list_directory() in SimpleHTTPServer.py should add charset=... to Content-type header

[gvanrossum]

BPO	11442
Nosy	@gvanrossum, @warsaw, @orsenthil, @pitrou, @benjaminp
Files	SimpleHTTPServer-fix-2.7.patch: Patch to make SimpleHTTPServer report the correct content type header in listings.

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/orsenthil'
closed_at = <Date 2011-03-17.07:06:12.268>
created_at = <Date 2011-03-08.19:05:15.092>
labels = ['type-security']
title = 'list_directory() in SimpleHTTPServer.py should add charset=... to Content-type header'
updated_at = <Date 2012-06-27.14:56:12.080>
user = 'https://github.com/gvanrossum'

bugs.python.org fields:

activity = <Date 2012-06-27.14:56:12.080>
actor = 'gvanrossum'
assignee = 'orsenthil'
closed = True
closed_date = <Date 2011-03-17.07:06:12.268>
closer = 'orsenthil'
components = []
creation = <Date 2011-03-08.19:05:15.092>
creator = 'gvanrossum'
dependencies = []
files = ['21255']
hgrepos = []
issue_num = 11442
keywords = ['patch']
message_count = 13.0
messages = ['130347', '130348', '130349', '131200', '131205', '131228', '131231', '131707', '133938', '136400', '136403', '136404', '164163']
nosy_count = 7.0
nosy_names = ['gvanrossum', 'barry', 'orsenthil', 'pitrou', 'benjamin.peterson', 'Tom.N', 'python-dev']
pr_nums = []
priority = None
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue11442'
versions = ['Python 2.6', 'Python 2.5', 'Python 2.7']

[gvanrossum]

The security list received a report about SimpleHTTPServer's list_directory(). It needs to add a charset parameter to the Content-type header. This is already done in Python 3 (where this code lives in http/server.py) but not in any Python 2 versions I can find. A simple backport of the code in Python 3 should hopefully suffice.

I'm marking this tentatively as a release blocker, but I don't see it's necessary to issue an urgent release. It should just be fixed before the next scheduled releases of 2.5, 2.6, 2.7.

[pitrou]

It needs to add a charset parameter to the Content-type header.

What is the rationale?

[gvanrossum]

> It needs to add a charset parameter to the Content-type header.

What is the rationale?

Without a charset parameter, IE7 engages in encoding-sniffing and can
be enticed to interpret the output as UTF7. This allows an attacker to
hide e.g. <script> tags in UTF-7 encoded characters which do not get
quoted by cgi.encode(). This allows XSS attacks.

[TomN]

I have backported the code from python 3, to apply to the current 2.7 branch. All tests pass, and my machine reports "Content-type: text/html; charset=UTF-8", which appears to be correct.

[gvanrossum]

Looks good, this should be committed to the 2.5 branch first, then
merged to 2.6, then to 2.7.

[python-dev]

New changeset e9724d7abbc2 by Senthil Kumaran in branch '2.5':
Fix bpo-11442 - Add a charset parameter to the Content-type to avoid XSS attacks.
http://hg.python.org/cpython/rev/e9724d7abbc2

[orsenthil]

Fixed in all the relevant code lines.

[gvanrossum]

Thanks Senthil!

[python-dev]

New changeset bb1695c6cea1 by Martin v. Löwis in branch '2.5':
bpo-11442: Add NEWS entry for e9724d7abbc2
http://hg.python.org/cpython/rev/bb1695c6cea1

[warsaw]

Senthil, I just want to verify. You applied this patch to the Python 2.6 branch in hg, but not in svn, correct? Since I'm going to be making the 2.6.7 release from svn, I am porting this patch over to the svn 2.6 branch. You don't have to do that, but if you can just confirm it, that would be great.