changeset:   101045:8054a68dfce2
branch:      3.5
parent:      101041:31cd179c9451
user:        Martin Panter <vadmium+py@gmail.com>
date:        Mon Apr 18 03:45:18 2016 +0000
files:       Lib/http/server.py Lib/test/test_httpservers.py Misc/NEWS
description:
Issue #26657: Fix Windows directory traversal vulnerability with http.server

Based on patch by Philipp Hagemeister.  This fixes a regression caused by
revision f4377699fd47.


diff -r 31cd179c9451 -r 8054a68dfce2 Lib/http/server.py
--- a/Lib/http/server.py	Sun Apr 17 17:52:05 2016 -0700
+++ b/Lib/http/server.py	Mon Apr 18 03:45:18 2016 +0000
@@ -774,9 +774,9 @@
         words = filter(None, words)
         path = os.getcwd()
         for word in words:
-            drive, word = os.path.splitdrive(word)
-            head, word = os.path.split(word)
-            if word in (os.curdir, os.pardir): continue
+            if os.path.dirname(word) or word in (os.curdir, os.pardir):
+                # Ignore components that are not a simple file/directory name
+                continue
             path = os.path.join(path, word)
         if trailing_slash:
             path += '/'
diff -r 31cd179c9451 -r 8054a68dfce2 Lib/test/test_httpservers.py
--- a/Lib/test/test_httpservers.py	Sun Apr 17 17:52:05 2016 -0700
+++ b/Lib/test/test_httpservers.py	Mon Apr 18 03:45:18 2016 +0000
@@ -12,6 +12,7 @@
 import sys
 import re
 import base64
+import ntpath
 import shutil
 import urllib.parse
 import html
@@ -918,6 +919,24 @@
         path = self.handler.translate_path('//filename?foo=bar')
         self.assertEqual(path, self.translated)
 
+    def test_windows_colon(self):
+        with support.swap_attr(server.os, 'path', ntpath):
+            path = self.handler.translate_path('c:c:c:foo/filename')
+            path = path.replace(ntpath.sep, os.sep)
+            self.assertEqual(path, self.translated)
+
+            path = self.handler.translate_path('\\c:../filename')
+            path = path.replace(ntpath.sep, os.sep)
+            self.assertEqual(path, self.translated)
+
+            path = self.handler.translate_path('c:\\c:..\\foo/filename')
+            path = path.replace(ntpath.sep, os.sep)
+            self.assertEqual(path, self.translated)
+
+            path = self.handler.translate_path('c:c:foo\\c:c:bar/filename')
+            path = path.replace(ntpath.sep, os.sep)
+            self.assertEqual(path, self.translated)
+
 
 class MiscTestCase(unittest.TestCase):
     def test_all(self):
diff -r 31cd179c9451 -r 8054a68dfce2 Misc/NEWS
--- a/Misc/NEWS	Sun Apr 17 17:52:05 2016 -0700
+++ b/Misc/NEWS	Mon Apr 18 03:45:18 2016 +0000
@@ -107,6 +107,10 @@
 Library
 -------
 
+- Issue #26657: Fix directory traversal vulnerability with http.server on
+  Windows.  This fixes a regression that was introduced in 3.3.4rc1 and
+  3.4.0rc1.  Based on patch by Philipp Hagemeister.
+
 - Issue #26717: Stop encoding Latin-1-ized WSGI paths with UTF-8.  Patch by
   Anthony Sottile.