Issue #22421 - Secure pydoc server run. Bind it to localhost instead of all interfaces.

diff --git a/Lib/pydoc.py b/Lib/pydoc.py
index 9dce07976d71150381f7a89ccfe8c049eb88528e..c9d84362282761843b773f4acf53b903d8a079df 100755 (executable)
--- a/Lib/pydoc.py
+++ b/Lib/pydoc.py
@@ -2168,8 +2168,8 @@ def _start_server(urlhandler, port):
     class DocServer(http.server.HTTPServer):
 
         def __init__(self, port, callback):
-            self.host = (sys.platform == 'mac') and '127.0.0.1' or 'localhost'
-            self.address = ('', port)
+            self.host = 'localhost'
+            self.address = (self.host, port)
             self.callback = callback
             self.base.__init__(self, self.address, self.handler)
             self.quit = False

diff --git a/Lib/test/test_pydoc.py b/Lib/test/test_pydoc.py
index 43f4163daef635b24f19288845a6b7664440947e..ce46d60f6c785588aee05930b476a2f23e751811 100644 (file)
--- a/Lib/test/test_pydoc.py
+++ b/Lib/test/test_pydoc.py
@@ -557,6 +557,8 @@ class PydocServerTest(unittest.TestCase):
             return text
 
         serverthread = pydoc._start_server(my_url_handler, port=0)
+        self.assertIn('localhost', serverthread.docserver.address)
+
         starttime = time.time()
         timeout = 1  #seconds