From: Senthil Kumaran <senthil@python.org>
Date: Mon, 28 Jun 2021 10:05:21 +0000 (-0700)
Subject: [3.8] bpo-43882 - Mention urllib.parse changes in Whats new section. (#26277)
X-Git-Tag: v3.8.11~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=634da2de88af06eb8c6ebdb90d8c00005847063d;p=thirdparty%2FPython%2Fcpython.git

[3.8] bpo-43882 - Mention urllib.parse changes in Whats new section. (#26277)
---

diff --git a/Doc/whatsnew/3.8.rst b/Doc/whatsnew/3.8.rst
index 6c30ac183b67..109a06e92efb 100644
--- a/Doc/whatsnew/3.8.rst
+++ b/Doc/whatsnew/3.8.rst
@@ -2294,4 +2294,16 @@ for and build on the oldest version in the range.
 with fixes by FX Coudert and Eli Rykoff, and backported to 3.8 by Maxime Bélanger
 and Ned Deily)
 
+Notable changes in Python 3.8.10
+================================
+
+urllib.parse
+------------
+
+The presence of newline or tab characters in parts of a URL allows for some
+forms of attacks. Following the WHATWG specification that updates :rfc:`3986`,
+ASCII newline ``\n``, ``\r`` and tab ``\t`` characters are stripped from the
+URL by the parser in :mod:`urllib.parse` preventing such attacks. The removal
+characters are controlled by a new module level variable
+``urllib.parse._UNSAFE_URL_BYTES_TO_REMOVE``. (See :issue:`43882`)