Apply fix for directory traversal vulnerability, ref.
http://bugs.python.org/issue21766
Bump PKGREVISION.


(he)

$NetBSD: patch-Lib_http_server.py,v 1.1 2014/07/04 11:37:13 he Exp $

Apply fix for directory traversal vulnerability, ref.
http://bugs.python.org/issue21766

--- Lib/http/server.py.orig	2014-05-19 05:19:38.000000000 +0000
+++ Lib/http/server.py
@@ -977,7 +977,7 @@ class CGIHTTPRequestHandler(SimpleHTTPRe
         (and the next character is a '/' or the end of the string).
 
         """
-        collapsed_path = _url_collapse_path(self.path)
+        collapsed_path = _url_collapse_path(urllib.parse.unquote(self.path))
         dir_sep = collapsed_path.find('/', 1)
         head, tail = collapsed_path[:dir_sep], collapsed_path[dir_sep+1:]
         if head in self.cgi_directories:

$NetBSD: patch-Lib_test_test__httpservers.py,v 1.1 2014/07/04 11:37:13 he Exp $

Add test case for directory traversal vulnerability fix, ref.
http://bugs.python.org/issue21766

--- Lib/test/test_httpservers.py.orig	2014-05-19 05:19:38.000000000 +0000
+++ Lib/test/test_httpservers.py
@@ -485,6 +485,11 @@ class CGIHTTPServerTestCase(BaseTestCase
                 (res.read(), res.getheader('Content-type'), res.status))
         self.assertEqual(os.environ['SERVER_SOFTWARE'], signature)
 
+    def test_urlquote_decoding_in_cgi_check(self):
+        res = self.request('/cgi-bin%2ffile1.py')
+        self.assertEqual((b'Hello World\n', 'text/html', 200),
+                (res.read(), res.getheader('Content-type'), res.status))
+
 
 class SocketlessRequestHandler(SimpleHTTPRequestHandler):
     def __init__(self):

$NetBSD: patch-Misc_NEWS,v 1.1 2014/07/04 11:37:13 he Exp $

Note we have fix for directory traversal vulnerability, ref.
http://bugs.python.org/issue21766

--- Misc/NEWS.orig	2014-05-19 05:19:39.000000000 +0000
+++ Misc/NEWS
@@ -93,6 +93,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #21766: Prevent a security hole in CGIHTTPServer by URL unquoting paths
+  before checking for a CGI script at that path.
+
 - Issue #21088: Bugfix for curses.window.addch() regression in 3.4.0.
   In porting to Argument Clinic, the first two arguments were reversed.