Skip to content

gh-87389: avoid treating path as URI with netloc #93894

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nascheme wants to merge 19 commits into
base: main
Choose a base branch
from
Open

gh-87389: avoid treating path as URI with netloc #93894

Changes from 1 commit
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
4f76c44
wip: alternative fix for gh-87389
nascheme Jun 16, 2022
06b3879
Don't strip slashes if not building relative URL.
nascheme Jun 16, 2022
00a3a92
Add unit test for urlunsplit relative URL case.
nascheme Jun 16, 2022
a8e1cc2
sanitize paths that can be confused as scheme
nascheme Jun 16, 2022
83c8332
Add blurb.
nascheme Jun 16, 2022
f99e80b
Improve name and comment for _get_redirect_url().
nascheme Jun 16, 2022
e542578
Add urllib.parse.pathsplit() function.
nascheme Jun 16, 2022
b7b0b15
Fix blurb formating, add note about pathsplit().
nascheme Jun 16, 2022
6915331
Improve comments and docs.
nascheme Jun 16, 2022
915451c
Add basic unit test for pathsplit().
nascheme Jun 16, 2022
952a0f4
Fix markup in blurb.
nascheme Jun 16, 2022
899f512
Use pathsplit() in translate_path().
nascheme Jun 16, 2022
a00656c
Improved unit tests from gps.
nascheme Jun 16, 2022
8985853
Add test for Request-URI containing scheme.
nascheme Jun 16, 2022
f1f94ae
Make _get_redirect_url() into a method.
nascheme Jun 16, 2022
8a34cd0
Futher cleanups, remove urllib.parse.pathsplit().
nascheme Jun 16, 2022
23d4b56
reword news
gpshead Jul 3, 2022
7a71381
Merge branch 'main' into urlunsplit_relative
serhiy-storchaka May 14, 2024
d18bbd9
Merge branch 'main' into urlunsplit_relative
serhiy-storchaka May 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Fix blurb formating, add note about pathsplit().
  • Loading branch information
@nascheme
nascheme committed Jun 16, 2022
commit b7b0b15ce510151c0ee6d024d2654fbf7c303e33
12 changes: 2 additions & 10 deletions Misc/NEWS.d/next/Security/2022-06-16-12-13-55.gh-issue-87389.MS9wAR.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,14 +2,6 @@
when an URI path starts with ``//``. Vulnerability discovered, and initial
fix proposed, by Hamza Avvan. Change `urllib.parse.urlunsplit()` to
sanitize `path` argument in order to avoid confusing the first component of
the path as a net location or scheme.
the path as a net location or scheme. Add `urllib.parse.pathsplit()` function.

Co-authored-by: Gregory P. Smith <gps@google.com> #.. section: Core and
Builtins #.. section: Library #.. section: Documentation #.. section: Tests
#.. section: Build #.. section: Windows #.. section: macOS #.. section: IDLE
#.. section: Tools/Demos #.. section: C API

# Write your Misc/NEWS entry below. It should be a simple ReST paragraph. #
Don't start with "- Issue #<n>: " or "- gh-issue-<n>: " or that sort of
stuff.
###########################################################################
Co-authored-by: Gregory P. Smith <gps@google.com>
Comment thread
nascheme marked this conversation as resolved.
Outdated