From 224cd0c3bf2e24f7731fb0b6f31b3839641307d7 Mon Sep 17 00:00:00 2001
From: "Miss Islington (bot)"
<31488909+miss-islington@users.noreply.github.com>
Date: Fri, 1 Jul 2022 09:41:54 -0700
Subject: [PATCH] gh-81054: Document that SimpleHTTPRequestHandler follows
symbolic links (GH-94416) (GH-94494)
(cherry picked from commit 80aaeabb8bd1e6b49598a7e23e0f8d99b3fcecaf)
Co-authored-by: Sam Ezeh <sam.z.ezeh@gmail.com>
---
Doc/library/http.server.rst | 13 ++++++++++++-
Doc/library/security_warnings.rst | 2 +-
2 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/Doc/library/http.server.rst b/Doc/library/http.server.rst
index dea79108d34..4aa10e26f61 100644
--- a/Doc/library/http.server.rst
+++ b/Doc/library/http.server.rst
@@ -20,7 +20,7 @@ This module defines classes for implementing HTTP servers (Web servers).
.. warning::
:mod:`http.server` is not recommended for production. It only implements
- basic security checks.
+ :ref:`basic security checks <http.server-security>`.
One class, :class:`HTTPServer`, is a :class:`socketserver.TCPServer` subclass.
It creates and listens at the HTTP socket, dispatching the requests to a
@@ -488,3 +488,14 @@ the following command uses a specific directory::
the ``--cgi`` option::
python -m http.server --cgi
+
+.. _http.server-security:
+
+Security Considerations
+-----------------------
+
+.. index:: pair: http.server; security
+
+:class:`SimpleHTTPRequestHandler` will follow symbolic links when handling
+requests, this makes it possible for files outside of the specified directory
+to be served.
diff --git a/Doc/library/security_warnings.rst b/Doc/library/security_warnings.rst
index 61fd4e6e487..8432248d639 100644
--- a/Doc/library/security_warnings.rst
+++ b/Doc/library/security_warnings.rst
@@ -12,7 +12,7 @@ The following modules have specific security considerations:
argument disabling known insecure and blocked algorithms
<hashlib-usedforsecurity>`
* :mod:`http.server` is not suitable for production use, only implementing
- basic security checks
+ basic security checks. See the :ref:`security considerations <http.server-security>`.
* :mod:`logging`: :ref:`Logging configuration uses eval()
<logging-eval-security>`
* :mod:`multiprocessing`: :ref:`Connection.recv() uses pickle
--
GitLab