This is an archive of the discontinued Mercurial Phabricator instance.

Differential D1110

hgweb: when unpacking args from request form, convert to bytes
ClosedPublic

Authored by durin42 on Oct 16 2017, 9:51 AM.

Details

Reviewers
yuja
Group Reviewers
hg-reviewers
Commits
rHG5a9cad0dfddb: hgweb: when unpacking args from request form, convert to bytes
Summary

We assume http-originated values are ASCII, which should be safe based
on the RFC.

Diff Detail

Repository
rHG Mercurial
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

durin42 created this revision.Oct 16 2017, 9:51 AM
yuja accepted this revision.Oct 16 2017, 11:01 AM
This revision is now accepted and ready to land.Oct 16 2017, 11:01 AM
Closed by commit rHG5a9cad0dfddb: hgweb: when unpacking args from request form, convert to bytes (authored by durin42). · Explain WhyOct 16 2017, 11:10 AM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathPackages
Mmercurial/hgweb/protocol.py (4 lines)

Diff 2818

mercurial/hgweb/protocol.py

import struct import struct
from .common import ( from .common import (
HTTP_OK, HTTP_OK,
) )
from .. import ( from .. import (
error, error,
pycompat,
util, util,
wireproto, wireproto,
) )
stringio = util.stringio stringio = util.stringio
urlerr = util.urlerr urlerr = util.urlerr
urlreq = util.urlreq urlreq = util.urlreq
if key != 'cmd' and key not in keys: if key != 'cmd' and key not in keys:
star[key] = knownargs[key][0] star[key] = knownargs[key][0]
data['*'] = star data['*'] = star
else: else:
data[k] = knownargs[k][0] data[k] = knownargs[k][0]
return [data[k] for k in keys] return [data[k] for k in keys]
def _args(self): def _args(self):
args = self.req.form.copy() args = self.req.form.copy()
if pycompat.ispy3:
args = {k.encode('ascii'): [v.encode('ascii') for v in vs]
for k, vs in args.items()}
postlen = int(self.req.env.get('HTTP_X_HGARGS_POST', 0)) postlen = int(self.req.env.get('HTTP_X_HGARGS_POST', 0))
if postlen: if postlen:
args.update(cgi.parse_qs( args.update(cgi.parse_qs(
self.req.read(postlen), keep_blank_values=True)) self.req.read(postlen), keep_blank_values=True))
return args return args
argvalue = decodevaluefromheaders(self.req, 'X-HgArg') argvalue = decodevaluefromheaders(self.req, 'X-HgArg')
args.update(cgi.parse_qs(argvalue, keep_blank_values=True)) args.update(cgi.parse_qs(argvalue, keep_blank_values=True))