Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[3.9] gh-102153: Start stripping C0 control and space chars in urlsplit (GH-102508) (GH-104575) (GH-104592) #104593

Merged
merged 2 commits into from
May 22, 2023
Merged

[3.9] gh-102153: Start stripping C0 control and space chars in urlsplit (GH-102508) (GH-104575) (GH-104592) #104593

merged 2 commits into from
May 22, 2023

Commits on May 17, 2023

  1. [3.10] [3.11] pythongh-102153: Start stripping C0 control and space c… 

    …hars in `urlsplit` (pythonGH-102508) (pythonGH-104575) (pythonGH-104592)

pythongh-102153: Start stripping C0 control and space chars in `urlsplit` (pythonGH-102508)

`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit pythonGH-25595.

This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).

I simplified the docs by eliding the state of the world explanatory
paragraph in this security release only backport.  (people will see
that in the mainline /3/ docs)

---------

(cherry picked from commit 2f630e1)
(cherry picked from commit 610cc0a)

(cherry picked from commit f48a96a)

Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
Co-authored-by: Gregory P. Smith [Google] <greg@krypto.org>
    @miss-islington @illia-v @gpshead
    3 people committed May 17, 2023
    Configuration menu
    Copy the full SHA
    87819d8 View commit details
    Browse the repository at this point in the history

Commits on May 19, 2023

  1. versionchanged:: 3.9.17

    @gpshead
    gpshead committed May 19, 2023
    Configuration menu
    Copy the full SHA
    3a6b6f9 View commit details
    Browse the repository at this point in the history