]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
projects / thirdparty / Python / cpython.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 0709586) | patch
gh-87389: Fix an open redirection vulnerability in http.server. (#93879)
authorGregory P. Smith <greg@krypto.org>
Tue, 21 Jun 2022 20:16:57 +0000 (13:16 -0700)
committerGitHub <noreply@github.com>
Tue, 21 Jun 2022 20:16:57 +0000 (13:16 -0700)
commit4abab6b603dd38bec1168e9a37c40a48ec89508e
treee606aa6a39146ea80b6c6e7e3f55aec22d08c7b4tree | snapshot
parent0709586744ec58dd60492e16b08fff6dc1149a0acommit | diff
gh-87389: Fix an open redirection vulnerability in http.server. (#93879)

Fix an open redirection vulnerability in the `http.server` module when
an URI path starts with `//` that could produce a 301 Location header
with a misleading target.  Vulnerability discovered, and logic fix
proposed, by Hamza Avvan (@hamzaavvan).

Test and comments authored by Gregory P. Smith [Google].
Lib/http/server.py diff | blob | blame | history
Lib/test/test_httpservers.py diff | blob | blame | history
Misc/NEWS.d/next/Security/2022-06-15-20-09-23.gh-issue-87389.QVaC3f.rst [new file with mode: 0644] blob
Mirror of https://github.com/python/cpython.git