From: Senthil Kumaran Date: Thu, 20 May 2021 20:15:01 +0000 (-0700) Subject: [3.7] bpo-43882 - Mention urllib.parse changes in Whats New section for 3.7.11 (GH... X-Git-Tag: v3.7.11~2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c723d5191110f99849f7b0944820f6c3cd5f7747;p=thirdparty%2FPython%2Fcpython.git [3.7] bpo-43882 - Mention urllib.parse changes in Whats New section for 3.7.11 (GH-26267) Co-authored-by: Gregory P. Smith --- diff --git a/Doc/whatsnew/3.7.rst b/Doc/whatsnew/3.7.rst index 85f924b2e41f..2cc380bf5aa6 100644 --- a/Doc/whatsnew/3.7.rst +++ b/Doc/whatsnew/3.7.rst @@ -2594,3 +2594,13 @@ IPv4 address sent from the remote server when setting up a passive data channel. We reuse the ftp server IP address instead. For unusual code requiring the old behavior, set a ``trust_server_pasv_ipv4_address`` attribute on your FTP instance to ``True``. (See :issue:`43285`) + + +The presence of newline or tab characters in parts of a URL allows for some +forms of attacks. Following the WHATWG specification that updates RFC 3986, +ASCII newline ``\n``, ``\r`` and tab ``\t`` characters are stripped from the +URL by the parser :func:`urllib.parse` preventing such attacks. The removal +characters are controlled by a new module level variable +``urllib.parse._UNSAFE_URL_BYTES_TO_REMOVE``. (See :issue:`43882`) + +