Skip to content

gh-87389: avoid treating path as URI with netloc #93894

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
nascheme wants to merge 19 commits into from
Closed

gh-87389: avoid treating path as URI with netloc #93894

Changes from 1 commit
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
4f76c44
wip: alternative fix for gh-87389
nascheme Jun 16, 2022
06b3879
Don't strip slashes if not building relative URL.
nascheme Jun 16, 2022
00a3a92
Add unit test for urlunsplit relative URL case.
nascheme Jun 16, 2022
a8e1cc2
sanitize paths that can be confused as scheme
nascheme Jun 16, 2022
83c8332
Add blurb.
nascheme Jun 16, 2022
f99e80b
Improve name and comment for _get_redirect_url().
nascheme Jun 16, 2022
e542578
Add urllib.parse.pathsplit() function.
nascheme Jun 16, 2022
b7b0b15
Fix blurb formating, add note about pathsplit().
nascheme Jun 16, 2022
6915331
Improve comments and docs.
nascheme Jun 16, 2022
915451c
Add basic unit test for pathsplit().
nascheme Jun 16, 2022
952a0f4
Fix markup in blurb.
nascheme Jun 16, 2022
899f512
Use pathsplit() in translate_path().
nascheme Jun 16, 2022
a00656c
Improved unit tests from gps.
nascheme Jun 16, 2022
8985853
Add test for Request-URI containing scheme.
nascheme Jun 16, 2022
f1f94ae
Make _get_redirect_url() into a method.
nascheme Jun 16, 2022
8a34cd0
Futher cleanups, remove urllib.parse.pathsplit().
nascheme Jun 16, 2022
23d4b56
reword news
gpshead Jul 3, 2022
7a71381
Merge branch 'main' into urlunsplit_relative
serhiy-storchaka May 14, 2024
d18bbd9
Merge branch 'main' into urlunsplit_relative
serhiy-storchaka May 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Improve name and comment for _get_redirect_url().
  • Loading branch information
@nascheme
nascheme committed Jun 16, 2022
commit f99e80b935613e802ade6f9d85e8e8c3595456a5
10 changes: 8 additions & 2 deletions Lib/http/server.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -678,7 +678,7 @@ def send_head(self):
path = self.translate_path(self.path)
f = None
if os.path.isdir(path):
new_url = _add_trailing_slash(self.path)
new_url = _get_redirect_url(self.path)
if new_url:
# redirect browser - doing basically what apache does
self.send_response(HTTPStatus.MOVED_PERMANENTLY)
Expand Down Expand Up @@ -878,10 +878,16 @@ def guess_type(self, path):
return 'application/octet-stream'


def _add_trailing_slash(path):
def _get_redirect_url(path):
"""Returns URL with trailing slash on path, if required. If not required,
returns None.
"""
# It would be simpler to use urllib.parse.urlsplit() here. However, the
# 'path' is not truly a URI in that it can't have a scheme or netloc. We
# need to avoid parsing it incorrectly. For example, as reported in
# gh-87389, a path starting with a double slash should not be treated as a
# relative URI. Also, a path with a colon in the first component could
# also be parsed wrongly.
path, _, fragment = path.partition('#')
path, _, query = path.partition('?')
if path.endswith('/'):
Expand Down