Merge pull request #74 from cherrypy/bugfix/options-path-processing

WIP: Bypass URI as path only if absolute for OPTIONS
cherrypy · Oct 14, 2019 · 02f7a17 · 02f7a17
2 parents bdbd6ee + dc9592b
commit 02f7a17
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 3 deletions.
diff --git a/CHANGES.rst b/CHANGES.rst
@@ -3,6 +3,8 @@ v8.2.0
 
 - Deprecated use of negative timeouts as alias for
   infinite timeouts in ``ThreadPool.stop``.
+- :cp-issue:`1662` via :pr:`74`: For OPTION requests,
+  bypass URI as path if it does not appear absolute.
 
 v8.1.0
 ======

diff --git a/cheroot/server.py b/cheroot/server.py
@@ -827,12 +827,14 @@ def read_request_line(self):
             self.simple_response('400 Bad Request', 'Malformed Request-URI')
             return False
 
+        uri_is_absolute_form = (scheme or authority)
+
         if self.method == b'OPTIONS':
             # TODO: cover this branch with tests
             path = (
                 uri
                 # https://tools.ietf.org/html/rfc7230#section-5.3.4
-                if self.proxy_mode or uri == ASTERISK
+                if (self.proxy_mode and uri_is_absolute_form)
                 else path
             )
         elif self.method == b'CONNECT':
@@ -871,8 +873,6 @@ def read_request_line(self):
             authority = path = _authority
             scheme = qs = fragment = EMPTY
         else:
-            uri_is_absolute_form = (scheme or authority)
-
             disallowed_absolute = (
                 self.strict_mode
                 and not self.proxy_mode