diff options
| author | Andrew M. Kuchling <amk@amk.ca> | 2006-05-31 14:08:48 +0000 |
|---|---|---|
| committer | Andrew M. Kuchling <amk@amk.ca> | 2006-05-31 14:08:48 +0000 |
| commit | 622f14417521bcc94d39f6da638ee539c2cbaeb7 (patch) | |
| tree | 103f3e45d7e7c49e7fa8ebdc1c00c3df7dad4151 /Python/ceval.c | |
| parent | bc09e1086e971d0dd4b846064832d23855eb0cd6 (diff) | |
| download | cpython-git-622f14417521bcc94d39f6da638ee539c2cbaeb7.tar.gz | |
[Bug #1473048]
SimpleXMLRPCServer and DocXMLRPCServer don't look at
the path of the HTTP request at all; you can POST or
GET from / or /RPC2 or /blahblahblah with the same results.
Security scanners that look for /cgi-bin/phf will therefore report
lots of vulnerabilities.
Fix: add a .rpc_paths attribute to the SimpleXMLRPCServer class,
and report a 404 error if the path isn't on the allowed list.
Possibly-controversial aspect of this change: the default makes only
'/' and '/RPC2' legal. Maybe this will break people's applications
(though I doubt it). We could just set the default to an empty tuple,
which would exactly match the current behaviour.
Diffstat (limited to 'Python/ceval.c')
0 files changed, 0 insertions, 0 deletions