8000 bpo-35028: cgi: Fix max_num_fields off by one error (GH-9973) · python/cpython@178bf58 · GitHub
[go: up one dir, main page]

Skip to content
8000

Commit 178bf58

Browse files
bpo-35028: cgi: Fix max_num_fields off by one error (GH-9973)
https://bugs.python.org/issue35028 (cherry picked from commit b79b5c0) Co-authored-by: matthewbelisle-wf <matthew.belisle@workiva.com>
1 parent d730719 commit 178bf58

File tree

2 files changed

+24
-18
lines changed

2 files changed

+24
-18
lines changed

Lib/cgi.py

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -635,6 +635,11 @@ def read_multi(self, environ, keep_blank_values, strict_parsing):
635635
first_line = self.fp.readline()
636636
self.bytes_read += len(first_line)
637637

638+
# Propagate max_num_fields into the sub class appropriately
639+
max_num_fields = self.max_num_fields
640+
if max_num_fields is not None:
641+
max_num_fields -= len(self.list)
642+
638643
while True:
639644
parser = FeedParser()
640645
hdr_text = b""
@@ -654,23 +659,19 @@ def read_multi(self, environ, keep_blank_values, strict_parsing):
654659
if 'content-length' in headers:
655660
del headers['content-length']
656661

657-
# Propagate max_num_fields into the sub class appropriately
658-
sub_max_num_fields = self.max_num_fields
659-
if sub_max_num_fields is not None:
660-
sub_max_num_fields -= len(self.list)
661-
662662
part = klass(self.fp, headers, ib, environ, keep_blank_values,
663663
strict_parsing,self.limit-self.bytes_read,
664-
self.encoding, self.errors, sub_max_num_fields)
664+
self.encoding, self.errors, max_num_fields)
665665

666-
max_num_fields = self.max_num_fields
667-
if max_num_fields is not None and part.list:
668-
max_num_fields -= len(part.list)
666+
if max_num_fields is not None:
667+
max_num_fields -= 1
668+
if part.list:
669+
max_num_fields -= len(part.list)
670+
if max_num_fields < 0:
671+
raise ValueError('Max number of fields exceeded')
669672

670673
self.bytes_read += part.bytes_read
671674
self.list.append(part)
672-
if max_num_fields is not None and max_num_fields < len(self.list):
673-
raise ValueError('Max number of fields exceeded')
674675
if part.done or self.bytes_read >= self.length > 0:
675676
break
676677
self.skip_lines()

Lib/test/test_cgi.py

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -411,33 +411,38 @@ def test_max_num_fields(self):
411411
data = """---123
412412
Content-Disposition: form-data; name="a"
413413
414-
a
414+
3
415415
---123
416416
Content-Type: application/x-www-form-urlencoded
417417
418-
a=a&a=a
418+
a=4
419+
---123
420+
Content-Type: application/x-www-form-urlencoded
421+
422+
a=5
419423
---123--
420424
"""
421425
environ = {
422426
'CONTENT_LENGTH': str(len(data)),
423427
'CONTENT_TYPE': 'multipart/form-data; boundary=-123',
424-
'QUERY_STRING': 'a=a&a=a',
428+
'QUERY_STRING': 'a=1&a=2',
425429
'REQUEST_METHOD': 'POST',
426430
}
427431

428432
# 2 GET entities
429-
# 2 top level POST entities
430-
# 2 entities within the second POST entity
433+
# 1 top level POST entities
434+
# 1 entity within the second POST entity
435+
# 1 entity within the third POST entity
431436
with self.assertRaises(ValueError):
432437
cgi.FieldStorage(
433438
fp=BytesIO(data.encode()),
434439
environ=environ,
435-
max_num_fields=5,
440+
max_num_fields=4,
436441
)
437442
cgi.FieldStorage(
438443
fp=BytesIO(data.encode()),
439444
environ=environ,
440-
max_num_fields=6,
445+
max_num_fields=5,
441446
)
442447

443448
def testQSAndFormData(self):

0 commit comments

Comments
 (0)
0