classification
Title: http.server fails when query string contains addition '?' characters
Type: behavior Stage:
Components: Library (Lib) Versions: Python 3.2, Python 3.1, Python 2.7, Python 2.6
process
Status: open Resolution:
Dependencies: Superseder:
Assigned To: orsenthil Nosy List: facundobatista, fdrake, orsenthil, v+python
Priority: normal Keywords:

Created on 2010-11-21 07:38 by v+python, last changed 2012-03-16 08:21 by orsenthil.

Messages (1)
msg121877 - (view) Author: Glenn Linderman (v+python) Date: 2010-11-21 07:38
http.server on Python 3 and CGIHTTPServer on Python 2 both contain the same code with the same bug.  In run_cgi, rest.rfind('?') is used to separate the path from the query string.  However, it should be rest.find('?') as the query string starts with '?' but may also contain '?'.  It is required that '?' not be used in URL path part without escaping.

Apache, for example, separates the following URL:

/testing?foo=bar?&baz=3

into path part /testing  and query string part  foo=bar?&baz=3 but http.server does not.
History
Date User Action Args
2012-03-16 08:21:32orsenthilsetassignee: orsenthil
2010-11-21 16:59:18pitrousetnosy: + fdrake, facundobatista, orsenthil
2010-11-21 07:38:31v+pythonsettype: behavior
2010-11-21 07:38:12v+pythoncreate