From d274b3f1f1e2d8811733fb952c9f18d7da3a376a Mon Sep 17 00:00:00 2001 From: Martin Panter Date: Mon, 18 Apr 2016 03:45:18 +0000 Subject: Issue #26657: Fix Windows directory traversal vulnerability with http.server Based on patch by Philipp Hagemeister. This fixes a regression caused by revision f4377699fd47. --- Lib/test/test_httpservers.py | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) (limited to 'Lib/test/test_httpservers.py') diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py index f396ebd66c..08666848d0 100644 --- a/Lib/test/test_httpservers.py +++ b/Lib/test/test_httpservers.py @@ -12,6 +12,7 @@ import os import sys import re import base64 +import ntpath import shutil import urllib.parse import html @@ -918,6 +919,24 @@ class SimpleHTTPRequestHandlerTestCase(unittest.TestCase): path = self.handler.translate_path('//filename?foo=bar') self.assertEqual(path, self.translated) + def test_windows_colon(self): + with support.swap_attr(server.os, 'path', ntpath): + path = self.handler.translate_path('c:c:c:foo/filename') + path = path.replace(ntpath.sep, os.sep) + self.assertEqual(path, self.translated) + + path = self.handler.translate_path('\\c:../filename') + path = path.replace(ntpath.sep, os.sep) + self.assertEqual(path, self.translated) + + path = self.handler.translate_path('c:\\c:..\\foo/filename') + path = path.replace(ntpath.sep, os.sep) + self.assertEqual(path, self.translated) + + path = self.handler.translate_path('c:c:foo\\c:c:bar/filename') + path = path.replace(ntpath.sep, os.sep) + self.assertEqual(path, self.translated) + class MiscTestCase(unittest.TestCase): def test_all(self): -- cgit v1.2.1