Message 121877 - Python tracker

➜

This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author	v+python
Recipients	v+python
Date	2010-11-21.07:38:12
SpamBayes Score	0.00034004156
Marked as misclassified	No
Message-id	<1290325094.43.0.114667735532.issue10485@psf.upfronthosting.co.za>
In-reply-to

Content
http.server on Python 3 and CGIHTTPServer on Python 2 both contain the same code with the same bug. In run_cgi, rest.rfind('?') is used to separate the path from the query string. However, it should be rest.find('?') as the query string starts with '?' but may also contain '?'. It is required that '?' not be used in URL path part without escaping. Apache, for example, separates the following URL: /testing?foo=bar?&baz=3 into path part /testing and query string part foo=bar?&baz=3 but http.server does not.

http.server on Python 3 and CGIHTTPServer on Python 2 both contain the same code with the same bug.  In run_cgi, rest.rfind('?') is used to separate the path from the query string.  However, it should be rest.find('?') as the query string starts with '?' but may also contain '?'.  It is required that '?' not be used in URL path part without escaping.

Apache, for example, separates the following URL:

/testing?foo=bar?&baz=3

into path part /testing  and query string part  foo=bar?&baz=3 but http.server does not.

History
Date	User	Action	Args
2010-11-21 07:38:14	v+python	set	recipients: + v+python
2010-11-21 07:38:14	v+python	set	messageid: <1290325094.43.0.114667735532.issue10485@psf.upfronthosting.co.za>
2010-11-21 07:38:12	v+python	link	issue10485 messages
2010-11-21 07:38:12	v+python	create