gh-87389: Fix an open redirection vulnerability in http.server. (GH-93879) (GH-94093)
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Wed, 22 Jun 2022 08:42:02 +0000 (01:42 -0700)
committerAdrian Bunk <bunk@debian.org>
Sun, 1 Dec 2024 12:12:57 +0000 (14:12 +0200)
commit299c795a2c1d52b4f3c180856ddcca7a23eb17e6
tree2a06c0ade89d09fd760bc1a6709389967909dddb
parentc408d358aac5a8d7a142a8b13a851eabc9ba6018
gh-87389: Fix an open redirection vulnerability in http.server. (GH-93879) (GH-94093)

Fix an open redirection vulnerability in the `http.server` module when
an URI path starts with `//` that could produce a 301 Location header
with a misleading target.  Vulnerability discovered, and logic fix
proposed, by Hamza Avvan (@hamzaavvan).

Test and comments authored by Gregory P. Smith [Google].
(cherry picked from commit 4abab6b603dd38bec1168e9a37c40a48ec89508e)

Co-authored-by: Gregory P. Smith <greg@krypto.org>
Gbp-Pq: Name 0008-gh-87389-Fix-an-open-redirection-vulnerability-in-ht.patch
Lib/http/server.py
Lib/test/test_httpservers.py