Commit821a87e

and

authored

[3.13]gh-133889: Only show the path of the URL in the SimpleHTTPRequestHandler page (GH-134135) (GH-134191)

The query and fragment are ambiguous and not used.(cherry picked from commit5cbc8c6)Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

1 parent018ec63 commit821a87eCopy full SHA for 821a87e

File tree

+15

-8

lines changed

+15

-8

lines changed

Lines changed: 5 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -791,11 +791,14 @@ def list_directory(self, path):`
`791`	`791`	`returnNone`
`792`	`792`	`list.sort(key=lambdaa:a.lower())`
`793`	`793`	`r= []`
	`794`	`+displaypath=self.path`
	`795`	`+displaypath=displaypath.split('#',1)[0]`
	`796`	`+displaypath=displaypath.split('?',1)[0]`
`794`	`797`	`try:`
`795`		`-displaypath=urllib.parse.unquote(self.path,`
	`798`	`+displaypath=urllib.parse.unquote(displaypath,`
`796`	`799`	`errors='surrogatepass')`
`797`	`800`	`exceptUnicodeDecodeError:`
`798`		`-displaypath=urllib.parse.unquote(self.path)`
	`801`	`+displaypath=urllib.parse.unquote(displaypath)`
`799`	`802`	`displaypath=html.escape(displaypath,quote=False)`
`800`	`803`	`enc=sys.getfilesystemencoding()`
`801`	`804`	`title=f'Directory listing for{displaypath}'`

Lines changed: 7 additions & 6 deletions

Original file line number	Diff line number	Diff line change
`@@ -517,13 +517,14 @@ def test_list_dir_escape_filename(self):`
`517`	`517`	`self.check_list_dir_filename(filename)`
`518`	`518`	`os_helper.unlink(os.path.join(self.tempdir,filename))`
`519`	`519`
`520`		`-deftest_undecodable_parameter(self):`
`521`		`-# sanity check using a valid parameter`
	`520`	`+deftest_list_dir_with_query_and_fragment(self):`
	`521`	`+prefix=f'listing for{self.base_url}/</'.encode('latin1')`
	`522`	`+response=self.request(self.base_url+'/#123').read()`
	`523`	`+self.assertIn(prefix+b'title>',response)`
	`524`	`+self.assertIn(prefix+b'h1>',response)`
`522`	`525`	`response=self.request(self.base_url+'/?x=123').read()`
`523`		`-self.assertRegex(response,rf'listing for{self.base_url}/\?x=123'.encode('latin1'))`
`524`		`-# now the bogus encoding`
`525`		`-response=self.request(self.base_url+'/?x=%bb').read()`
`526`		`-self.assertRegex(response,rf'listing for{self.base_url}/\?x=\xef\xbf\xbd'.encode('latin1'))`
	`526`	`+self.assertIn(prefix+b'title>',response)`
	`527`	`+self.assertIn(prefix+b'h1>',response)`
`527`	`528`
`528`	`529`	`deftest_get_dir_redirect_location_domain_injection_bug(self):`
`529`	`530`	`"""Ensure //evil.co/..%2f../../X does not put //evil.co/ in Location.`

Lines changed: 3 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+The generated directory listing page in`
	`2`	+:class:`http.server.SimpleHTTPRequestHandler` now only shows the decoded
	`3`	`+path component of the requested URL, and not the query and fragment.`

Comments

(0)