Skip to content

gh-87389: avoid treating path as URI with netloc #93894

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nascheme wants to merge 19 commits into
base: main
Choose a base branch
from
Open

gh-87389: avoid treating path as URI with netloc #93894

Changes from 1 commit
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
4f76c44
wip: alternative fix for gh-87389
nascheme Jun 16, 2022
06b3879
Don't strip slashes if not building relative URL.
nascheme Jun 16, 2022
00a3a92
Add unit test for urlunsplit relative URL case.
nascheme Jun 16, 2022
a8e1cc2
sanitize paths that can be confused as scheme
nascheme Jun 16, 2022
83c8332
Add blurb.
nascheme Jun 16, 2022
f99e80b
Improve name and comment for _get_redirect_url().
nascheme Jun 16, 2022
e542578
Add urllib.parse.pathsplit() function.
nascheme Jun 16, 2022
b7b0b15
Fix blurb formating, add note about pathsplit().
nascheme Jun 16, 2022
6915331
Improve comments and docs.
nascheme Jun 16, 2022
915451c
Add basic unit test for pathsplit().
nascheme Jun 16, 2022
952a0f4
Fix markup in blurb.
nascheme Jun 16, 2022
899f512
Use pathsplit() in translate_path().
nascheme Jun 16, 2022
a00656c
Improved unit tests from gps.
nascheme Jun 16, 2022
8985853
Add test for Request-URI containing scheme.
nascheme Jun 16, 2022
f1f94ae
Make _get_redirect_url() into a method.
nascheme Jun 16, 2022
8a34cd0
Futher cleanups, remove urllib.parse.pathsplit().
nascheme Jun 16, 2022
23d4b56
reword news
gpshead Jul 3, 2022
7a71381
Merge branch 'main' into urlunsplit_relative
serhiy-storchaka May 14, 2024
d18bbd9
Merge branch 'main' into urlunsplit_relative
serhiy-storchaka May 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Improved unit tests from gps.
  • Loading branch information
@nascheme
nascheme committed Jun 16, 2022
commit a00656c572c121e131808c18c16ae8f05f2b0be4
27 changes: 21 additions & 6 deletions Lib/test/test_httpservers.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -421,23 +421,38 @@ def test_undecodable_filename(self):
def test_get_dir_redirect_location_domain_injection_bug(self):
Comment thread
nascheme marked this conversation as resolved.
"""Ensure //evil.co/..%2f../../X does not put //evil.co/ in Location.

//domain/ in a Location header is a redirect to a new domain name.
//netloc/ in a Location header is a redirect to a new host.
https://github.com/python/cpython/issues/87389

This checks that a path resolving to a directory on our server cannot
resolve into a redirect to another server telling it that the
directory in question exists on the Referrer server.
resolve into a redirect to another server.
"""
os.mkdir(os.path.join(self.tempdir, 'existing_directory'))
attack_url = f'//python.org/..%2f..%2f..%2f..%2f..%2f../%0a%0d/../{self.tempdir_name}/existing_directory'
url = f'/python.org/..%2f..%2f..%2f..%2f..%2f../%0a%0d/../{self.tempdir_name}/existing_directory'
expected_location = f'{url}/' # /python.org.../ single slash single prefix, trailing slash
# Canonicalizes to /tmp/tempdir_name/existing_directory which does
# exist and is a dir, triggering the 301 redirect logic.
response = self.request(url)
self.check_status_and_reason(response, HTTPStatus.MOVED_PERMANENTLY)
location = response.getheader('Location')
self.assertEqual(location, expected_location, msg='non-attack failed!')

# //python.org... multi-slash prefix, no trailing slash
attack_url = f'/{url}'
response = self.request(attack_url)
self.check_status_and_reason(response, HTTPStatus.MOVED_PERMANENTLY)
location = response.getheader('Location')
self.assertFalse(location.startswith('//'), msg=location)
self.assertEqual(location, attack_url[1:] + '/',
msg='Expected Location: to start with a single / and '
self.assertEqual(location, expected_location,
msg='Expected Location header to start with a single / and '
'end with a / as this is a directory redirect.')

# ///python.org... triple-slash prefix, no trailing slash
attack3_url = f'//{url}'
response = self.request(attack3_url)
self.check_status_and_reason(response, HTTPStatus.MOVED_PERMANENTLY)
self.assertEqual(response.getheader('Location'), expected_location)

def test_get(self):
#constructs the path relative to the root directory of the HTTPServer
response = self.request(self.base_url + '/test')
Expand Down