CGIHTTPRequestHandler.run_cgi() HTTP_ACCEPT improperly parsed #49304

Activity

1. mwatkins commented on Jan 25, 2009

   

   mwatkinsmannequin

   on Jan 25, 2009

   MannequinAuthor

   More actions

   There appears to have been a bug in how HTTP_ACCEPT is parsed living in
   run_cgi() for eons, perhaps from the time it was written. Perhaps not
   many are using this code (I'm not either) but recent (post 3.0 Release)
   Python 3.x appear to have broken something in getallmatchingheaders()
   (which originates in Message) and I happened to stumble upon this
   condition while searching through the stdlib code.

   From Line 980 of http.server

           accept = []
           for line in self.headers.getallmatchingheaders('accept'):
               if line[:1] in "\t\n\r ":
                   accept.append(line.strip())
               else:
                   accept = accept + line[7:].split(',')
           env['HTTP_ACCEPT'] = ','.join(accept)

   line[:1] in '\t\n\r' clearly was meant to to be line[-1].

   However that doesn't fix completely this chunk of code as it makes some
   assumptions about what getallmatchingheaders() delivers which aren't
   accurate. The following behaves as expected and feels safer:

           accept = []
           for line in self.headers.getallmatchingheaders('accept'):
               if line.lower().startswith("accept:"):
                   line = line[7:]
               for part in line.split(','):
                   part = part.strip()
                   if part:
                       accept.append(part)
           env['HTTP_ACCEPT'] = ','.join(accept)

   Note that post Python 3.0 release,
   http.client.HTTPMessage.getallmatchingheaders() was broken. I've
   reported this just now and proposed a fix in bpo-5053.
2. mwatkins

   added

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Jan 25, 2009
3. terryjreedy commented on Jun 26, 2010

   

   terryjreedy

   on Jun 26, 2010

   Member

   More actions

   I hope that someone who knows more than me on this subject takes a look at this.
4. vadmium commented on Feb 15, 2015

   

   vadmium

   on Feb 15, 2015

   Member

   More actions

   Posting a patch for this so that we can get rid of the broken HTTPMessage.getallmatchingheaders() method in bpo-5053.
5. vadmium commented on Feb 15, 2015

   

   vadmium

   on Feb 15, 2015

   Member

   More actions

   BTW in the original code, I think line[:1] in "\t\n\r " might have been correct. It looks like the getallmatchinheaders() method was actually meant to return continued lines separately, prefixed with whitespace. My patch is probably only appropriate for Python 3; maybe Mike’s code will work for Python 2.
6. orsenthil

   added

   3.9 (EOL)end of lifeend of life

   3.10 (EOL)end of lifeend of life

   on Dec 1, 2020
7. orsenthil

   self-assigned this

   on Dec 1, 2020
8. miss-islington commented on Dec 5, 2020

   

   miss-islington

   on Dec 5, 2020

   Contributor

   More actions

   New changeset b630ca7 by Miss Islington (bot) in branch '3.9':
   [3.9] bpo-5054: CGIHTTPRequestHandler.run_cgi() HTTP_ACCEPT improperly parsed (GH-23638) (GH-23657)
   b630ca7
9. orsenthil

   closed this as completedon Dec 5, 2020
10. orsenthil commented on Dec 5, 2020

    

    orsenthil

    on Dec 5, 2020

    Member

    More actions

    This was also resolved in 3.10 #23638
11. ezio-melotti

    transferred this issue fromon Apr 10, 2022