Question

I found a bug on web.py utils.safeunicode function. the version is 0.36

>>> import web
>>> app=web.application(('/hello','hello'),locals())
>>> class hello:
...   def GET(self):
...       return 'hello world'

#it's the normal request
>>> app.request('/hello').data
'hello world'

#the Error request
>>> app.request('hello\xbf').data
...
UnicodeDecodeError: 'utf8' codec can't decode byte 0xbf in position 6: unexpected code byte

I tried on some web.py website like ‘http://web.site/index%bf’, and all of them response status 500 or Exceptions. so is that a bug or vulnability?

I fixed the utils.py line 342

elif t is str:
    ooxxxxoo=obj.decode(encoding,'ignore')
    return ooxxxxoo

then it going okay. but is there really safe?

Answer 1

I’ve opened this issue in github repository and it seems to be already fixed. Maybe you should update to 0.37?