Issue #25232: Fix CGIRequestHandler's splitting of URL query

Patch from Xiang Zhang.

diff --git a/Lib/CGIHTTPServer.py b/Lib/CGIHTTPServer.py
index 8f8ae56c93bedbe6c8f950dbbac0c0db56a22af4..7a4593eeb6115d5476a62b98d8bc5987b8e27776 100644 (file)
--- a/Lib/CGIHTTPServer.py
+++ b/Lib/CGIHTTPServer.py
@@ -120,11 +120,7 @@ class CGIHTTPRequestHandler(SimpleHTTPServer.SimpleHTTPRequestHandler):
                 break
 
         # find an explicit query string, if present.
-        i = rest.rfind('?')
-        if i >= 0:
-            rest, query = rest[:i], rest[i+1:]
-        else:
-            query = ''
+        rest, _, query = rest.partition('?')
 
         # dissect the part after the directory name into a script name &
         # a possible additional path, to be stored in PATH_INFO.

diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
index 706dfc7fb2ad289f3db66fe34c9bd503fd22031d..023180e624825bc65d8f2b545f6997be85cc8fbf 100644 (file)
--- a/Lib/test/test_httpservers.py
+++ b/Lib/test/test_httpservers.py
@@ -381,6 +381,16 @@ print "%%s, %%s, %%s" %% (form.getfirst("spam"), form.getfirst("eggs"),
                           form.getfirst("bacon"))
 """
 
+cgi_file4 = """\
+#!%s
+import os
+
+print("Content-type: text/html")
+print()
+
+print(os.environ["%s"])
+"""
+
 
 @unittest.skipIf(hasattr(os, 'geteuid') and os.geteuid() == 0,
         "This test can't be run reliably as root (issue #13308).")
@@ -424,6 +434,11 @@ class CGIHTTPServerTestCase(BaseTestCase):
             file3.write(cgi_file1 % self.pythonexe)
         os.chmod(self.file3_path, 0777)
 
+        self.file4_path = os.path.join(self.cgi_dir, 'file4.py')
+        with open(self.file4_path, 'w') as file4:
+            file4.write(cgi_file4 % (self.pythonexe, 'QUERY_STRING'))
+        os.chmod(self.file4_path, 0o777)
+
         self.cwd = os.getcwd()
         os.chdir(self.parent_dir)
 
@@ -436,6 +451,7 @@ class CGIHTTPServerTestCase(BaseTestCase):
             os.remove(self.file1_path)
             os.remove(self.file2_path)
             os.remove(self.file3_path)
+            os.remove(self.file4_path)
             os.rmdir(self.cgi_child_dir)
             os.rmdir(self.cgi_dir)
             os.rmdir(self.parent_dir)
@@ -536,6 +552,12 @@ class CGIHTTPServerTestCase(BaseTestCase):
         self.assertEqual((b'Hello World\n', 'text/html', 200),
                 (res.read(), res.getheader('Content-type'), res.status))
 
+    def test_query_with_multiple_question_mark(self):
+        res = self.request('/cgi-bin/file4.py?a=b?c=d')
+        self.assertEqual(
+            (b'a=b?c=d\n', 'text/html', 200),
+            (res.read(), res.getheader('Content-type'), res.status))
+
 
 class SimpleHTTPRequestHandlerTestCase(unittest.TestCase):
     """ Test url parsing """

diff --git a/Misc/ACKS b/Misc/ACKS
index bdbb802e37c9f908ec5ef28c34a795013f70bf00..34f0a0a73f9a948bb70adc0ea764a6998ecca054 100644 (file)
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -1505,6 +1505,7 @@ Thomas Wouters
 Daniel Wozniak
 Heiko Wundram
 Doug Wyatt
+Xiang Zhang
 Robert Xiao
 Florent Xicluna
 Hirokazu Yamamoto

diff --git a/Misc/NEWS b/Misc/NEWS
index 0494fd17d81324425913974a93086e2ca1f71fef..f6e29b6ff2063387c6e709007ab6b66ad4bdd315 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -43,6 +43,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #25232: Fix CGIRequestHandler to split the query from the URL at the
+  first question mark (?) rather than the last. Patch from Xiang Zhang.
+
 - Issue #22958: Constructor and update method of weakref.WeakValueDictionary
   now accept the self keyword argument.