From a02e18a43f61543c911c82698d3cf44c8c11a0c2 Mon Sep 17 00:00:00 2001 From: Martin Panter Date: Sat, 3 Oct 2015 05:38:07 +0000 Subject: Issue #25232: Fix CGIRequestHandler's splitting of URL query Patch from Xiang Zhang. --- Lib/test/test_httpservers.py | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) (limited to 'Lib/test/test_httpservers.py') diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py index 74e07143eb..d50a9ac259 100644 --- a/Lib/test/test_httpservers.py +++ b/Lib/test/test_httpservers.py @@ -366,6 +366,16 @@ print("%%s, %%s, %%s" %% (form.getfirst("spam"), form.getfirst("eggs"), form.getfirst("bacon"))) """ +cgi_file4 = """\ +#!%s +import os + +print("Content-type: text/html") +print() + +print(os.environ["%s"]) +""" + @unittest.skipIf(hasattr(os, 'geteuid') and os.geteuid() == 0, "This test can't be run reliably as root (issue #13308).") @@ -387,6 +397,7 @@ class CGIHTTPServerTestCase(BaseTestCase): self.file1_path = None self.file2_path = None self.file3_path = None + self.file4_path = None # The shebang line should be pure ASCII: use symlink if possible. # See issue #7668. @@ -425,6 +436,11 @@ class CGIHTTPServerTestCase(BaseTestCase): file3.write(cgi_file1 % self.pythonexe) os.chmod(self.file3_path, 0o777) + self.file4_path = os.path.join(self.cgi_dir, 'file4.py') + with open(self.file4_path, 'w', encoding='utf-8') as file4: + file4.write(cgi_file4 % (self.pythonexe, 'QUERY_STRING')) + os.chmod(self.file4_path, 0o777) + os.chdir(self.parent_dir) def tearDown(self): @@ -440,6 +456,8 @@ class CGIHTTPServerTestCase(BaseTestCase): os.remove(self.file2_path) if self.file3_path: os.remove(self.file3_path) + if self.file4_path: + os.remove(self.file4_path) os.rmdir(self.cgi_child_dir) os.rmdir(self.cgi_dir) os.rmdir(self.parent_dir) @@ -541,6 +559,12 @@ class CGIHTTPServerTestCase(BaseTestCase): self.assertEqual((b'Hello World' + self.linesep, 'text/html', 200), (res.read(), res.getheader('Content-type'), res.status)) + def test_query_with_multiple_question_mark(self): + res = self.request('/cgi-bin/file4.py?a=b?c=d') + self.assertEqual( + (b'a=b?c=d' + self.linesep, 'text/html', 200), + (res.read(), res.getheader('Content-type'), res.status)) + class SocketlessRequestHandler(SimpleHTTPRequestHandler): def __init__(self): -- cgit v1.2.1 From cb29e8c0e5dc67c5f73926ea0c540612ca40714a Mon Sep 17 00:00:00 2001 From: Martin Panter Date: Sat, 3 Oct 2015 05:55:46 +0000 Subject: Issue #24657: Prevent CGIRequestHandler from collapsing the URL query Initial patch from Xiang Zhang. Also fix out-of-date _url_collapse_path() doc string. --- Lib/test/test_httpservers.py | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'Lib/test/test_httpservers.py') diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py index d50a9ac259..6e5f2db7fd 100644 --- a/Lib/test/test_httpservers.py +++ b/Lib/test/test_httpservers.py @@ -565,6 +565,13 @@ class CGIHTTPServerTestCase(BaseTestCase): (b'a=b?c=d' + self.linesep, 'text/html', 200), (res.read(), res.getheader('Content-type'), res.status)) + def test_query_with_continuous_slashes(self): + res = self.request('/cgi-bin/file4.py?k=aa%2F%2Fbb&//q//p//=//a//b//') + self.assertEqual( + (b'k=aa%2F%2Fbb&//q//p//=//a//b//' + self.linesep, + 'text/html', 200), + (res.read(), res.getheader('Content-type'), res.status)) + class SocketlessRequestHandler(SimpleHTTPRequestHandler): def __init__(self): -- cgit v1.2.1