Re: [PyCS-devel] bug in medusa that creates problems for both pycs and pyds (functionality bug, not security bug!)

[Georg B. <gb...@mu...>]

Hi!

> I take it that the offending bit is:
>
>             # unquote path if necessary (thanks to Skip Montanaro for
> pointing
>             # out that we must unquote in piecemeal fashion).
>             if '%' in uri:
>                 uri = unquote (uri)

Yep, that's the bugger.

> IMHO this should become:
>
>             if '%' in uri:
>                 path, qs = urllib.splitquery(uri)
>                 url = unquote(path) + qs

Hmm. It's in line 469ff - there is actually "request" in the code, nur
"uri" - are you using an older/newer version than 0.5.3?

path, qs = urllib.splitquery(request)
if '%' in path:
   request = unquote(path) + qs

So we don't unquote if there is only quoting in the query? This should fix
the problem, I think. If Id idn't overlook some problem, that is ...

bye, Georg