From b3acaccf273feb720df10c2890d6c35ca8b62acd Mon Sep 17 00:00:00 2001
From: Georg Brandl <georg@python.org>
Date: Mon, 11 Nov 2013 06:10:23 +0100
Subject: Transplant of rev 544b654d000c: directory traversal attack in
 CGIHttpRequestHandler.

---
 Lib/http/server.py           |  9 ++++-----
 Lib/test/test_httpservers.py | 12 ++++++++++++
 2 files changed, 16 insertions(+), 5 deletions(-)

(limited to 'Lib')

diff --git a/Lib/http/server.py b/Lib/http/server.py
index ebc2a8fcdc..2bfda12df4 100644
--- a/Lib/http/server.py
+++ b/Lib/http/server.py
@@ -987,18 +987,17 @@ class CGIHTTPRequestHandler(SimpleHTTPRequestHandler):
 
     def run_cgi(self):
         """Execute a CGI script."""
-        path = self.path
         dir, rest = self.cgi_info
 
-        i = path.find('/', len(dir) + 1)
+        i = rest.find('/')
         while i >= 0:
-            nextdir = path[:i]
-            nextrest = path[i+1:]
+            nextdir = rest[:i]
+            nextrest = rest[i+1:]
 
             scriptdir = self.translate_path(nextdir)
             if os.path.isdir(scriptdir):
                 dir, rest = nextdir, nextrest
-                i = path.find('/', len(dir) + 1)
+                i = rest.find('/')
             else:
                 break
 
diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
index b8bbcb6734..9dd27788f7 100644
--- a/Lib/test/test_httpservers.py
+++ b/Lib/test/test_httpservers.py
@@ -325,6 +325,7 @@ class CGIHTTPServerTestCase(BaseTestCase):
         self.parent_dir = tempfile.mkdtemp()
         self.cgi_dir = os.path.join(self.parent_dir, 'cgi-bin')
         os.mkdir(self.cgi_dir)
+        self.nocgi_path = None
         self.file1_path = None
         self.file2_path = None
 
@@ -345,6 +346,11 @@ class CGIHTTPServerTestCase(BaseTestCase):
             self.tearDown()
             self.skipTest("Python executable path is not encodable to utf-8")
 
+        self.nocgi_path = os.path.join(self.parent_dir, 'nocgi.py')
+        with open(self.nocgi_path, 'w') as fp:
+            fp.write(cgi_file1 % self.pythonexe)
+        os.chmod(self.nocgi_path, 0o777)
+
         self.file1_path = os.path.join(self.cgi_dir, 'file1.py')
         with open(self.file1_path, 'w', encoding='utf-8') as file1:
             file1.write(cgi_file1 % self.pythonexe)
@@ -362,6 +368,8 @@ class CGIHTTPServerTestCase(BaseTestCase):
             os.chdir(self.cwd)
             if self.pythonexe != sys.executable:
                 os.remove(self.pythonexe)
+            if self.nocgi_path:
+                os.remove(self.nocgi_path)
             if self.file1_path:
                 os.remove(self.file1_path)
             if self.file2_path:
@@ -418,6 +426,10 @@ class CGIHTTPServerTestCase(BaseTestCase):
         self.assertEqual((b'Hello World' + self.linesep, 'text/html', 200),
             (res.read(), res.getheader('Content-type'), res.status))
 
+    def test_issue19435(self):
+        res = self.request('///////////nocgi.py/../cgi-bin/nothere.sh')
+        self.assertEqual(res.status, 404)
+
     def test_post(self):
         params = urllib.parse.urlencode(
             {'spam' : 1, 'eggs' : 'python', 'bacon' : 123456})
-- 
cgit v1.2.1


From 4cf9b2047d0438b69f66b0c2fd48e6d7576eb1f1 Mon Sep 17 00:00:00 2001
From: Georg Brandl <georg@python.org>
Date: Mon, 11 Nov 2013 06:13:54 +0100
Subject: Bump to 3.3.3rc2.

---
 Lib/distutils/__init__.py | 2 +-
 Lib/idlelib/idlever.py    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to 'Lib')

diff --git a/Lib/distutils/__init__.py b/Lib/distutils/__init__.py
index 812d8f35dc..0650dd277a 100644
--- a/Lib/distutils/__init__.py
+++ b/Lib/distutils/__init__.py
@@ -13,5 +13,5 @@ used from a setup script as
 # Updated automatically by the Python release process.
 #
 #--start constants--
-__version__ = "3.3.3rc1"
+__version__ = "3.3.3rc2"
 #--end constants--
diff --git a/Lib/idlelib/idlever.py b/Lib/idlelib/idlever.py
index 640e008015..c1e6476111 100644
--- a/Lib/idlelib/idlever.py
+++ b/Lib/idlelib/idlever.py
@@ -1 +1 @@
-IDLE_VERSION = "3.3.3rc1"
+IDLE_VERSION = "3.3.3rc2"
-- 
cgit v1.2.1


From 9e2043a5613a6423b7051b08a916b01969c179ed Mon Sep 17 00:00:00 2001
From: Georg Brandl <georg@python.org>
Date: Sun, 17 Nov 2013 07:58:22 +0100
Subject: Bump to 3.3.3 final.

---
 Lib/distutils/__init__.py | 2 +-
 Lib/idlelib/idlever.py    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to 'Lib')

diff --git a/Lib/distutils/__init__.py b/Lib/distutils/__init__.py
index 0650dd277a..6747ab8677 100644
--- a/Lib/distutils/__init__.py
+++ b/Lib/distutils/__init__.py
@@ -13,5 +13,5 @@ used from a setup script as
 # Updated automatically by the Python release process.
 #
 #--start constants--
-__version__ = "3.3.3rc2"
+__version__ = "3.3.3"
 #--end constants--
diff --git a/Lib/idlelib/idlever.py b/Lib/idlelib/idlever.py
index c1e6476111..60f1d329aa 100644
--- a/Lib/idlelib/idlever.py
+++ b/Lib/idlelib/idlever.py
@@ -1 +1 @@
-IDLE_VERSION = "3.3.3rc2"
+IDLE_VERSION = "3.3.3"
-- 
cgit v1.2.1