Ori Livneh <ori.liv...@gmail.com> added the comment:

I've attached my proposal for a fix. It's my first, so apologies if I've made a 
mistake somewhere. Senthil Kumaran, to whom the bug is currently assigned, 
kindly agreed to let me take a stab at it (thanks!).

The approach I took was to normalize the path by replacing each of os.sep and 
os.altsep with slashes if (a) these characters are present in the path 
component and (b) the operating system is such that os.sep or os.altsep != '/'. 
(Currently, os.altsep is either None or '/' on all systems, but it seemed like 
a good idea to check anyway.)

Requesting a relative path which, when translated, would point above the 
current working directory (e.g. http://localhost:8000/../) causes the server to 
return a 400 error, which is just how Apache responds to such requests.

Internal calls to translate_path with such malformed paths cause translate_path 
to raise an IndexError, which is consistent with how _url_collapse_path_split 
(used by CGIRequestHandler) handles them.

----------
keywords: +patch
Added file: http://bugs.python.org/file22260/translate_path.patch

_______________________________________
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue11197>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

Reply via email to