1berry/cpython
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

gh-134098: Fix handling %-encoded trailing slash in SimpleHTTPRequestHandler (GH-134099)

Browse Source
This commit is contained in:
Serhiy Storchaka 2025-05-17 10:11:34 +03:00 committed by GitHub
parent fcaf009907
commit 2f1ecb3bc4
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Lib/http/server.py
View File

@ -750,7 +750,7 @@ class SimpleHTTPRequestHandler(BaseHTTPRequestHandler):
f = None f = None
if os.path.isdir(path): if os.path.isdir(path):
parts = urllib.parse.urlsplit(self.path) parts = urllib.parse.urlsplit(self.path)
if not parts.path.endswith('/'): if not parts.path.endswith(('/', '%2f', '%2F')):
# redirect browser - doing basically what apache does # redirect browser - doing basically what apache does
self.send_response(HTTPStatus.MOVED_PERMANENTLY) self.send_response(HTTPStatus.MOVED_PERMANENTLY)
new_parts = (parts[0], parts[1], parts[2] + '/', new_parts = (parts[0], parts[1], parts[2] + '/',
@ -890,14 +890,14 @@ class SimpleHTTPRequestHandler(BaseHTTPRequestHandler):
""" """
# abandon query parameters # abandon query parameters
path = path.split('?',1)[0] path = path.split('#', 1)[0]
path = path.split('#',1)[0] path = path.split('?', 1)[0]
# Don't forget explicit trailing slash when normalizing. Issue17324 # Don't forget explicit trailing slash when normalizing. Issue17324
trailing_slash = path.rstrip().endswith('/')
try: try:
path = urllib.parse.unquote(path, errors='surrogatepass') path = urllib.parse.unquote(path, errors='surrogatepass')
except UnicodeDecodeError: except UnicodeDecodeError:
path = urllib.parse.unquote(path) path = urllib.parse.unquote(path)
trailing_slash = path.endswith('/')
path = posixpath.normpath(path) path = posixpath.normpath(path)
words = path.split('/') words = path.split('/')
words = filter(None, words) words = filter(None, words)

11
Lib/test/test_httpservers.py
View File

@ -692,10 +692,19 @@ class SimpleHTTPServerTestCase(BaseTestCase):
# check for trailing "/" which should return 404. See Issue17324 # check for trailing "/" which should return 404. See Issue17324
response = self.request(self.base_url + '/test/') response = self.request(self.base_url + '/test/')
self.check_status_and_reason(response, HTTPStatus.NOT_FOUND) self.check_status_and_reason(response, HTTPStatus.NOT_FOUND)
response = self.request(self.base_url + '/test%2f')
self.check_status_and_reason(response, HTTPStatus.NOT_FOUND)
response = self.request(self.base_url + '/test%2F')
self.check_status_and_reason(response, HTTPStatus.NOT_FOUND)
response = self.request(self.base_url + '/') response = self.request(self.base_url + '/')
self.check_status_and_reason(response, HTTPStatus.OK) self.check_status_and_reason(response, HTTPStatus.OK)
response = self.request(self.base_url + '%2f')
self.check_status_and_reason(response, HTTPStatus.OK)
response = self.request(self.base_url + '%2F')
self.check_status_and_reason(response, HTTPStatus.OK)
response = self.request(self.base_url) response = self.request(self.base_url)
self.check_status_and_reason(response, HTTPStatus.MOVED_PERMANENTLY) self.check_status_and_reason(response, HTTPStatus.MOVED_PERMANENTLY)
self.assertEqual(response.getheader("Location"), self.base_url + "/")
self.assertEqual(response.getheader("Content-Length"), "0") self.assertEqual(response.getheader("Content-Length"), "0")
response = self.request(self.base_url + '/?hi=2') response = self.request(self.base_url + '/?hi=2')
self.check_status_and_reason(response, HTTPStatus.OK) self.check_status_and_reason(response, HTTPStatus.OK)
@ -801,6 +810,8 @@ class SimpleHTTPServerTestCase(BaseTestCase):
self.check_status_and_reason(response, HTTPStatus.OK) self.check_status_and_reason(response, HTTPStatus.OK)
response = self.request(self.tempdir_name) response = self.request(self.tempdir_name)
self.check_status_and_reason(response, HTTPStatus.MOVED_PERMANENTLY) self.check_status_and_reason(response, HTTPStatus.MOVED_PERMANENTLY)
self.assertEqual(response.getheader("Location"),
self.tempdir_name + "/")
response = self.request(self.tempdir_name + '/?hi=2') response = self.request(self.tempdir_name + '/?hi=2')
self.check_status_and_reason(response, HTTPStatus.OK) self.check_status_and_reason(response, HTTPStatus.OK)
response = self.request(self.tempdir_name + '?hi=1') response = self.request(self.tempdir_name + '?hi=1')

2
Misc/NEWS.d/next/Library/2025-05-16-20-10-25.gh-issue-134098.YyTkKr.rst Normal file
View File

@ -0,0 +1,2 @@
Fix handling paths that end with a percent-encoded slash (``%2f`` or
``%2F``) in :class:`http.server.SimpleHTTPRequestHandler`.