Skip to content

gh-102153: Start stripping C0 control and space chars in urlsplit #102508

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 12 commits into from
May 17, 2023
Merged

gh-102153: Start stripping C0 control and space chars in urlsplit #102508

Changes from 1 commit
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
5e67815
gh-102153: Start stripping C0 control and space chars in `urlsplit`
illia-v Mar 7, 2023
84231ba
Add a period
illia-v Mar 7, 2023
716e1c2
Simplify code
illia-v Mar 8, 2023
d81766d
Merge remote-tracking branch 'python/main' into gh-102153
illia-v Mar 8, 2023
a13bf41
Expand the constant instead of computing it at import time.
gpshead Apr 27, 2023
c863a81
Only lstrip the URL to avoid breaking applications.
gpshead May 2, 2023
fd3e429
Fix the unittests to allow trailing C0
gpshead May 2, 2023
456d238
remove a duplicate word
gpshead May 3, 2023
0f7f9ea
Update 2023-03-07-20-59-17.gh-issue-102153.14CLSZ.rst
gpshead May 3, 2023
a510652
Add urlparse and urlsplit security warnings.
gpshead May 17, 2023
766a7d3
doc formatting and wording tweaks.
gpshead May 17, 2023
fc6aaaf
Merge branch 'main' into gh-102153
gpshead May 17, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Update 2023-03-07-20-59-17.gh-issue-102153.14CLSZ.rst 
remove "trailing"
  • Loading branch information
@gpshead
gpshead authored May 3, 2023
commit 0f7f9ea830064d3d2e96680ce63eeb503acfd1ad
6 changes: 3 additions & 3 deletions Misc/NEWS.d/next/Security/2023-03-07-20-59-17.gh-issue-102153.14CLSZ.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
:func:`urllib.parse.urlsplit` now strips leading and trailing C0 control and
space characters following the controlling specification for URLs defined by
WHATWG in response to CVE-2023-24329. Patch by Illia Volochii.
:func:`urllib.parse.urlsplit` now strips leading C0 control and space
characters following the specification for URLs defined by WHATWG in
response to CVE-2023-24329. Patch by Illia Volochii.