New submission from Mike Watkins <python@mikewatkins.ca>:
There appears to have been a bug in how HTTP_ACCEPT is parsed living in
run_cgi() for eons, perhaps from the time it was written. Perhaps not
many are using this code (I'm not either) but recent (post 3.0 Release)
Python 3.x appear to have broken something in getallmatchingheaders()
(which originates in Message) and I happened to stumble upon this
condition while searching through the stdlib code.
>From Line 980 of http.server
accept = []
for line in self.headers.getallmatchingheaders('accept'):
if line[:1] in "\t\n\r ":
accept.append(line.strip())
else:
accept = accept + line[7:].split(',')
env['HTTP_ACCEPT'] = ','.join(accept)
line[:1] in '\t\n\r' clearly was meant to to be line[-1].
However that doesn't fix completely this chunk of code as it makes some
assumptions about what getallmatchingheaders() delivers which aren't
accurate. The following behaves as expected and feels safer:
accept = []
for line in self.headers.getallmatchingheaders('accept'):
if line.lower().startswith("accept:"):
line = line[7:]
for part in line.split(','):
part = part.strip()
if part:
accept.append(part)
env['HTTP_ACCEPT'] = ','.join(accept)
Note that post Python 3.0 release,
http.client.HTTPMessage.getallmatchingheaders() was broken. I've
reported this just now and proposed a fix in #5053.
----------
components: Library (Lib)
messages: 80510
nosy: mwatkins
severity: normal
status: open
title: CGIHTTPRequestHandler.run_cgi() HTTP_ACCEPT improperly parsed
type: behavior
versions: Python 2.4, Python 2.5, Python 2.6, Python 2.7, Python 3.0, Python 3.1
_______________________________________
Python tracker <report@bugs.python.org>
<http://bugs.python.org/issue5054>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/list-python-bugs%40lists.gossamer-threads.com
There appears to have been a bug in how HTTP_ACCEPT is parsed living in
run_cgi() for eons, perhaps from the time it was written. Perhaps not
many are using this code (I'm not either) but recent (post 3.0 Release)
Python 3.x appear to have broken something in getallmatchingheaders()
(which originates in Message) and I happened to stumble upon this
condition while searching through the stdlib code.
>From Line 980 of http.server
accept = []
for line in self.headers.getallmatchingheaders('accept'):
if line[:1] in "\t\n\r ":
accept.append(line.strip())
else:
accept = accept + line[7:].split(',')
env['HTTP_ACCEPT'] = ','.join(accept)
line[:1] in '\t\n\r' clearly was meant to to be line[-1].
However that doesn't fix completely this chunk of code as it makes some
assumptions about what getallmatchingheaders() delivers which aren't
accurate. The following behaves as expected and feels safer:
accept = []
for line in self.headers.getallmatchingheaders('accept'):
if line.lower().startswith("accept:"):
line = line[7:]
for part in line.split(','):
part = part.strip()
if part:
accept.append(part)
env['HTTP_ACCEPT'] = ','.join(accept)
Note that post Python 3.0 release,
http.client.HTTPMessage.getallmatchingheaders() was broken. I've
reported this just now and proposed a fix in #5053.
----------
components: Library (Lib)
messages: 80510
nosy: mwatkins
severity: normal
status: open
title: CGIHTTPRequestHandler.run_cgi() HTTP_ACCEPT improperly parsed
type: behavior
versions: Python 2.4, Python 2.5, Python 2.6, Python 2.7, Python 3.0, Python 3.1
_______________________________________
Python tracker <report@bugs.python.org>
<http://bugs.python.org/issue5054>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/list-python-bugs%40lists.gossamer-threads.com