diff options
| author | Siwon Kang <kkangshawn@gmail.com> | 2019-11-22 18:13:05 +0900 |
|---|---|---|
| committer | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2019-11-22 01:13:05 -0800 |
| commit | 91daa9d7224626dad4bb820924c01b3438ca6e3f (patch) | |
| tree | 7e44a82b5e6093fbe2fa6a4ad890047d52027371 /Lib/http/server.py | |
| parent | b4e5eeac267c436bb60776dc5be771d3259bd298 (diff) | |
| download | cpython-git-91daa9d7224626dad4bb820924c01b3438ca6e3f.tar.gz | |
bpo-38863: Improve is_cgi() in http.server (GH-17312)
is_cgi() function of http.server library does not currently handle a
cgi script if one of the cgi_directories is located at the
sub-directory of given path. Since is_cgi() in CGIHTTPRequestHandler
class separates given path into (dir, rest) based on the first seen
'/', multi-level directories like /sub/dir/cgi-bin/hello.py is divided
into head=/sub, rest=dir/cgi-bin/hello.py then check whether '/sub'
exists in cgi_directories = [..., '/sub/dir/cgi-bin'].
This patch makes the is_cgi() keep expanding dir part to the next '/'
then checking if that expanded path exists in the cgi_directories.
Signed-off-by: Siwon Kang <kkangshawn@gmail.com>
https://bugs.python.org/issue38863
Diffstat (limited to 'Lib/http/server.py')
| -rw-r--r-- | Lib/http/server.py | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/Lib/http/server.py b/Lib/http/server.py index 005dd824f9..47a4fcf9a6 100644 --- a/Lib/http/server.py +++ b/Lib/http/server.py @@ -1014,8 +1014,10 @@ class CGIHTTPRequestHandler(SimpleHTTPRequestHandler): """ collapsed_path = _url_collapse_path(self.path) dir_sep = collapsed_path.find('/', 1) - head, tail = collapsed_path[:dir_sep], collapsed_path[dir_sep+1:] - if head in self.cgi_directories: + while dir_sep > 0 and not collapsed_path[:dir_sep] in self.cgi_directories: + dir_sep = collapsed_path.find('/', dir_sep+1) + if dir_sep > 0: + head, tail = collapsed_path[:dir_sep], collapsed_path[dir_sep+1:] self.cgi_info = head, tail return True return False |