Message119899
SimpleHTTPRequestHandler directory bugs
Running 3.2a3 http/server.py or 2.7 SimpleHTTPServer.py as a script:
* Redirection appends "/" to the unparsed URL instead of to the
pathname component of the parsed URL: "foo/dir?baz" => "foo/dir?baz/".
* The unparsed URL is also used to check if the URL ends with "/".
Thus "foo/dir?baz/" gives a directory listing instead of redirecting,
which makes the files relative to "foo/" instead of to "foo/dir/".
* translate_path("directory/") produces filenames without a final "/".
Not sure if that is correct for CGI env['PATH_TRANSLATED']. Anyway:
This means a non-directory file with a final slash is accepted, but
again relative URLs in that file will refer to the wrong absolute URL.
".../foo.html/" + relative URL "bar.html" -> ".../foo.html/bar.html".
However if translate_path("...foo/") is changed and you use stat() on
the result, I do not know if all relevant directory operations work
with the final directory separator on all OSes. I seem to remember
getting errors in some OS for stat("dirname/", &st) in C.
* translate_path() does not handle initial "."/".." on non-Posix systems.
If that's wrong, it can (ignoring other issues listed here) do this:
drop = frozenset((os.curdir, os.pardir, '', '.', '..'))
for ...:
if word not in drop: os.path.join(path, word)
Though it looks a bit quicker to do
words, drop = [], frozenset((os.curdir, os.pardir, '', '.', '..'))
for word in filter(None, path.split('/')):
word = os.path.split(os.path.splitdrive(word)[1])[1]
if word not in drop: words.append(word)
return os.path.join(os.getcwd(), *words)
unless that can somehow produce a different result. |
|
Date |
User |
Action |
Args |
2010-10-29 13:10:35 | hfuru | set | recipients:
+ hfuru |
2010-10-29 13:10:35 | hfuru | set | messageid: <1288357835.63.0.535261040588.issue10231@psf.upfronthosting.co.za> |
2010-10-29 13:10:33 | hfuru | link | issue10231 messages |
2010-10-29 13:10:32 | hfuru | create | |
|