( )⚙ D1110 hgweb: when unpacking args from request form, convert to bytes

This is an archive of the discontinued Mercurial Phabricator instance.

Differential D1110

hgweb: when unpacking args from request form, convert to bytes
ClosedPublic

Authored by durin42 on Oct 16 2017, 9:51 AM.

Details

Reviewers
yuja
Group Reviewers
hg-reviewers
Commits
rHG5a9cad0dfddb: hgweb: when unpacking args from request form, convert to bytes
Summary

We assume http-originated values are ASCII, which should be safe based
on the RFC.

Diff Detail

Repository
rHG Mercurial
Lint
Lint Skipped
Unit
Unit Tests Skipped

Event Timeline

durin42 created this revision.Oct 16 2017, 9:51 AM
yuja accepted this revision.Oct 16 2017, 11:01 AM
This revision is now accepted and ready to land.Oct 16 2017, 11:01 AM
Closed by commit rHG5a9cad0dfddb: hgweb: when unpacking args from request form, convert to bytes (authored by durin42). · Explain WhyOct 16 2017, 11:10 AM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathPackages
Mmercurial/hgweb/protocol.py (4 lines)

Diff 2812

mercurial/hgweb/protocol.py

import struct import struct
from .common import ( from .common import (
HTTP_OK, HTTP_OK,
) )
from .. import ( from .. import (
error, error,
pycompat,
util, util,
wireproto, wireproto,
) )
stringio = util.stringio stringio = util.stringio
urlerr = util.urlerr urlerr = util.urlerr
urlreq = util.urlreq urlreq = util.urlreq
if key != 'cmd' and key not in keys: if key != 'cmd' and key not in keys:
star[key] = knownargs[key][0] star[key] = knownargs[key][0]
data['*'] = star data['*'] = star
else: else:
data[k] = knownargs[k][0] data[k] = knownargs[k][0]
return [data[k] for k in keys] return [data[k] for k in keys]
def _args(self): def _args(self):
args = self.req.form.copy() args = self.req.form.copy()
if pycompat.ispy3:
args = {k.encode('ascii'): [v.encode('ascii') for v in vs]
for k, vs in args.items()}
postlen = int(self.req.env.get('HTTP_X_HGARGS_POST', 0)) postlen = int(self.req.env.get('HTTP_X_HGARGS_POST', 0))
if postlen: if postlen:
args.update(cgi.parse_qs( args.update(cgi.parse_qs(
self.req.read(postlen), keep_blank_values=True)) self.req.read(postlen), keep_blank_values=True))
return args return args
argvalue = decodevaluefromheaders(self.req, 'X-HgArg') argvalue = decodevaluefromheaders(self.req, 'X-HgArg')
args.update(cgi.parse_qs(argvalue, keep_blank_values=True)) args.update(cgi.parse_qs(argvalue, keep_blank_values=True))