CGIRequestHandler behave incorrectly with query component consisting mutliple ?

[zhangyangyu]

BPO	25232
Nosy	@berkerpeksag, @vadmium, @zhangyangyu
Files	multiple?.diff: Fix CGIRequestHandler about multiple ? query component multiple?.patch: Add a testcase and use partition

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/vadmium'
closed_at = <Date 2015-10-03.07:40:56.561>
created_at = <Date 2015-09-25.15:44:41.655>
labels = ['type-bug', 'library']
title = 'CGIRequestHandler behave incorrectly with query component consisting mutliple ?'
updated_at = <Date 2015-10-03.07:40:56.560>
user = 'https://github.com/zhangyangyu'

bugs.python.org fields:

activity = <Date 2015-10-03.07:40:56.560>
actor = 'martin.panter'
assignee = 'martin.panter'
closed = True
closed_date = <Date 2015-10-03.07:40:56.561>
closer = 'martin.panter'
components = ['Library (Lib)']
creation = <Date 2015-09-25.15:44:41.655>
creator = 'xiang.zhang'
dependencies = []
files = ['40574', '40584']
hgrepos = []
issue_num = 25232
keywords = ['patch']
message_count = 6.0
messages = ['251586', '251617', '251632', '252081', '252195', '252197']
nosy_count = 4.0
nosy_names = ['python-dev', 'berker.peksag', 'martin.panter', 'xiang.zhang']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue25232'
versions = ['Python 2.7', 'Python 3.4', 'Python 3.5', 'Python 3.6']

[zhangyangyu]

According to rfc3986, section 3.4:

The query component is indicated by the first question
mark ("?") character and terminated by a number sign ("#") character
or by the end of the URI.

The characters slash ("/") and question mark ("?") may represent data
within the query component.

But for CGIRequestHandler, it uses the content after the last ? as
query component. For uri http://localhost:8000/cgi-bin/test.py?a=b?c=d,
the QUERY_STRING is c=d.

[vadmium]

Thanks for the report and patch. Would you be interested in making a new regression test for this bug?

While we are fixing this code, we might as well simplify that whole “if” block to

[rest, query] = rest.partition("?")

[zhangyangyu]

I add a testcase but I worry it's not in the right format. Please review it. Partition is a good choice here.

[vadmium]

The test case looks okay to me. IMO using numbers for variable names (cgi_file4 etc) is a terrible idea, but I understand you are just conforming to the existing code :)

[python-dev]

New changeset 969afbf501af by Martin Panter in branch '3.4':
Issue bpo-25232: Fix CGIRequestHandler's splitting of URL query
https://hg.python.org/cpython/rev/969afbf501af

New changeset ba1e3c112e42 by Martin Panter in branch '3.5':
Issues bpo-25232, bpo-24657: Merge two CGI server fixes from 3.4 into 3.5
https://hg.python.org/cpython/rev/ba1e3c112e42

New changeset 88918f2a54df by Martin Panter in branch '3.5':
Issues bpo-25232, bpo-24657: Use new enum status to match rest of tests
https://hg.python.org/cpython/rev/88918f2a54df

New changeset 0f03023d4318 by Martin Panter in branch 'default':
Issues bpo-25232, bpo-24657: Merge two CGI server fixes from 3.5
https://hg.python.org/cpython/rev/0f03023d4318

New changeset 3c006ee38287 by Martin Panter in branch 'default':
Issues bpo-25232, bpo-24657: Add NEWS to 3.6.0a1 section
https://hg.python.org/cpython/rev/3c006ee38287

[python-dev]

New changeset b12b30dc8617 by Martin Panter in branch '2.7':
Issue bpo-25232: Fix CGIRequestHandler's splitting of URL query
https://hg.python.org/cpython/rev/b12b30dc8617