CGIHttpServer leaves traces of previous requests in env

[stevecassidy]

BPO	1711605
Nosy	@loewis, @birkenfeld
Superseder	bpo-9272: CGIHTTPServer poisons os.environ

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2010-07-31.19:10:34.896>
created_at = <Date 2007-05-03.00:28:37.000>
labels = ['easy', 'type-bug', 'library']
title = 'CGIHttpServer leaves traces of previous requests in env'
updated_at = <Date 2010-07-31.19:10:34.894>
user = 'https://bugs.python.org/stevecassidy'

bugs.python.org fields:

activity = <Date 2010-07-31.19:10:34.894>
actor = 'georg.brandl'
assignee = 'none'
closed = True
closed_date = <Date 2010-07-31.19:10:34.896>
closer = 'georg.brandl'
components = ['Library (Lib)']
creation = <Date 2007-05-03.00:28:37.000>
creator = 'stevecassidy'
dependencies = []
files = []
hgrepos = []
issue_num = 1711605
keywords = ['easy']
message_count = 5.0
messages = ['31931', '31932', '107914', '107915', '112182']
nosy_count = 5.0
nosy_names = ['loewis', 'georg.brandl', 'techtonik', 'stevecassidy', 'dugan']
pr_nums = []
priority = 'normal'
resolution = 'duplicate'
stage = 'test needed'
status = 'closed'
superseder = '9272'
type = 'behavior'
url = 'https://bugs.python.org/issue1711605'
versions = ['Python 2.6', 'Python 3.0']

[stevecassidy]

CGIHttpserver tries to reset the environment between calls to CGI scripts by setting various variables to '' if they are not needed in the current request. In some cases this is not the correct behaviour since the presence of a null value can be interpreted by a CGI script as being significant.

For example, if HTTP_COOKIE has a null value then a script doing the standard test:

if os.environ.has_key('HTTP_COOKIE'):
   # get the cookie

will have trouble

The problem is that CGIHTTPserver.py resets the entries in the env array which is then passed to os.environ.update(), this can only overwrite the env variables, not remove them.

An alternative is to call

if os.environ.has_key(k):
    del os.environ[k]

inside the loop that updates the empty keys, then these variables will not be passed on to the CGI script.

Steve

[loewis]

Can you provide a patch?

[techtonik]

I don't see why it modifies os.environ at all environ it passed as argument to child subprocess.

[techtonik]

I can't edit my comment. That suxx. It should be
"...at all if environ is passed..."

[birkenfeld]

bpo-9272 has a patch.