← 返回首页
bpo-43223: [SECURITY] Patched Open Redirection In SimpleHTTPServer Module by hamzaavvan · Pull Request #24848 · python/cpython · GitHub
Skip to content

Navigation Menu

Toggle navigation
Sign in
Appearance settings
Search or jump to...

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted
Cancel Submit feedback

Saved searches

Use saved searches to filter your results more quickly

Cancel Create saved search
Appearance settings
Resetting focus

bpo-43223: [SECURITY] Patched Open Redirection In SimpleHTTPServer Module#24848

Closed
hamzaavvan wants to merge 1 commit into
python:mainfrom
hamzaavvan:fix-issue-43223
Closed

bpo-43223: [SECURITY] Patched Open Redirection In SimpleHTTPServer Module#24848
hamzaavvan wants to merge 1 commit into
python:mainfrom
hamzaavvan:fix-issue-43223

Conversation

hamzaavvan commented Mar 13, 2021 •
edited
Loading

Copy link
Copy Markdown

Due to no protection against multiple (/) at the beginning of a url an attacker could achieve an open redirection by crafting a malformed URI followed by an existing directory.

Payload: http://127.0.0.1:8000//attacker.com/..%2f..%2f../anyexistingdirectory

The main reason behind open redirection is that there's no (/) at the end of anyexistingdirectory because the server is checking for the path supplied is a valid directory at send_head() method from Lib/http/server.py. Right after that, it's checking for the path ending with a (/) or not. So, if there's no (/) at the end of the path then the server will issue a Location header to redirect the web client to that specific directory.

While issuing the redirection, this part //attacker.com/..%2f..%2f../anyexistingdirectory will be sent to the Location header's value due to which any web client or browser will consider it as a new url because of multiple (/) at the beginning of the path.

So to mitigate this issue I decided to use regex to replace all the occurrences of (/) from the beginning of the path.

self.path = re.sub(r'(^(/|\\)+)', '/', self.path)

This regex will replace multiple entries (if present) of (/) or (\) from the beginning of the path. So that the path would be:

  1. //attacker.com/..%2f..%2f../anyexistingdirectory -> /attacker.com/..%2f..%2f../anyexistingdirectory
  2. //\attacker.com/..%2f..%2f../anyexistingdirectory -> /attacker.com/..%2f..%2f../anyexistingdirectory
  3. \//\attacker.com/..%2f..%2f../anyexistingdirectory -> /attacker.com/..%2f..%2f../anyexistingdirectory

And according to these test cases there was no redirection issued from the server after implementing the fix.

https://bugs.python.org/issue43223

hamzaavvan changed the title bpo-43223: Patched Open Redirection In SimpleHTTPServer Module bpo-43223: [SECURITY] Patched Open Redirection In SimpleHTTPServer Module Mar 13, 2021
vstinner reviewed Mar 16, 2021
View reviewed changes
Comment thread Lib/http/server.py Outdated Show resolved Hide resolved
Comment thread Misc/NEWS.d/next/Security/2021-03-13-21-25-29.bpo-43223.ieBVWq.rst Outdated Show resolved Hide resolved
hamzaavvan force-pushed the fix-issue-43223 branch 2 times, most recently from e2137b6 to 403490c Compare March 16, 2021 17:42
vstinner reviewed Mar 16, 2021
View reviewed changes
Comment thread Lib/http/server.py Outdated Show resolved Hide resolved
hamzaavvan force-pushed the fix-issue-43223 branch 3 times, most recently from f61138a to 0fe6eed Compare March 16, 2021 18:09
vstinner reviewed Mar 18, 2021
View reviewed changes

vstinner left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality Hide comment

Can you please try to write an unit test?

Comment thread Lib/http/server.py Outdated Show resolved Hide resolved
Comment thread Lib/http/server.py Outdated Show resolved Hide resolved

github-actions Bot commented Apr 18, 2021

Copy link
Copy Markdown

This PR is stale because it has been open for 30 days with no activity.

github-actions Bot added the stale Stale PR or inactive for long period of time. label Apr 18, 2021

hamzaavvan commented May 6, 2021

Copy link
Copy Markdown
Author

Sorry I was busy with my other projects.
Will be pushing the test case shortly.

hamzaavvan commented May 6, 2021

Copy link
Copy Markdown
Author

Since I'm new to writing test cases, please help me in correcting the code if something went wrong.

github-actions Bot removed the stale Stale PR or inactive for long period of time. label May 7, 2021
ned-deily reviewed May 7, 2021
View reviewed changes
Comment thread Misc/NEWS.d/next/Security/2021-03-13-21-25-29.bpo-43223.ieBVWq.rst Outdated Show resolved Hide resolved
bpo-43223: Fix Open Redirection In http.server module …
42eb552
Fix an open redirection vulnerability in the HTTP server when a URL contains ``//``. Added test case for bpo-43223 patch
hamzaavvan requested review from ned-deily and vstinner May 8, 2021 14:32
ned-deily removed their request for review May 21, 2021 22:03

hamzaavvan commented Jun 6, 2021

Copy link
Copy Markdown
Author

@vstinner please have a look at the unit test.

ambv requested changes Jul 12, 2021
View reviewed changes
Comment thread Lib/test/test_http/test_http.py

def test_http_parse_request(self):
self.assertEqual(re.sub(r'^/+', '/', '//test.com'), '/test.com', '//test.com should be converted to a proper relative path')
self.assertEqual(re.sub(r'^/+', '/', '///test.com'), '/test.com', '///test.com should be converted to a proper relative path')

ambv Jul 12, 2021

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality Hide comment

This doesn't test anything useful. It only checks that some regular expression matches two strings. Since your code change is in http.server, your test should execute the http.server path that you changed.

A good test should fail without your code change to http.server, and pass with your change.

hamzaavvan Aug 21, 2021 •
edited
Loading

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality Hide comment

Sorry I've been away due to my workload. But now as I've got some spare time I can do it better. As I've already said earlier that I'm new to writing these test cases and after checking out your comment I'm still confused about your requirements

Can you please elaborate these two statements:

Since your code change is in http.server, your test should execute the http.server path that you changed.

and this one:

A good test should fail without your code change to http.server, and pass with your change.

ambv Aug 29, 2021

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality Hide comment

@hamzaavvan, to put it in the simplest terms:

  • on a clean checkout of the main branch, write a test that fails because it triggers the problem described in BPO-43223; this will prove we have a problem;
  • then include your fix to prove that the fix solved the problem.

The test will have to actually run the HTTP server to be useful.

bedevere-bot commented Jul 12, 2021

Copy link
Copy Markdown

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

jhadvig commented Apr 8, 2022

Copy link
Copy Markdown

@hamzaavvan ping :)

hamzaavvan commented Apr 8, 2022 via email

Copy link
Copy Markdown
Author

188 hidden items Load more…
hamzaavvan mannequin mentioned this pull request Apr 10, 2022
Closed
gpshead mentioned this pull request Jun 15, 2022
Merged

gpshead commented Jun 15, 2022

Copy link
Copy Markdown
Member

This PR has been replaced by #93879

gpshead closed this Jun 15, 2022
ibm-mend-app Bot mentioned this pull request Sep 17, 2025
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

ambv ambv requested changes
ned-deily ned-deily left review comments
vstinner Awaiting requested review from vstinner

Assignees

No one assigned

Labels

awaiting changes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

8 participants

Footer

© 2026 GitHub, Inc.