.assertIn(prefix+b'h1>',response)`
`637`	`638`
`638`	`639`	`deftest_get_dir_redirect_location_domain_injection_bug(self):`
`639`	`640`	`"""Ensure //evil.co/..%2f../../X does not put //evil.co/ in Location.`

Lines changed: 3 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+The generated directory listing page in`
	`2`	+:class:`http.server.SimpleHTTPRequestHandler` now only shows the decoded
	`3`	`+path component of the requested URL, and not the query and fragment.`

Comments

(0)