[Python-checkins] cpython (2.7): Issue #21323: Fix CGIHTTPServer to again handle scripts in CGI subdirectories,

[ned.deily]

http://hg.python.org/cpython/rev/d367ea865ea4
changeset:   91663:d367ea865ea4
branch:      2.7
parent:      91654:cc8849331528
user:        Ned Deily <nad at acm.org>
date:        Sat Jul 12 22:01:15 2014 -0700
summary:
  Issue #21323: Fix CGIHTTPServer to again handle scripts in CGI subdirectories,
broken by the fix for security issue #19435.  Patch by Zach Byrne.

files:
  Lib/CGIHTTPServer.py         |  10 +++++-----
  Lib/test/test_httpservers.py |  14 ++++++++++++++
  Misc/ACKS                    |   1 +
  Misc/NEWS                    |   3 +++
  4 files changed, 23 insertions(+), 5 deletions(-)


diff --git a/Lib/CGIHTTPServer.py b/Lib/CGIHTTPServer.py
--- a/Lib/CGIHTTPServer.py
+++ b/Lib/CGIHTTPServer.py
@@ -106,16 +106,16 @@
     def run_cgi(self):
         """Execute a CGI script."""
         dir, rest = self.cgi_info
-
-        i = rest.find('/')
+        path = dir + '/' + rest
+        i = path.find('/', len(dir)+1)
         while i >= 0:
-            nextdir = rest[:i]
-            nextrest = rest[i+1:]
+            nextdir = path[:i]
+            nextrest = path[i+1:]
 
             scriptdir = self.translate_path(nextdir)
             if os.path.isdir(scriptdir):
                 dir, rest = nextdir, nextrest
-                i = rest.find('/')
+                i = path.find('/', len(dir)+1)
             else:
                 break
 
diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
--- a/Lib/test/test_httpservers.py
+++ b/Lib/test/test_httpservers.py
@@ -386,7 +386,9 @@
         BaseTestCase.setUp(self)
         self.parent_dir = tempfile.mkdtemp()
         self.cgi_dir = os.path.join(self.parent_dir, 'cgi-bin')
+        self.cgi_child_dir = os.path.join(self.cgi_dir, 'child-dir')
         os.mkdir(self.cgi_dir)
+        os.mkdir(self.cgi_child_dir)
 
         # The shebang line should be pure ASCII: use symlink if possible.
         # See issue #7668.
@@ -411,6 +413,11 @@
             file2.write(cgi_file2 % self.pythonexe)
         os.chmod(self.file2_path, 0777)
 
+        self.file3_path = os.path.join(self.cgi_child_dir, 'file3.py')
+        with open(self.file3_path, 'w') as file3:
+            file3.write(cgi_file1 % self.pythonexe)
+        os.chmod(self.file3_path, 0777)
+
         self.cwd = os.getcwd()
         os.chdir(self.parent_dir)
 
@@ -422,6 +429,8 @@
             os.remove(self.nocgi_path)
             os.remove(self.file1_path)
             os.remove(self.file2_path)
+            os.remove(self.file3_path)
+            os.rmdir(self.cgi_child_dir)
             os.rmdir(self.cgi_dir)
             os.rmdir(self.parent_dir)
         finally:
@@ -516,6 +525,11 @@
         self.assertEqual((b'Hello World\n', 'text/html', 200),
                 (res.read(), res.getheader('Content-type'), res.status))
 
+    def test_nested_cgi_path_issue21323(self):
+        res = self.request('/cgi-bin/child-dir/file3.py')
+        self.assertEqual((b'Hello World\n', 'text/html', 200),
+                (res.read(), res.getheader('Content-type'), res.status))
+
 
 class SimpleHTTPRequestHandlerTestCase(unittest.TestCase):
     """ Test url parsing """
diff --git a/Misc/ACKS b/Misc/ACKS
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -198,6 +198,7 @@
 Lee Busby
 Katherine Busch
 Ralph Butler
+Zach Byrne
 Nicolas Cadou
 Jp Calderone
 Arnaud Calmettes
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -25,6 +25,9 @@
 - Issue #21923: Prevent AttributeError in distutils.sysconfig.customize_compiler
   due to possible uninitialized _config_vars.
 
+- Issue #21323: Fix CGIHTTPServer to again handle scripts in CGI subdirectories,
+  broken by the fix for security issue #19435.  Patch by Zach Byrne.
+
 
 What's New in Python 2.7.8?
 ===========================

-- 
Repository URL: http://hg.python.org/cpython