ioflo / hio

Apache License 2.0
9 stars 10 forks source link

adds quote of path to adhere to PEP3333 #38

Closed m00sey closed 4 months ago

m00sey commented 4 months ago

There is a potential for requests using UTF-8 characters within the request path to cause a crash with WSGI.

    # PEP 3333 specifies that the PATH_INFO variable is always
    # "bytes tunneled as latin-1" and must be encoded back.
    #
    # NOTE(kgriffs): The decoded path may contain UTF-8 characters.
    # But according to the WSGI spec, no strings can contain chars
    # outside ISO-8859-1. Therefore, to reconcile the URI
    # encoding standard that allows UTF-8 with the WSGI spec
    # that does not, WSGI servers tunnel the string via
    # ISO-8859-1, e.g.:
    #
    #   tunnelled_path = path.encode('utf-8').decode('iso-8859-1')

    # perf(vytas): Only decode the tunnelled path in case it is not ASCII.
    #   For ASCII-strings, the below decoding chain is a no-op.
    # If not isascii(path):
        path = path.encode('iso-8859-1').decode('utf-8', 'replace')

Is the relevant PEP, thanks @pfeairheller

SmithSamuelM commented 4 months ago

@m00sey See https://github.com/ioflo/hio/pull/39 created new version of hio on pypi and tag v0.6.14 with fix