From: Alex Gaynor <alex.gaynor@gmail.com>
Date: Fri, 15 Nov 2024 23:09:05 +0000 (-0500)
Subject: Added a warning to the urljoin docs, indicating that it is not safe to use with attac... 
X-Git-Tag: v3.14.0a2~28
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d6bcc154e93a0a20ab97187d3e8b726fffb14f8f;p=thirdparty%2FPython%2Fcpython.git

Added a warning to the urljoin docs, indicating that it is not safe to use with attacker controlled URLs (GH-126659)

This was flagged to me at a party today by someone who works in red-teaming as a frequently encountered footgun. Documenting the potentially unexpected behavior seemed like a good place to start.
---

diff --git a/Doc/library/urllib.parse.rst b/Doc/library/urllib.parse.rst
index 0501dc8733b2..44a9c79cba22 100644
--- a/Doc/library/urllib.parse.rst
+++ b/Doc/library/urllib.parse.rst
@@ -407,6 +407,15 @@ or on combining URL components into a URL string.
       If you do not want that behavior, preprocess the *url* with :func:`urlsplit` and
       :func:`urlunsplit`, removing possible *scheme* and *netloc* parts.
 
+   .. warning::
+
+      Because an absolute URL may be passed as the ``url`` parameter, it is
+      generally **not secure** to use ``urljoin`` with an attacker-controlled
+      ``url``. For example in,
+      ``urljoin("https://website.com/users/", username)``, if ``username`` can
+      contain an absolute URL, the result of ``urljoin`` will be the absolute
+      URL.
+
 
    .. versionchanged:: 3.5