Fix Issue9272 - Change CGIHTTPServer to give the child program a copy of os.environ

Lib/http/server.py

@@ -99,6 +99,7 @@ import socketserver
 import sys
 import time
 import urllib.parse
+import copy
 
 # Default error message template
 DEFAULT_ERROR_MESSAGE = """\
@@ -994,7 +995,7 @@ class CGIHTTPRequestHandler(SimpleHTTPRequestHandler):
 
         # Reference: http://hoohoo.ncsa.uiuc.edu/cgi/env.html
         # XXX Much of the following could be prepared ahead of time!
-        env = {}
+        env = copy.deepcopy(os.environ)
         env['SERVER_SOFTWARE'] = self.version_string()
         env['SERVER_NAME'] = self.server.server_name
         env['GATEWAY_INTERFACE'] = 'CGI/1.1'
@@ -1059,7 +1060,6 @@ class CGIHTTPRequestHandler(SimpleHTTPRequestHandler):
         for k in ('QUERY_STRING', 'REMOTE_HOST', 'CONTENT_LENGTH',
                   'HTTP_USER_AGENT', 'HTTP_COOKIE', 'HTTP_REFERER'):
             env.setdefault(k, "")
-        os.environ.update(env)
 
         self.send_response(200, "Script output follows")
 
@@ -1091,7 +1091,7 @@ class CGIHTTPRequestHandler(SimpleHTTPRequestHandler):
                     pass
                 os.dup2(self.rfile.fileno(), 0)
                 os.dup2(self.wfile.fileno(), 1)
-                os.execve(scriptfile, args, os.environ)
+                os.execve(scriptfile, args, env)
             except:
                 self.server.handle_error(self.request, self.client_address)
                 os._exit(127)
@@ -1116,7 +1116,8 @@ class CGIHTTPRequestHandler(SimpleHTTPRequestHandler):
             p = subprocess.Popen(cmdline,
                                  stdin=subprocess.PIPE,
                                  stdout=subprocess.PIPE,
-                                 stderr=subprocess.PIPE
+                                 stderr=subprocess.PIPE,
+                                 env = env
                                  )
             if self.command.lower() == "post" and nbytes > 0:
                 data = self.rfile.read(nbytes)

Lib/test/test_httpservers.py

@@ -402,6 +402,14 @@ class CGIHTTPServerTestCase(BaseTestCase):
         self.assertEqual((b'Hello World\n', 'text/html', 200),
              (res.read(), res.getheader('Content-type'), res.status))
 
+    def test_os_environ_is_not_altered(self):
+        signature = "Test CGI Server"
+        os.environ['SERVER_SOFTWARE'] = signature
+        res = self.request('/cgi-bin/file1.py')
+        self.assertEqual((b'Hello World\n', 'text/html', 200),
+                (res.read(), res.getheader('Content-type'), res.status))
+        self.assertEqual(os.environ['SERVER_SOFTWARE'], signature)
+
 
 class SocketlessRequestHandler(SimpleHTTPRequestHandler):
     def __init__(self):