diff options
| author | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2023-05-09 08:21:53 -0700 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-05-09 15:21:53 +0000 |
| commit | d77e77c363a170f4435cbe826628b6a347654d9e (patch) | |
| tree | cc7ad763e443e31171bf7bc6f6921e0dd33fd0e9 /Lib/http/server.py | |
| parent | e277266a926a9037d39f1af7751050012f7f1998 (diff) | |
| download | cpython-git-d77e77c363a170f4435cbe826628b6a347654d9e.tar.gz | |
[3.10] gh-104049: do not expose on-disk location from SimpleHTTPRequestHandler (GH-104067) (#104119)
gh-104049: do not expose on-disk location from SimpleHTTPRequestHandler (GH-104067)
Do not expose the local server's on-disk location from `SimpleHTTPRequestHandler` when generating a directory index. (unnecessary information disclosure)
---------
(cherry picked from commit c7c3a60c88de61a79ded9fdaf6bc6a29da4efb9a)
Co-authored-by: Ethan Furman <ethan@stoneleaf.us>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com>
Diffstat (limited to 'Lib/http/server.py')
| -rw-r--r-- | Lib/http/server.py | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/Lib/http/server.py b/Lib/http/server.py index 9c218d06ac..b965c593d5 100644 --- a/Lib/http/server.py +++ b/Lib/http/server.py @@ -791,7 +791,7 @@ class SimpleHTTPRequestHandler(BaseHTTPRequestHandler): displaypath = urllib.parse.unquote(self.path, errors='surrogatepass') except UnicodeDecodeError: - displaypath = urllib.parse.unquote(path) + displaypath = urllib.parse.unquote(self.path) displaypath = html.escape(displaypath, quote=False) enc = sys.getfilesystemencoding() title = 'Directory listing for %s' % displaypath |