From 43a1a0dde57cb7e02974dc8b991ea2f7efe2af16 Mon Sep 17 00:00:00 2001 From: James Frost Date: Fri, 23 Dec 2022 20:37:32 +0000 Subject: [PATCH 1/5] Fix handling of dirs named index.html in http.server If you had a directory called index.html or index.htm within a directory, it would cause http.server to return a 404 Not Found error instead of the directory listing. This came about due to not checking that the index was a regular file. --- Lib/http/server.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Lib/http/server.py b/Lib/http/server.py index 8acabff605e795..221c8be4ae4b8f 100644 --- a/Lib/http/server.py +++ b/Lib/http/server.py @@ -711,7 +711,7 @@ def send_head(self): return None for index in self.index_pages: index = os.path.join(path, index) - if os.path.exists(index): + if os.path.isfile(index): path = index break else: From b89b070a77fe243cb4114b6251b912f9daebf424 Mon Sep 17 00:00:00 2001 From: James Frost Date: Fri, 23 Dec 2022 21:02:55 +0000 Subject: [PATCH 2/5] Add NEWS notice via blurb --- .../next/Library/2022-12-23-21-02-43.gh-issue-100474.gppA4U.rst | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 Misc/NEWS.d/next/Library/2022-12-23-21-02-43.gh-issue-100474.gppA4U.rst diff --git a/Misc/NEWS.d/next/Library/2022-12-23-21-02-43.gh-issue-100474.gppA4U.rst b/Misc/NEWS.d/next/Library/2022-12-23-21-02-43.gh-issue-100474.gppA4U.rst new file mode 100644 index 00000000000000..ddefc9cc265436 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2022-12-23-21-02-43.gh-issue-100474.gppA4U.rst @@ -0,0 +1,2 @@ +Check that index page is actually a regular file before trying to serve it. +This avoids issues around directories named "index.html". From ee23e37e8618cbbbaa33aaed252a060e9d4a638e Mon Sep 17 00:00:00 2001 From: James Frost Date: Fri, 23 Dec 2022 21:39:56 +0000 Subject: [PATCH 3/5] Add test for index.html dir for http.server --- Lib/test/test_httpservers.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py index ca078862cca6b9..cbcf94136ac4eb 100644 --- a/Lib/test/test_httpservers.py +++ b/Lib/test/test_httpservers.py @@ -489,6 +489,9 @@ def test_get(self): self.check_status_and_reason(response, HTTPStatus.NOT_FOUND) response = self.request('/' + 'ThisDoesNotExist' + '/') self.check_status_and_reason(response, HTTPStatus.NOT_FOUND) + os.makedirs(os.path.join(self.tempdir, 'spam', 'index.html')) + response = self.request(self.base_url + '/spam/') + self.check_status_and_reason(response, HTTPStatus.OK) data = b"Dummy index file\r\n" with open(os.path.join(self.tempdir_name, 'index.html'), 'wb') as f: From 869d94af935ad0b961bff55758018e90fb98c598 Mon Sep 17 00:00:00 2001 From: James Frost Date: Sat, 24 Dec 2022 18:02:08 +0000 Subject: [PATCH 4/5] Update Misc/NEWS.d/next/Library/2022-12-23-21-02-43.gh-issue-100474.gppA4U.rst MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add context around where the bug was. Co-authored-by: Éric --- .../Library/2022-12-23-21-02-43.gh-issue-100474.gppA4U.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Misc/NEWS.d/next/Library/2022-12-23-21-02-43.gh-issue-100474.gppA4U.rst b/Misc/NEWS.d/next/Library/2022-12-23-21-02-43.gh-issue-100474.gppA4U.rst index ddefc9cc265436..4c00a707ff9939 100644 --- a/Misc/NEWS.d/next/Library/2022-12-23-21-02-43.gh-issue-100474.gppA4U.rst +++ b/Misc/NEWS.d/next/Library/2022-12-23-21-02-43.gh-issue-100474.gppA4U.rst @@ -1,2 +1,2 @@ -Check that index page is actually a regular file before trying to serve it. -This avoids issues around directories named "index.html". +:mod:`http.server` now checks that an index page is actually a regular file before trying +to serve it. This avoids issues with directories named `index.html`. From ed9312d1f83339d0c61e62371c5674824d3ac06e Mon Sep 17 00:00:00 2001 From: James Frost Date: Sat, 24 Dec 2022 18:05:35 +0000 Subject: [PATCH 5/5] Correct ReST syntax in NEWS file --- .../next/Library/2022-12-23-21-02-43.gh-issue-100474.gppA4U.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Misc/NEWS.d/next/Library/2022-12-23-21-02-43.gh-issue-100474.gppA4U.rst b/Misc/NEWS.d/next/Library/2022-12-23-21-02-43.gh-issue-100474.gppA4U.rst index 4c00a707ff9939..31abfb8b87fbee 100644 --- a/Misc/NEWS.d/next/Library/2022-12-23-21-02-43.gh-issue-100474.gppA4U.rst +++ b/Misc/NEWS.d/next/Library/2022-12-23-21-02-43.gh-issue-100474.gppA4U.rst @@ -1,2 +1,2 @@ :mod:`http.server` now checks that an index page is actually a regular file before trying -to serve it. This avoids issues with directories named `index.html`. +to serve it. This avoids issues with directories named ``index.html``.