8000 bpo-30458: Disallow control chars in http URLs. by gpshead · Pull Request #12755 · python/cpython · GitHub
[go: up one dir, main page]
Skip to content

bpo-30458: Disallow control chars in http URLs. #12755

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 13 commits into from
May 1, 2019
Merged

bpo-30458: Disallow control chars in http URLs. #12755

Changes from 1 commit
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
97bcc4b
bpo-14826 bpo-36276: Disallow control chars in http URLs.
gpshead Apr 10, 2019
bba966c
Move validation to _splittype & correct boundary.
gpshead Apr 10, 2019
bde613c
Move the check to http.client where it belongs.
gpshead Apr 10, 2019
448a541
don't bother checking for chars above ascii.
gpshead Apr 10, 2019
944c5fa
missing f on f-string
gpshead Apr 10, 2019
f039a80
confirm that repr of the url is in the ValueError.
gpshead Apr 10, 2019
6686d66
also assert no ' ' in the quoted url
gpshead Apr 10, 2019
a754bd7
📜🤖 Added by blurb_it.
blurb-it[bot] Apr 10, 2019
95039e6
Don't abuse http.client in text_xmlrpc.
gpshead Apr 10, 2019
5589519
fix misplaced f-str
gpshead Apr 10, 2019
54f7fca
Address code review comments.
gpshead Apr 30, 2019
73db8e1
fix indentation
gpshead Apr 30, 2019
aeb2be8
Expand the tests to cover every char.
gpshead Apr 30, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
📜🤖 Added by blurb_it.
  • Loading branch information
@blurb-it
blurb-it[bot] committed Apr 10, 2019
commit a754bd7a56295e30bc8d34448b88b4f0f5ce5964
1 change: 1 addition & 0 deletions Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-36276.51E-DA.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Address CVE-2019-9740 by disallowing URL paths with embedded whitespace or control characters through into the underlying http client request. Such potentially malicious header injection URLs now cause a ValueError to be raised.
0