Skip to content

SimpleHTTPRequestHandler incorrectly handles trailing escaped slash #134098

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
serhiy-storchaka opened this issue May 16, 2025 · 2 comments
Closed
Assignees
Labels
3.13 bugs and security fixes 3.14 bugs and security fixes 3.15 new features, bugs and security fixes stdlib Python modules in the Lib dir type-bug An unexpected behavior, bug, or error

Comments

@serhiy-storchaka
Copy link
Member

serhiy-storchaka commented May 16, 2025

Bug report

For path to directory which does not end with slash ("/"), SimpleHTTPRequestHandler returns status MOVED_PERMANENTLY with redirection to new path that ends with slash. Slashes can be percent-encoded, although this is not necessary. But the code that checks for the trailing slash does not take this into account (in two place).

Linked PRs

@serhiy-storchaka serhiy-storchaka self-assigned this May 16, 2025
@serhiy-storchaka serhiy-storchaka added type-bug An unexpected behavior, bug, or error 3.13 bugs and security fixes 3.14 bugs and security fixes 3.15 new features, bugs and security fixes labels May 16, 2025
@serhiy-storchaka
Copy link
Member Author

Other effect of this bug -- a percent-encoded trailing slash is ignored after non-directory path (should return status NOT_FOUND).

serhiy-storchaka added a commit to serhiy-storchaka/cpython that referenced this issue May 16, 2025
@picnixz picnixz added the stdlib Python modules in the Lib dir label May 16, 2025
@donBarbos
Copy link
Contributor

since you mentioned request handling, what do you think about making http.server accept "absolute form" as "request target"?
issue #132741

miss-islington pushed a commit to miss-islington/cpython that referenced this issue May 17, 2025
…equestHandler (pythonGH-134099)

(cherry picked from commit 2f1ecb3)

Co-authored-by: Serhiy Storchaka <[email protected]>
miss-islington pushed a commit to miss-islington/cpython that referenced this issue May 17, 2025
…equestHandler (pythonGH-134099)

(cherry picked from commit 2f1ecb3)

Co-authored-by: Serhiy Storchaka <[email protected]>
serhiy-storchaka added a commit that referenced this issue May 17, 2025
…RequestHandler (GH-134099) (GH-134124)

(cherry picked from commit 2f1ecb3)

Co-authored-by: Serhiy Storchaka <[email protected]>
serhiy-storchaka added a commit that referenced this issue May 17, 2025
…RequestHandler (GH-134099) (GH-134123)

(cherry picked from commit 2f1ecb3)

Co-authored-by: Serhiy Storchaka <[email protected]>
@hugovk hugovk closed this as completed May 20, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3.13 bugs and security fixes 3.14 bugs and security fixes 3.15 new features, bugs and security fixes stdlib Python modules in the Lib dir type-bug An unexpected behavior, bug, or error
Projects
None yet
Development

No branches or pull requests

4 participants