[EASY doc] http.server, SimpleHTTPServer: warn users on security

[vstinner]

BPO	34576
Nosy	@orsenthil, @vstinner, @benjaminp, @ned-deily, @vadmium, @miss-islington, @Windsooon, @gutsytechster, @tirkarthi, @fbidu
PRs	bpo-34576 warn users on security for http.server #9720 [3.6] bpo-34576 warn users on security for http.server (GH-9720) #9794 [3.7] bpo-34576 warn users on security for http.server (GH-9720) #9795 bpo-34576 - Fix the formatting for security considerations in http.server.rst #10005 [3.6] - bpo-34576 : Backport eeab510 3.6 #10113 [3.7] bpo-34576 : Backport eeab510 #10114 [3.7] bpo-34576 : Backport eeab510 #10114 [2.7] bpo-34576 : Backport eeab510 2.7 #10115 bpo-34576 - Simplify the warning for http.server. #10116

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/orsenthil'
closed_at = <Date 2018-10-26.17:13:01.877>
created_at = <Date 2018-09-04.09:39:03.824>
labels = ['type-security', '3.8', '3.7', 'library', 'easy']
title = '[EASY doc] http.server, SimpleHTTPServer: warn users on security'
updated_at = <Date 2018-10-26.17:13:01.875>
user = 'https://github.com/vstinner'

bugs.python.org fields:

activity = <Date 2018-10-26.17:13:01.875>
actor = 'orsenthil'
assignee = 'orsenthil'
closed = True
closed_date = <Date 2018-10-26.17:13:01.877>
closer = 'orsenthil'
components = ['Library (Lib)']
creation = <Date 2018-09-04.09:39:03.824>
creator = 'vstinner'
dependencies = []
files = []
hgrepos = []
issue_num = 34576
keywords = ['patch', 'easy']
message_count = 25.0
messages = ['324577', '324579', '324583', '326058', '326555', '327069', '327089', '327504', '327509', '327512', '327526', '327540', '328141', '328162', '328165', '328170', '328173', '328174', '328175', '328241', '328508', '328525', '328572', '328573', '328574']
nosy_count = 10.0
nosy_names = ['orsenthil', 'vstinner', 'benjamin.peterson', 'ned.deily', 'martin.panter', 'miss-islington', 'Windson Yang', 'gutsytechster', 'xtreak', 'fbidu']
pr_nums = ['9720', '9794', '9795', '10005', '10113', '10114', '10114', '10115', '10116']
priority = None
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue34576'
versions = ['Python 2.7', 'Python 3.6', 'Python 3.7', 'Python 3.8']

[vstinner]

Larry Hastings proposed on the PSRT mailing list to add the following note of the SimpleHTTPServer documentation:

Note: SimpleHTTPServer is, as its name implies, a simple HTTP
server.  We provide it as a sample implementation of the Python HTTP
server API.  However, SimpleHTTPServer is neither secure nor
high-performance, and as such you should not use SimpleHTTPServer in
security-sensitive or performance-sensitive applications.

For example, if you create a symbolic link outside the directory served by SimpleHTTPServer, SimpleHTTPServer follows symbolic links.

[Windsooon]

The SimpleHTTPServer module has been merged into http.server in Python 3. So we add this to python2 document?

[vstinner]

The SimpleHTTPServer module has been merged into http.server in Python 3. So we add this to python2 document?

The node should be added to Python 2 and Python 3 documentations.

[benjaminp]

There was some disagreement later on the list about adding this warning. We will fix security issues in SimpleHTTPServer.

[fbidu]

Well, even if we do fix some security issues in SimpleHTTPServer, it doesn't change the fact that it shouldn't really be used for sensitive applications. I like how Django docs handles a similar issue regarding their development server (https://docs.djangoproject.com/en/2.1/ref/django-admin/#runserver)

DO NOT USE THIS SERVER IN A PRODUCTION SETTING. It has not gone through security audits or performance tests. (And that’s how it’s gonna stay. We’re in the business of making Web frameworks, not Web servers, so improving this server to be able to handle a production environment is outside the scope of Django.)

I think that the same philosophy applies to SimpleHTTPServer. If the warning should be add to the docs, I'll be glad to issue an PR fixing it!

[gutsytechster]

Should this change be done? If so, I would want to take up this issue.

[vadmium]

FYI Senthil made an earlier suggestion for wording at <https://bugs.python.org/issue26005#msg257517\>

[orsenthil]

New changeset 1d26c72 by Senthil Kumaran (Felipe Rodrigues) in branch 'master':
bpo-34576 warn users on security for http.server (bpo-9720)
1d26c72

[miss-islington]

New changeset 3baee3b by Miss Islington (bot) in branch '3.6':
bpo-34576 warn users on security for http.server (GH-9720)
3baee3b