gh-81054: Document that SimpleHTTPRequestHandler follows symbolic links (GH-94416...

(cherry picked from commit 80aaeabb8bd1e6b49598a7e23e0f8d99b3fcecaf)

Co-authored-by: Sam Ezeh <sam.z.ezeh@gmail.com>

diff --git a/Doc/library/http.server.rst b/Doc/library/http.server.rst
index 0de02834401aa8d786ec06544865ab32cd5f8c74..8584f99d1567bc25055af30fda4ba532ea9d61b7 100644 (file)
--- a/Doc/library/http.server.rst
+++ b/Doc/library/http.server.rst
@@ -20,7 +20,7 @@ This module defines classes for implementing HTTP servers.
 .. warning::
 
     :mod:`http.server` is not recommended for production. It only implements
-    basic security checks.
+    :ref:`basic security checks <http.server-security>`.
 
 One class, :class:`HTTPServer`, is a :class:`socketserver.TCPServer` subclass.
 It creates and listens at the HTTP socket, dispatching the requests to a
@@ -488,3 +488,14 @@ the following command uses a specific directory::
 the ``--cgi`` option::
 
         python -m http.server --cgi
+
+.. _http.server-security:
+
+Security Considerations
+-----------------------
+
+.. index:: pair: http.server; security
+
+:class:`SimpleHTTPRequestHandler` will follow symbolic links when handling
+requests, this makes it possible for files outside of the specified directory
+to be served.

diff --git a/Doc/library/security_warnings.rst b/Doc/library/security_warnings.rst
index 26b015c0f8fc7a193b34c3439c0da0c71f6e5008..3cc79413871f211f8b04279a49ec3a3d79afc17d 100644 (file)
--- a/Doc/library/security_warnings.rst
+++ b/Doc/library/security_warnings.rst
@@ -14,7 +14,7 @@ The following modules have specific security considerations:
   argument disabling known insecure and blocked algorithms
   <hashlib-usedforsecurity>`
 * :mod:`http.server` is not suitable for production use, only implementing
-  basic security checks
+  basic security checks. See the :ref:`security considerations <http.server-security>`.
 * :mod:`logging`: :ref:`Logging configuration uses eval()
   <logging-eval-security>`
 * :mod:`multiprocessing`: :ref:`Connection.recv() uses pickle