Author hfuru
Recipients hfuru
Date 2010-10-29.13:10:32
SpamBayes Score 3.89688e-14
Marked as misclassified No
Message-id <>
SimpleHTTPRequestHandler directory bugs

Running 3.2a3 http/ or 2.7 as a script:

* Redirection appends "/" to the unparsed URL instead of to the
  pathname component of the parsed URL: "foo/dir?baz" => "foo/dir?baz/".

* The unparsed URL is also used to check if the URL ends with "/".
  Thus "foo/dir?baz/" gives a directory listing instead of redirecting,
  which makes the files relative to "foo/" instead of to "foo/dir/".

* translate_path("directory/") produces filenames without a final "/".
  Not sure if that is correct for CGI env['PATH_TRANSLATED'].  Anyway:
  This means a non-directory file with a final slash is accepted, but
  again relative URLs in that file will refer to the wrong absolute URL.
  ".../foo.html/" + relative URL "bar.html" -> ".../foo.html/bar.html".

  However if translate_path("") is changed and you use stat() on
  the result, I do not know if all relevant directory operations work
  with the final directory separator on all OSes.  I seem to remember
  getting errors in some OS for stat("dirname/", &st) in C.

* translate_path() does not handle initial "."/".." on non-Posix systems.
  If that's wrong, it can (ignoring other issues listed here) do this:
      drop = frozenset((os.curdir, os.pardir, '', '.', '..'))
      for ...:
          if word not in drop: os.path.join(path, word)
  Though it looks a bit quicker to do
      words, drop = [], frozenset((os.curdir, os.pardir, '', '.', '..'))
      for word in filter(None, path.split('/')):
          word = os.path.split(os.path.splitdrive(word)[1])[1]
          if word not in drop: words.append(word)
      return os.path.join(os.getcwd(), *words)
  unless that can somehow produce a different result.
Date User Action Args
2010-10-29 13:10:35hfurusetrecipients: + hfuru
2010-10-29 13:10:35hfurusetmessageid: <>
2010-10-29 13:10:33hfurulinkissue10231 messages
2010-10-29 13:10:32hfurucreate