Commit7073587

and

authored

[3.14]gh-133889: Only show the path of the URL in the SimpleHTTPRequestHandler page (GH-134135) (GH-134190)

The query and fragment are ambiguous and not used.(cherry picked from commit5cbc8c6)Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

1 parent76957eb commit7073587Copy full SHA for 7073587

File tree

+15

-8

lines changed

+15

-8

lines changed

Lines changed: 5 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -840,11 +840,14 @@ def list_directory(self, path):`
`840`	`840`	`returnNone`
`841`	`841`	`list.sort(key=lambdaa:a.lower())`
`842`	`842`	`r= []`
	`843`	`+displaypath=self.path`
	`844`	`+displaypath=displaypath.split('#',1)[0]`
	`845`	`+displaypath=displaypath.split('?',1)[0]`
`843`	`846`	`try:`
`844`		`-displaypath=urllib.parse.unquote(self.path,`
	`847`	`+displaypath=urllib.parse.unquote(displaypath,`
`845`	`848`	`errors='surrogatepass')`
`846`	`849`	`exceptUnicodeDecodeError:`
`847`		`-displaypath=urllib.parse.unquote(self.path)`
	`850`	`+displaypath=urllib.parse.unquote(displaypath)`
`848`	`851`	`displaypath=html.escape(displaypath,quote=False)`
`849`	`852`	`enc=sys.getfilesystemencoding()`
`850`	`853`	`title=f'Directory listing for{displaypath}'`

Lines changed: 7 additions & 6 deletions

Original file line number	Diff line number	Diff line change
`@@ -628,13 +628,14 @@ def test_list_dir_escape_filename(self):`
`628`	`628`	`self.check_list_dir_filename(filename)`
`629`	`629`	`os_helper.unlink(os.path.join(self.tempdir,filename))`
`630`	`630`
`631`		`-deftest_undecodable_parameter(self):`
`632`		`-# sanity check using a valid parameter`
	`631`	`+deftest_list_dir_with_query_and_fragment(self):`
	`632`	`+prefix=f'listing for{self.base_url}/</'.encode('latin1')`
	`633`	`+response=self.request(self.base_url+'/#123').read()`
	`634`	`+self.assertIn(prefix+b'title>',response)`
	`635`	`+self.assertIn(prefix+b'h1>',response)`
`633`	`636`	`response=self.request(self.base_url+'/?x=123').read()`
`634`		`-self.assertRegex(response,rf'listing for{self.base_url}/\?x=123'.encode('latin1'))`
`635`		`-# now the bogus encoding`
`636`		`-response=self.request(self.base_url+'/?x=%bb').read()`
`637`		`-self.assertRegex(response,rf'listing for{self.base_url}/\?x=\xef\xbf\xbd'.encode('latin1'))`
	`637`	`+self.assertIn(prefix+b'title>',response)`
	`638`	`+self.assertIn(prefix+b'h1>',response)`
`638`	`639`
`639`	`640`	`deftest_get_dir_redirect_location_domain_injection_bug(self):`
`640`	`641`	`"""Ensure //evil.co/..%2f../../X does not put //evil.co/ in Location.`

Lines changed: 3 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+The generated directory listing page in`
	`2`	+:class:`http.server.SimpleHTTPRequestHandler` now only shows the decoded
	`3`	`+path component of the requested URL, and not the query and fragment.`

Comments

(0)