[Python-checkins] cpython (merge 3.5 -> default): Issue #26657: Merge http.server fix from 3.5

Mon Apr 18 04:02:43 EDT 2016

https://hg.python.org/cpython/rev/5d8042ab3361
changeset: 101046:5d8042ab3361
parent: 101044:7d9f7d7a21ae
parent: 101045:8054a68dfce2
user: Martin Panter <vadmium+py at gmail.com>
date: Mon Apr 18 07:16:17 2016 +0000
summary:
 Issue #26657: Merge http.server fix from 3.5
files:
 Lib/http/server.py | 6 +++---
 Lib/test/test_httpservers.py | 19 +++++++++++++++++++
 Misc/NEWS | 4 ++++
 3 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/Lib/http/server.py b/Lib/http/server.py
--- a/Lib/http/server.py
+++ b/Lib/http/server.py
@@ -768,9 +768,9 @@
 words = filter(None, words)
 path = os.getcwd()
 for word in words:
- drive, word = os.path.splitdrive(word)
- head, word = os.path.split(word)
- if word in (os.curdir, os.pardir): continue
+ if os.path.dirname(word) or word in (os.curdir, os.pardir):
+ # Ignore components that are not a simple file/directory name
+ continue
 path = os.path.join(path, word)
 if trailing_slash:
 path += '/'
diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
--- a/Lib/test/test_httpservers.py
+++ b/Lib/test/test_httpservers.py
@@ -12,6 +12,7 @@
 import sys
 import re
 import base64
+import ntpath
 import shutil
 import urllib.parse
 import html
@@ -960,6 +961,24 @@
 path = self.handler.translate_path('//filename?foo=bar')
 self.assertEqual(path, self.translated)
 
+ def test_windows_colon(self):
+ with support.swap_attr(server.os, 'path', ntpath):
+ path = self.handler.translate_path('c:c:c:foo/filename')
+ path = path.replace(ntpath.sep, os.sep)
+ self.assertEqual(path, self.translated)
+
+ path = self.handler.translate_path('\\c:../filename')
+ path = path.replace(ntpath.sep, os.sep)
+ self.assertEqual(path, self.translated)
+
+ path = self.handler.translate_path('c:\\c:..\\foo/filename')
+ path = path.replace(ntpath.sep, os.sep)
+ self.assertEqual(path, self.translated)
+
+ path = self.handler.translate_path('c:c:foo\\c:c:bar/filename')
+ path = path.replace(ntpath.sep, os.sep)
+ self.assertEqual(path, self.translated)
+
 
 class MiscTestCase(unittest.TestCase):
 def test_all(self):
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -245,6 +245,10 @@
 Library
 -------
 
+- Issue #26657: Fix directory traversal vulnerability with http.server on
+ Windows. This fixes a regression that was introduced in 3.3.4rc1 and
+ 3.4.0rc1. Based on patch by Philipp Hagemeister.
+
 - Issue #26717: Stop encoding Latin-1-ized WSGI paths with UTF-8. Patch by
 Anthony Sottile.
 
-- 
Repository URL: https://hg.python.org/cpython
