8000 [2.7] bpo-30458: Disallow control chars in http URLs. (GH-12755) (GH-13154) by vstinner · Pull Request #13315 · python/cpython · GitHub
[go: up one dir, main page]
Skip to content

[2.7] bpo-30458: Disallow control chars in http URLs. (GH-12755) (GH-13154) #13315

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
May 21, 2019
Merged

[2.7] bpo-30458: Disallow control chars in http URLs. (GH-12755) (GH-13154) #13315

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8af9afd
bpo-30458: Disallow control chars in http URLs. (GH-12755) (GH-13154)
hroncok May 7, 2019
9f8ae2a
Address Gregory's comments
vstinner May 20, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Address Gregory's comments
  • Loading branch information
@vstinner
vstinner committed May 20, 2019
commit 9f8ae2a2e4b836fe3136e84e55b8de62cb40904f
6 changes: 0 additions & 6 deletions Lib/test/test_urllib.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,6 @@
import sys
import mimetools
import tempfile
try:
import ssl
except ImportError:
ssl = None

from test import test_support
from base64 import b64encode
Expand Down Expand Up @@ -261,7 +257,6 @@ def test_url_fragment(self):
finally:
self.unfakehttp()

@unittest.skipUnless(ssl, "ssl module required")
def test_url_with_control_char_rejected(self):
for char_no in range(0, 0x21) + range(0x7f, 0x100):
char = chr(char_no)
Expand All @@ -274,7 +269,6 @@ def test_url_with_control_char_rejected(self):
finally:
self.unfakehttp()

@unittest.skipUnless(ssl, "ssl module required")
def test_url_with_newline_header_injection_rejected(self):
self.fakehttp(b"HTTP/1.1 200 OK\r\n\r\nHello.")
host = "localhost:7777?a=1 HTTP/1.1\r\nX-injected: header\r\nTEST: 123"
Expand Down
14 changes: 7 additions & 7 deletions Lib/test/test_urllib2.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
import unittest
from test import support
from test import test_support
from test import test_urllib

import os
Expand Down Expand Up @@ -686,7 +686,7 @@ def test_file(self):
h = urllib2.FileHandler()
o = h.parent = MockOpener()

TESTFN = support.TESTFN
TESTFN = test_support.TESTFN
urlpath = sanepathname2url(os.path.abspath(TESTFN))
towrite = "hello, world\n"
urls = [
Expand Down Expand Up @@ -1157,7 +1157,7 @@ def test_basic_auth_with_unquoted_realm(self):
opener.add_handler(auth_handler)
opener.add_handler(http_handler)
msg = "Basic Auth Realm was unquoted"
with support.check_warnings((msg, UserWarning)):
with test_support.check_warnings((msg, UserWarning)):
self._test_basic_auth(opener, auth_handler, "Authorization",
realm, http_handler, password_manager,
"http://acme.example.com/protected",
Expand Down Expand Up @@ -1350,7 +1350,7 @@ def test_url_with_newline_header_injection_rejected(self):
host = "localhost:7777?a=1 HTTP/1.1\r\nX-injected: header\r\nTEST: 123"
schemeless_url = "//" + host + ":8080/test/?test=a"
try:
# We explicitly test urllib.request.urlopen() instead of the top
# We explicitly test urllib2.urlopen() instead of the top
# level 'def urlopen()' function defined in this... (quite ugly)
# test suite. They use different url opening codepaths. Plain
# urlopen uses FancyURLOpener which goes via a codepath that
Expand Down Expand Up @@ -1461,14 +1461,14 @@ def test_HTTPError_interface_call(self):

def test_main(verbose=None):
from test import test_urllib2
support.run_doctest(test_urllib2, verbose)
support.run_doctest(urllib2, verbose)
test_support.run_doctest(test_urllib2, verbose)
test_support.run_doctest(urllib2, verbose)
tests = (TrivialTests,
OpenerDirectorTests,
HandlerTests,
MiscTests,
RequestTests)
support.run_unittest(*tests)
test_support.run_unittest(*tests)

if __name__ == "__main__":
test_main(verbose=True)
0