churchyard / rpms / python3

Forked from rpms/python3 6 years ago
Clone

Blame 00197-fix-CVE-2014-4650.patch

899a2ce
# HG changeset patch
899a2ce
# User Benjamin Peterson <benjamin@python.org>
899a2ce
# Date 1402796473 25200
899a2ce
# Node ID 847e288d6e93dba049c280f40979e16a1378d0f6
899a2ce
# Parent  6f1f387759913d91cb307d2783b3a40c48fe7424# Parent  5676797f3a3eccaf38e2c500e77ed39c68923cc9
899a2ce
merge 3.3 (#21766)
899a2ce
899a2ce
diff --git a/Lib/http/server.py b/Lib/http/server.py
899a2ce
--- a/Lib/http/server.py
899a2ce
+++ b/Lib/http/server.py
899a2ce
@@ -977,7 +977,7 @@ class CGIHTTPRequestHandler(SimpleHTTPRe
899a2ce
         (and the next character is a '/' or the end of the string).
899a2ce
 
899a2ce
         """
899a2ce
-        collapsed_path = _url_collapse_path(self.path)
899a2ce
+        collapsed_path = _url_collapse_path(urllib.parse.unquote(self.path))
899a2ce
         dir_sep = collapsed_path.find('/', 1)
899a2ce
         head, tail = collapsed_path[:dir_sep], collapsed_path[dir_sep+1:]
899a2ce
         if head in self.cgi_directories:
899a2ce
diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
899a2ce
--- a/Lib/test/test_httpservers.py
899a2ce
+++ b/Lib/test/test_httpservers.py
899a2ce
@@ -485,6 +485,11 @@ class CGIHTTPServerTestCase(BaseTestCase
899a2ce
                 (res.read(), res.getheader('Content-type'), res.status))
899a2ce
         self.assertEqual(os.environ['SERVER_SOFTWARE'], signature)
899a2ce
 
899a2ce
+    def test_urlquote_decoding_in_cgi_check(self):
899a2ce
+        res = self.request('/cgi-bin%2ffile1.py')
899a2ce
+        self.assertEqual((b'Hello World\n', 'text/html', 200),
899a2ce
+                (res.read(), res.getheader('Content-type'), res.status))
899a2ce
+
899a2ce
 
899a2ce
 class SocketlessRequestHandler(SimpleHTTPRequestHandler):
899a2ce
     def __init__(self):