8000 bpo-30458: Disallow control chars in http URLs. by gpshead · Pull Request #12755 · python/cpython · GitHub
[go: up one dir, main page]
Skip to content

bpo-30458: Disallow control chars in http URLs. #12755

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 13 commits into from
May 1, 2019
Merged

bpo-30458: Disallow control chars in http URLs. #12755

Changes from 1 commit
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
97bcc4b
bpo-14826 bpo-36276: Disallow control chars in http URLs.
gpshead Apr 10, 2019
bba966c
Move validation to _splittype & correct boundary.
gpshead Apr 10, 2019
bde613c
Move the check to http.client where it belongs.
gpshead Apr 10, 2019
448a541
don't bother checking for chars above ascii.
gpshead Apr 10, 2019
944c5fa
missing f on f-string
gpshead Apr 10, 2019
f039a80
confirm that repr of the url is in the ValueError.
gpshead Apr 10, 2019
6686d66
also assert no ' ' in the quoted url
gpshead Apr 10, 2019
a754bd7
📜🤖 Added by blurb_it.
blurb-it[bot] Apr 10, 2019
95039e6
Don't abuse http.client in text_xmlrpc.
gpshead Apr 10, 2019
5589519
fix misplaced f-str
gpshead Apr 10, 2019
54f7fca
Address code review comments.
gpshead Apr 30, 2019
73db8e1
fix indentation
gpshead Apr 30, 2019
aeb2be8
Expand the tests to cover every char.
gpshead Apr 30, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
bpo-14826 bpo-36276: Disallow control chars in http URLs. 
Example possible fix for those issues.
  • Loading branch information
@gpshead
gpshead committed Apr 10, 2019
commit 97bcc4bd5cf5c6dc1352d9b5e680db165c937fd1
8 changes: 8 additions & 0 deletions Lib/urllib/request.py 9700
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -350,6 +350,14 @@ def full_url(self):
def full_url(self, url):
# unwrap('<URL:type://host/path>') --> 'type://host/path'
self._full_url = _unwrap(url)
# Sanity check self._full_url to avoid control characters in HTTP.
# https://bugs.python.org/issue14826
# https://bugs.python.org/issue36276
# The same control characters check was adopted by Golang in:
# https://go-review.googlesource.com/c/go/+/159157
if (self._full_url.startswith('http') and
re.search("[\x00- \x7f-\x9f]", self._full_url)):
raise ValueError("URL can't contain control characters. %r" % (self._full_url,))
self._full_url, self.fragment = _splittag(self._full_url)
self._parse()

Expand Down
0