From a02e18a43f61543c911c82698d3cf44c8c11a0c2 Mon Sep 17 00:00:00 2001
From: Martin Panter <vadmium+py@gmail.com>
Date: Sat, 3 Oct 2015 05:38:07 +0000
Subject: [PATCH] Issue #25232: Fix CGIRequestHandler's splitting of URL query
Patch from Xiang Zhang.
---
Lib/http/server.py | 6 +-----
Lib/test/test_httpservers.py | 24 ++++++++++++++++++++++++
Misc/ACKS | 1 +
Misc/NEWS | 3 +++
4 files changed, 29 insertions(+), 5 deletions(-)
diff --git a/Lib/http/server.py b/Lib/http/server.py
index ce0f6cfe77..9a7c976b4f 100644
--- a/Lib/http/server.py
+++ b/Lib/http/server.py
@@ -1032,11 +1032,7 @@ class CGIHTTPRequestHandler(SimpleHTTPRequestHandler):
break
# find an explicit query string, if present.
- i = rest.rfind('?')
- if i >= 0:
- rest, query = rest[:i], rest[i+1:]
- else:
- query = ''
+ rest, _, query = rest.partition('?')
# dissect the part after the directory name into a script name &
# a possible additional path, to be stored in PATH_INFO.
diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
index 74e07143eb..d50a9ac259 100644
--- a/Lib/test/test_httpservers.py
+++ b/Lib/test/test_httpservers.py
@@ -366,6 +366,16 @@ print("%%s, %%s, %%s" %% (form.getfirst("spam"), form.getfirst("eggs"),
form.getfirst("bacon")))
"""
+cgi_file4 = """\
+#!%s
+import os
+
+print("Content-type: text/html")
+print()
+
+print(os.environ["%s"])
+"""
+
@unittest.skipIf(hasattr(os, 'geteuid') and os.geteuid() == 0,
"This test can't be run reliably as root (issue #13308).")
@@ -387,6 +397,7 @@ class CGIHTTPServerTestCase(BaseTestCase):
self.file1_path = None
self.file2_path = None
self.file3_path = None
+ self.file4_path = None
# The shebang line should be pure ASCII: use symlink if possible.
# See issue #7668.
@@ -425,6 +436,11 @@ class CGIHTTPServerTestCase(BaseTestCase):
file3.write(cgi_file1 % self.pythonexe)
os.chmod(self.file3_path, 0o777)
+ self.file4_path = os.path.join(self.cgi_dir, 'file4.py')
+ with open(self.file4_path, 'w', encoding='utf-8') as file4:
+ file4.write(cgi_file4 % (self.pythonexe, 'QUERY_STRING'))
+ os.chmod(self.file4_path, 0o777)
+
os.chdir(self.parent_dir)
def tearDown(self):
@@ -440,6 +456,8 @@ class CGIHTTPServerTestCase(BaseTestCase):
os.remove(self.file2_path)
if self.file3_path:
os.remove(self.file3_path)
+ if self.file4_path:
+ os.remove(self.file4_path)
os.rmdir(self.cgi_child_dir)
os.rmdir(self.cgi_dir)
os.rmdir(self.parent_dir)
@@ -541,6 +559,12 @@ class CGIHTTPServerTestCase(BaseTestCase):
self.assertEqual((b'Hello World' + self.linesep, 'text/html', 200),
(res.read(), res.getheader('Content-type'), res.status))
+ def test_query_with_multiple_question_mark(self):
+ res = self.request('/cgi-bin/file4.py?a=b?c=d')
+ self.assertEqual(
+ (b'a=b?c=d' + self.linesep, 'text/html', 200),
+ (res.read(), res.getheader('Content-type'), res.status))
+
class SocketlessRequestHandler(SimpleHTTPRequestHandler):
def __init__(self):
diff --git a/Misc/ACKS b/Misc/ACKS
index 6b4af4439d..9e2c57de7a 100644
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -1531,6 +1531,7 @@ Thomas Wouters
Daniel Wozniak
Heiko Wundram
Doug Wyatt
+Xiang Zhang
Robert Xiao
Florent Xicluna
Hirokazu Yamamoto
diff --git a/Misc/NEWS b/Misc/NEWS
index 99185d181f..f033f3c209 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -90,6 +90,9 @@ Core and Builtins
Library
-------
+- Issue #25232: Fix CGIRequestHandler to split the query from the URL at the
+ first question mark (?) rather than the last. Patch from Xiang Zhang.
+
- Issue #22958: Constructor and update method of weakref.WeakValueDictionary
now accept the self and the dict keyword arguments.
--
2.40.0