Repository navigation
maximum length not enforced in cgi.parse() #42628
Description
| BPO | 1367631 |
|---|
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = None
closed_at = None
created_at = <Date 2005-11-27.17:47:58.000>
labels = ['type-bug', 'library']
title = 'maximum length not enforced in cgi.parse()'
updated_at = <Date 2014-02-03.19:54:39.486>
user = 'https://bugs.python.org/adr26'bugs.python.org fields:
activity = <Date 2014-02-03.19:54:39.486>
actor = 'BreamoreBoy'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2005-11-27.17:47:58.000>
creator = 'adr26'
dependencies = []
files = []
hgrepos = []
issue_num = 1367631
keywords = []
message_count = 3.0
messages = ['26928', '109880', '115231']
nosy_count = 1.0
nosy_names = ['adr26']
pr_nums = []
priority = 'normal'
resolution = 'wont fix'
stage = 'test needed'
status = 'languishing'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue1367631'
versions = ['Python 3.1', 'Python 2.7', 'Python 3.2']
Activity
adr26 commentedon Nov 27, 2005
I have a simple form in HTML to upload a file:
<form action="http://foo/cgi-bin/test.py"
enctype="multipart/form-data" method="post">
<p>
Please specify a file:<br>
<input type="file" name="file_1" size="40">
</p>
<p>
<input type="submit" value="Send">
</p>
</form>
I use this to post to a CGI python script that looks
like this:
print "Content-type: text/plain"
print
I was expecting that cgi.pm would then throw an
exception if I send a file > 50 bytes long to it. If
I construct a FieldStorage object, it certainly
does:
The issue is that in parse_multipart() in cgi.pm, if
a part of a multi-part message does not have the
Content-Length header, you read lines until you
get to the next boundary "--...", but don't honour
maxlen whilst doing so. I'd consider this to be a bug
and would even be happy to have a go at fixing
it as my first contribution to Python, should others
concur with me... :-)
BreamoreBoy commentedon Jul 10, 2010
Andrew could you please provide a patch.
BreamoreBoy commentedon Aug 30, 2010
No reply to msg109880.
hugovk commentedon Apr 11, 2022
Let's close this old issue, the cgi module is deprecated in 3.11 and set for removal in 3.13.
See PEP 594 – Removing dead batteries from the standard library, #91217 and #32410.
There's a fork at https://pypi.org/project/legacy-cgi/.
AlexWaygood commentedon Apr 12, 2022
Cc. @adr26