]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
[3.7] gh-102153: Start stripping C0 control and space chars in `urlsplit` (GH-104896)
authorstratakis <cstratak@redhat.com>
Mon, 5 Jun 2023 04:02:03 +0000 (06:02 +0200)
committerGitHub <noreply@github.com>
Mon, 5 Jun 2023 04:02:03 +0000 (00:02 -0400)
commitd28bafa2d3e424b6fdcfd7ae7cde8e71d7177369
treee7823e2c138d323dc6c868654adc075370c2aeb7
parentde108bc72145decb7c74be5bf44e98b60725efd0
[3.7] gh-102153: Start stripping C0 control and space chars in `urlsplit` (GH-104896)

`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit GH-25595.

This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).

(cherry picked from commit d7f8a5fe07b0ff3a419ccec434cc405b21a5a304)
(cherry picked from commit 2f630e1ce18ad2e07428296532a68b11dc66ad10)
(cherry picked from commit 610cc0ab1b760b2abaac92bd256b96191c46b941)
(cherry picked from commit f48a96a28012d28ae37a2f4587a780a5eb779946)

Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
Co-authored-by: Gregory P. Smith [Google] <greg@krypto.org>
Doc/library/urllib.parse.rst
Lib/test/test_urlparse.py
Lib/urllib/parse.py
Misc/NEWS.d/next/Security/2023-03-07-20-59-17.gh-issue-102153.14CLSZ.rst [new file with mode: 0644]