X Tutup
The Wayback Machine - https://web.archive.org/web/20221223112146/https://github.com/python/cpython/pull/25519
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bpo-43910 Fix handling of quoted values in cgi.parse_header #25519

Closed
wants to merge 1 commit into from
Closed

bpo-43910 Fix handling of quoted values in cgi.parse_header #25519

wants to merge 1 commit into from

Conversation

msg555
Copy link

@msg555 msg555 commented Apr 22, 2021 •
edited

Updates the logic in cgi.parse_header to do a proper scan over the string managing the parse state properly. This corrects cases where a quoted value ends with a backslash character. This PR also correctly unescapes characters other than the backslash or double quote character by replacing them with the octet literal following a backslash in a quoted string (although according to the spec clients should not quote anything other than those two characters).

The goal is to recognize the language detailed in https://www.w3.org/Protocols/rfc1341/4_Content-Type.html (with additional details on quoted-string at https://greenbytes.de/tech/webdav/draft-ietf-httpbis-p1-messaging-16.html#rfc.section.3.2.1.p.3 ).

Note that this method has no validation that the header value is well formed and always returns a value. Do to this we recognize a slightly larger language that looks something like

wsp = any (possibly empty) string of white space characters
header = wsp type wsp [ ';' parameter ]*
type = any char but ';'
parameter = wsp mixed-string wsp '=' wsp mixed-string wsp
mixed-string = empty-string | ( quoted-string | any char but ';', '=', '"' ) mixed-string

This also eliminates an unnecessary quadratic loop (that was also the source of the correctness problem)

https://bugs.python.org/issue43910

@msg555
Fix handling of quoted values in cgi.parse_header
9dfa75a 
Signed-off-by: Mark Gordon <msg555@gmail.com>
@the-knights-who-say-ni
Copy link

the-knights-who-say-ni commented Apr 22, 2021

Hello, and thanks for your contribution!

I'm a bot set up to make sure that the project can legally accept this contribution by verifying everyone involved has signed the PSF contributor agreement (CLA).

CLA Missing

Our records indicate the following people have not signed the CLA:

@msg555

For legal reasons we need all the people listed to sign the CLA before we can look at your contribution. Please follow the steps outlined in the CPython devguide to rectify this issue.

If you have recently signed the CLA, please wait at least one business day
before our records are updated.

You can check yourself to see if the CLA has been received.

Thanks again for the contribution, we look forward to reviewing it!

@msg555 msg555 marked this pull request as ready for review Apr 22, 2021
@msg555 msg555 requested a review from ethanfurman as a code owner Apr 22, 2021
@github-actions
Copy link

github-actions bot commented Jun 3, 2021

This PR is stale because it has been open for 30 days with no activity.

@github-actions github-actions bot added the stale Stale PR or inactive for long period of time. label Jun 3, 2021
@AlexWaygood
Copy link
Member

AlexWaygood commented Apr 11, 2022

@msg555, thanks for the PR. Unfortunately, the cgi module is now deprecated following the acceptance of PEP 594, so bugfixes and improvements for this module will no longer be accepted. I am therefore closing this PR.

I hope that this does not dissuade you from contributing to CPython in the future 🙂

@msg555 msg555 mannequin mentioned this pull request Apr 11, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ethanfurman ethanfurman

Assignees
No one assigned
Labels
awaiting review stale Stale PR or inactive for long period of time.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@msg555 @the-knights-who-say-ni @AlexWaygood @bedevere-bot
X Tutup