gh-104049: do not expose on-disk location used by SimpleHTTPServer

[ethanfurman]

• Issue: python 3.11 http.server internal path disclosure #104049

[gpshead]

this fixes the fundamental problem, the local path should never have been exposed. I'm not sure taking the arbitrary binary data from the http request and allowing that to be rendered in the html's codec makes sense (high mojibake potential), but that doesn't feel important here.

using an error handler other than surrogatepass that elides or escapes values might also make sense.

[miss-islington]

Thanks @ethanfurman for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.7, 3.8, 3.9, 3.10, 3.11.
🐍🍒⛏🤖

[miss-islington]

Sorry @ethanfurman and @gpshead, I had trouble checking out the 3.11 backport branch.
Please retry by removing and re-adding the "needs backport to 3.11" label.
Alternatively, you can backport using cherry_picker on the command line.
cherry_picker c7c3a60c88de61a79ded9fdaf6bc6a29da4efb9a 3.11

[bedevere-bot]

GH-104119 is a backport of this pull request to the 3.10 branch.

[bedevere-bot]

GH-104120 is a backport of this pull request to the 3.9 branch.

[bedevere-bot]

GH-104121 is a backport of this pull request to the 3.8 branch.

[bedevere-bot]

GH-104122 is a backport of this pull request to the 3.7 branch.

[miss-islington]

Thanks @ethanfurman for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

[bedevere-bot]

GH-104123 is a backport of this pull request to the 3.11 branch.

[lazka]

The invalid escape sequence used in the tests makes some tests fail here.. I wonder why only I see it:

test test___all__ failed -- Traceback (most recent call last):
  File "C:\msys64\home\user\git\cpython-mingw\Lib\test\test___all__.py", line 111, in test_all
    self.check_all(modname)
  File "C:\msys64\home\user\git\cpython-mingw\Lib\test\test___all__.py", line 26, in check_all
    with warnings_helper.check_warnings(
  File "C:\msys64\home\user\git\cpython-mingw\Lib\contextlib.py", line 142, in __exit__
    next(self.gen)
  File "C:\msys64\home\user\git\cpython-mingw\Lib\test\support\warnings_helper.py", line 177, in _filterwarnings
    raise AssertionError("unhandled warning %s" % reraise[0])
AssertionError: unhandled warning {message : DeprecationWarning("invalid escape sequence '\\?'"), category : 'DeprecationWarning', filename : 'C:\\msys64\\home\\user\\git\\cpython-mingw\\Lib\\test\\test_httpservers.py', lineno : 423, line : None}