Skip to content
Snippets Groups Projects
Unverified Commit 80aaeabb authored by Sam Ezeh's avatar Sam Ezeh Committed by GitHub
Browse files

gh-81054: Document that SimpleHTTPRequestHandler follows symbolic links (GH-94416)

parent ad55147c
Branches
Tags
No related merge requests found
......@@ -20,7 +20,7 @@ This module defines classes for implementing HTTP servers.
.. warning::
:mod:`http.server` is not recommended for production. It only implements
basic security checks.
:ref:`basic security checks <http.server-security>`.
One class, :class:`HTTPServer`, is a :class:`socketserver.TCPServer` subclass.
It creates and listens at the HTTP socket, dispatching the requests to a
......@@ -499,3 +499,14 @@ following command runs an HTTP/1.1 conformant server::
the ``--cgi`` option::
python -m http.server --cgi
.. _http.server-security:
Security Considerations
-----------------------
.. index:: pair: http.server; security
:class:`SimpleHTTPRequestHandler` will follow symbolic links when handling
requests, this makes it possible for files outside of the specified directory
to be served.
......@@ -14,7 +14,7 @@ The following modules have specific security considerations:
argument disabling known insecure and blocked algorithms
<hashlib-usedforsecurity>`
* :mod:`http.server` is not suitable for production use, only implementing
basic security checks
basic security checks. See the :ref:`security considerations <http.server-security>`.
* :mod:`logging`: :ref:`Logging configuration uses eval()
<logging-eval-security>`
* :mod:`multiprocessing`: :ref:`Connection.recv() uses pickle
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment