Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
home:olh:SLE_11
python-base
CVE-2014-4650-CGIHTTPServer-traversal.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File CVE-2014-4650-CGIHTTPServer-traversal.patch of Package python-base
# HG changeset patch # User Benjamin Peterson <benjamin@python.org> # Date 1402796189 25200 # Node ID b4bab078876811c7d95231d08aa6fa7142fdda66 # Parent bb8b0c7fefd0c5ed99b3f336178a4f9554a1d0ef url unquote the path before checking if it refers to a CGI script (closes #21766) Index: Python-2.6.9/Lib/CGIHTTPServer.py =================================================================== --- Python-2.6.9.orig/Lib/CGIHTTPServer.py 2014-07-24 17:04:31.511887499 +0200 +++ Python-2.6.9/Lib/CGIHTTPServer.py 2014-07-24 17:05:59.865277203 +0200 @@ -80,7 +80,7 @@ path begins with one of the strings in self.cgi_directories (and the next character is a '/' or the end of the string). """ - splitpath = _url_collapse_path_split(self.path) + splitpath = _url_collapse_path_split(urllib.unquote(self.path)) if splitpath[0] in self.cgi_directories: self.cgi_info = splitpath return True Index: Python-2.6.9/Lib/test/test_httpservers.py =================================================================== --- Python-2.6.9.orig/Lib/test/test_httpservers.py 2014-07-24 17:01:39.461116403 +0200 +++ Python-2.6.9/Lib/test/test_httpservers.py 2014-07-24 17:04:31.512887503 +0200 @@ -394,6 +394,11 @@ self.assertEquals(('Hello World\n', 'text/html', 200), (res.read(), res.getheader('Content-type'), res.status)) + def test_urlquote_decoding_in_cgi_check(self): + res = self.request('/cgi-bin%2ffile1.py') + self.assertEqual((b'Hello World\n', 'text/html', 200), + (res.read(), res.getheader('Content-type'), res.status)) + def test_main(verbose=None): cwd = os.getcwd()
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor