Issue #815 open

cherrypy doesn't handle case where URL path contains multiple slashes

guest
created an issue

If you feed something like

GET //status/Status/ HTTP/1.1

cherrypy will treat status as hostname and Status as path.

As a result links like http://localhost//status/Status/ will produce 404.

Comments (4)

  1. Robert Brewer

    Just to be sure, I perused the BNF-like grammar for HTTP:

    Request-URI    = "*" | absoluteURI | abs_path | authority
    abs_path      = "/"  path_segments
    path_segments = segment *( "/" segment )
    segment       = *pchar *( ";" param )
    

    So, although the abs_path style of Request-URI must contain at least one segment, that segment or any other may be zero pchars.

    IMO the wsgiserver should not silently translate initial `` to `/`; instead, it should pass the path along unmolested. Application developers who choose to treat the former as a synonym for the latter should re-route it in their applications, not at the HTTP server level.

  2. Robert Brewer

    Lots of work done in a branch in [1977]. The crux of the matter is that most of Python's URL-handling functions are designed to operate on the full set of URI's, which can be ambiguous. HTTP's Request-URI, however, is an unambiguous subset of URI's, and needs a different set of functions to work correctly and optimally. See the wsgiserver changeset for lots more details.

  3. Log in to comment