Fix test URLs containing whitespaces #2025
Conversation
They triggered CVE-2019-9740 checks added in python here [0]. The problematic test should fail because of invalid source address but it failed earlier because of invalid request URL. Request URLs contained string representation of the tested source address which can contain whitespaces. E.g. "/source_address?(\'192.0.2.255\', 0)" The source addresses seem to be there only for information and were added as part of [1]. Removing them from the request URL makes the tests pass again. [0] python/cpython#12755 [1] urllib3#703
Codecov Report
@@ Coverage Diff @@
## master #2025 +/- ##
===========================================
+ Coverage 99.95% 100.00% +0.04%
===========================================
Files 25 25
Lines 2294 2294
===========================================
+ Hits 2293 2294 +1
+ Misses 1 0 -1
Continue to review full report at Codecov.
|
|
Without this PR our test suite appears to be passing, are you also seeing this or am I misunderstanding something? |
|
It depends on the python version you have on your CIs. If it doesn't have the CVE-2019-9740 fix included, it will pass without problems. |
|
We percent-encode whitespace before passing to We have the latest |
|
OK. Maybe this is not a proper fix for master then. |
|
Looks like v1.24.3 (and 1.25.x):
|
|
@sethmlarson the linked PR is just throwing exception if invalid URL is passed. These changes are included in the packages I'm working with. Do you remember when the percent-encoding of whitespace was added in urllib3? |
|
OK, I think I've found it: #1673 |
|
@skazi0 Very true, we can remove that note. |
They triggered CVE-2019-9740 checks added in python here [0].
The problematic test should fail because of invalid source address but it
failed earlier because of invalid request URL. Request URLs contained string
representation of the tested source address which can contain whitespaces.
E.g. "/source_address?('192.0.2.255', 0)"
The source addresses seem to be there only for information and were added as
part of [1]. Removing them from the request URL makes the tests pass again.
[0] python/cpython#12755
[1] #703