Message 121877 - Python tracker

➜

This issue tracker has been migrated to GitHub , and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

In-reply-to
Author	v+python
Recipients	v+python
Date	2010年11月21日.07:38:12
SpamBayes Score	0.00034004156
Marked as misclassified	No
Message-id	<1290325094.43.0.114667735532.issue10485@psf.upfronthosting.co.za>

Content
http.server on Python 3 and CGIHTTPServer on Python 2 both contain the same code with the same bug. In run_cgi, rest.rfind('?') is used to separate the path from the query string. However, it should be rest.find('?') as the query string starts with '?' but may also contain '?'. It is required that '?' not be used in URL path part without escaping. Apache, for example, separates the following URL: /testing?foo=bar?&baz=3 into path part /testing and query string part foo=bar?&baz=3 but http.server does not.

Content

http.server on Python 3 and CGIHTTPServer on Python 2 both contain the same code with the same bug. In run_cgi, rest.rfind('?') is used to separate the path from the query string. However, it should be rest.find('?') as the query string starts with '?' but may also contain '?'. It is required that '?' not be used in URL path part without escaping.
Apache, for example, separates the following URL:
/testing?foo=bar?&baz=3
into path part /testing and query string part foo=bar?&baz=3 but http.server does not.

History
Date	User	Action	Args
2010年11月21日 07:38:14	v+python	set	recipients: + v+python
2010年11月21日 07:38:14	v+python	set	messageid: <1290325094.43.0.114667735532.issue10485@psf.upfronthosting.co.za>
2010年11月21日 07:38:12	v+python	link	issue10485 messages
2010年11月21日 07:38:12	v+python	create

homepage