]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
gh-102153: Start stripping C0 control and space chars in `urlsplit` (#102508)
authorIllia Volochii <illia.volochii@gmail.com>
Wed, 17 May 2023 08:49:20 +0000 (11:49 +0300)
committerGitHub <noreply@github.com>
Wed, 17 May 2023 08:49:20 +0000 (01:49 -0700)
commit2f630e1ce18ad2e07428296532a68b11dc66ad10
tree9304975238c9ef66124cbb4a43f8b7f006ffd3fe
parentb58bc8c2a9a316891a5ea1a0487aebfc86c2793a
gh-102153: Start stripping C0 control and space chars in `urlsplit` (#102508)

`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit #25595.

This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/#url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).

---------

Co-authored-by: Gregory P. Smith [Google] <greg@krypto.org>
Doc/library/urllib.parse.rst
Lib/test/test_urlparse.py
Lib/urllib/parse.py
Misc/NEWS.d/next/Security/2023-03-07-20-59-17.gh-issue-102153.14CLSZ.rst [new file with mode: 0644]