10000 gh-105704: Disallow square brackets (`[` and `]`) in domain names for… · miss-islington/cpython@67d5a96 · GitHub
[go: up one dir, main page]
Skip to content

Commit 67d5a96

Browse files
sethmlarsonZeroIntensity
authored and
miss-islington
committed
pythongh-105704: Disallow square brackets ([ and ]) in domain names for parsed URLs (pythonGH-129418)
* pythongh-105704: Disallow square brackets ( and ) in domain names for parsed URLs * Use Sphinx references Co-authored-by: Peter Bierma <zintensitydev@gmail.com> * Add mismatched bracket test cases, fix news format * Add more test coverage for ports --------- (cherry picked from commit d89a5f6) Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
1 parent 10a2a9b commit 67d5a96

File tree

3 files changed

+58
-3
lines changed

3 files changed

+58
-3
lines changed

‎Lib/test/test_urlparse.py

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1149,16 +1149,51 @@ def test_invalid_bracketed_hosts(self):
11491149
self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af::2309::fae7:1234]/Path?Query')
11501150
self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af:2309::fae7:1234:2342:438e:192.0.2.146]/Path?Query')
11511151
self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@]v6a.ip[/Path')
1152+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip]')
1153+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip].suffix')
1154+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip]/')
1155+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip].suffix/')
1156+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip]?')
1157+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip].suffix?')
1158+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]')
1159+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix')
1160+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]/')
1161+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix/')
1162+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]?')
1163+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix?')
1164+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:a')
1165+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:a')
1166+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:a1')
1167+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:a1')
1168+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:1a')
1169+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:1a')
1170+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:')
1171+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:/')
1172+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:?')
1173+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://user@prefix.[v6a.ip]')
1174+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://user@[v6a.ip].suffix')
1175+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip')
1176+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip]')
1177+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://]v6a.ip[')
1178+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://]v6a.ip')
1179+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip[')
1180+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip')
1181+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip].suffix')
1182+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix]v6a.ip[suffix')
1183+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix]v6a.ip')
1184+
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip[suffix')
11521185

11531186
def test_splitting_bracketed_hosts(self):
1154-
p1 = urllib.parse.urlsplit('scheme://user@[v6a.ip]/path?query')
1187+
p1 = urllib.parse.urlsplit('scheme://user@[v6a.ip]:1234/path?query')
11551188
self.assertEqual(p1.hostname, 'v6a.ip')
11561189
self.assertEqual(p1.username, 'user')
11571190
self.assertEqual(p1.path, '/path')
1191+
self.assertEqual(p1.port, 1234)
11581192
p2 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7%test]/path?query')
11591193
self.assertEqual(p2.hostname, '0439:23af:2309::fae7%test')
11601194
self.assertEqual(p2.username, 'user')
11611195
self.assertEqual(p2.path, '/path')
1196+
self.assertIs(p2.port, None)
11621197
p3 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7:1234:192.0.2.146%test]/path?query')
11631198
self.assertEqual(p3.hostname, '0439:23af:2309::fae7:1234:192.0.2.146%test')
11641199
self.assertEqual(p3.username, 'user')

‎Lib/urllib/parse.py

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -442,6 +442,23 @@ def _checknetloc(netloc):
442442
raise ValueError("netloc '" + netloc + "' contains invalid " +
443443
"characters under NFKC normalization")
444444

445+
def _check_bracketed_netloc(netloc):
446+
# Note that this function must mirror the splitting
447+
# done in NetlocResultMixins._hostinfo().
448+
hostname_and_port = netloc.rpartition('@')[2]
449+
before_bracket, have_open_br, bracketed = hostname_and_port.partition('[')
450+
if have_open_br:
451+
# No data is allowed before a bracket.
452+
if before_bracket:
453+
raise ValueError("Invalid IPv6 URL")
454+
hostname, _, port = bracketed.partition(']')
455+
# No data is allowed after the bracket but before the port delimiter.
456+
if port and not port.startswith(":"):
457+
raise ValueError("Invalid IPv6 URL")
458+
else:
459+
hostname, _, port = hostname_and_port.partition(':')
460+
_check_bracketed_host(hostname)
461+
445462
# Valid bracketed hosts are defined in
446463
# https://www.rfc-editor.org/rfc/rfc3986#page-49 and https://url.spec.whatwg.org/
447464
def _check_bracketed_host(hostname):
@@ -505,8 +522,7 @@ def urlsplit(url, scheme='', allow_fragments=True):
505522
(']' in netloc and '[' not in netloc)):
506523
raise ValueError("Invalid IPv6 URL")
507524
if '[' in netloc and ']' in netloc:
508-
bracketed_host = netloc.partition('[')[2].partition(']')[0]
509-
_check_bracketed_host(bracketed_host)
525+
_check_bracketed_netloc(netloc)
510526
if allow_fragments and '#' in url:
511527
url, fragment = url.split('#', 1)
512528
if '?' in url:

‎Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
When using :func:`urllib.parse.urlsplit` and :func:`urllib.parse.urlparse` host
2+
parsing would not reject domain names containing square brackets (``[`` and
3+
``]``). Square brackets are only valid for IPv6 and IPvFuture hosts according to
4+
`RFC 3986 Section 3.2.2 <https://www.rfc-editor.org/rfc/rfc3986#section-3.2.2>`__.

0 commit comments

Comments
 (0)
0