Issue 10485: http.server fails when query string contains addition '?' characters

classification

Title:	http.server fails when query string contains addition '?' characters
Type:	behavior	Stage:
Components:	Library (Lib)	Versions:	Python 3.2, Python 3.1, Python 2.7, Python 2.6

process

Status:	open	Resolution:
Dependencies:		Superseder:
Assigned To:	orsenthil	Nosy List:	facundobatista, fdrake, orsenthil, v+python
Priority:	normal	Keywords:

Created on 2010-11-21 07:38 by v+python, last changed 2012-03-16 08:21 by orsenthil.

Messages (1)
msg121877 - (view)	Author: Glenn Linderman (v+python)	Date: 2010-11-21 07:38
http.server on Python 3 and CGIHTTPServer on Python 2 both contain the same code with the same bug. In run_cgi, rest.rfind('?') is used to separate the path from the query string. However, it should be rest.find('?') as the query string starts with '?' but may also contain '?'. It is required that '?' not be used in URL path part without escaping. Apache, for example, separates the following URL: /testing?foo=bar?&baz=3 into path part /testing and query string part foo=bar?&baz=3 but http.server does not.

msg121877 - (view)

Author: Glenn Linderman (v+python)

Date: 2010-11-21 07:38

http.server on Python 3 and CGIHTTPServer on Python 2 both contain the same code with the same bug.  In run_cgi, rest.rfind('?') is used to separate the path from the query string.  However, it should be rest.find('?') as the query string starts with '?' but may also contain '?'.  It is required that '?' not be used in URL path part without escaping.

Apache, for example, separates the following URL:

/testing?foo=bar?&baz=3

into path part /testing  and query string part  foo=bar?&baz=3 but http.server does not.

History
Date	User	Action	Args
2012-03-16 08:21:32	orsenthil	set	assignee: orsenthil
2010-11-21 16:59:18	pitrou	set	nosy: + fdrake, facundobatista, orsenthil
2010-11-21 07:38:31	v+python	set	type: behavior
2010-11-21 07:38:12	v+python	create