New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

`cherrypy.url` fails to normalize path #1595

Closed
lbolla opened this Issue May 16, 2017 · 0 comments

Comments

Projects
None yet
2 participants
@lbolla
Contributor

lbolla commented May 16, 2017

This call to cherrypy.url fails with IndexError:

>>> cherrypy.url(qs='../../../../../../etc/passwd')
...
IndexError: pop from empty list

The culprit seems in this logic, which strips newurl of as many atoms as there are ..:
https://github.com/cherrypy/cherrypy/blob/master/cherrypy/_helper.py#L261,L271

There are various problems.

  • That logic should only applied to the "path" part of newurl, not to the full url.

  • As a consequence of the point above, .. in the query string qs should not be considered

  • To consider: redundant .. should be ignored, to mimic os.path.normpath:

>>> os.path.normpath('/etc/../../../usr')
'/usr'

@jaraco jaraco closed this in 2a6f1c6 May 17, 2017

jaraco added a commit that referenced this issue May 17, 2017

Merge pull request #1596 from lbolla/issue-188
Fix #1595 Fix path normlisation
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment