Skip to content

Commit 42eb552

Browse files
committed
bpo-43223: Fix Open Redirection In http.server module
Fix an open redirection vulnerability in the HTTP server when a URL contains ``//``. Added test case for bpo-43223 patch
1 parent 5eb7796 commit 42eb552

File tree

3 files changed

+20
-0
lines changed

3 files changed

+20
-0
lines changed

Lib/http/server.py

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,7 @@
101101
import socket # For gethostbyaddr()
102102
import socketserver
103103
import sys
104+
import re
104105
import time
105106
import urllib.parse
106107
import contextlib
@@ -332,6 +333,12 @@ def parse_request(self):
332333
return False
333334
self.command, self.path = command, path
334335

336+
# bpo-43223: The purpose of replacing '//' with '/' is to protect against
337+
# open redirect attacks reside within http.server module which can be triggered
338+
# if the path contains '//' at the beginning because web clients treat //path as
339+
# an absolute url without scheme (similar to http://path) rather than a relative path
340+
self.path = re.sub(r'^(/)+', '/', self.path)
341+
335342
# Examine the headers and look for a Connection directive.
336343
try:
337344
self.headers = http.client.parse_headers(self.rfile,

Lib/test/test_http/test_http.py

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
import unittest
2+
import re
3+
4+
class TestHTTP(unittest.TestCase):
5+
6+
def test_http_parse_request(self):
7+
self.assertEqual(re.sub(r'^/+', '/', '//test.com'), '/test.com', '//test.com should be converted to a proper relative path')
8+
self.assertEqual(re.sub(r'^/+', '/', '///test.com'), '/test.com', '///test.com should be converted to a proper relative path')
9+
10+
if __name__ == '__main__':
11+
unittest.main()
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
:mod:`http.server`: Fix an open redirection vulnerability in the HTTP server when an URL contains ``//``.
2+
Vulnerability discovered and fixed by Hamza Avvan.

0 commit comments

Comments
 (0)