From 08a024b26c82d25b8af4de40415c5f7d30e332d3 Mon Sep 17 00:00:00 2001 From: SH Date: Sun, 24 Mar 2019 22:58:11 +0900 Subject: [PATCH 1/3] bpo-35906: Fix CRLF injection in urllib --- Lib/test/test_urlparse.py | 10 ++++++++++ Lib/urllib/parse.py | 2 +- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py index 0faf2bbb645924..0b44ba7bcd94ac 100644 --- a/Lib/test/test_urlparse.py +++ b/Lib/test/test_urlparse.py @@ -1059,6 +1059,16 @@ def test_splithost(self): self.assertEqual(splithost("//example.net/file#"), ('example.net', '/file#')) + # bpo-35906: disallow line breaks + self.assertEqual(splithost('//127.0.0.1:1234/?q=HTTP/1.1\r\nHeader: Value'), + (None, '//127.0.0.1:1234/?q=HTTP/1.1\r\nHeader: Value')) + + self.assertEqual(splithost('//127.0.0.1:1234?q=HTTP/1.1\r\nHeader: Value'), + (None, '//127.0.0.1:1234?q=HTTP/1.1\r\nHeader: Value')) + + self.assertEqual(splithost('//127.0.0.1:1234#q=HTTP/1.1\r\nHeader: Value'), + (None, '//127.0.0.1:1234#q=HTTP/1.1\r\nHeader: Value')) + def test_splituser(self): splituser = urllib.parse._splituser self.assertEqual(splituser('User:Pass@www.python.org:080'), diff --git a/Lib/urllib/parse.py b/Lib/urllib/parse.py index 8b6c9b10609152..42a4029d8ee049 100644 --- a/Lib/urllib/parse.py +++ b/Lib/urllib/parse.py @@ -1016,7 +1016,7 @@ def _splithost(url): """splithost('//host[:port]/path') --> 'host[:port]', '/path'.""" global _hostprog if _hostprog is None: - _hostprog = re.compile('//([^/#?]*)(.*)', re.DOTALL) + _hostprog = re.compile('//([^/#?]*)(.*)$') match = _hostprog.match(url) if match: From fc915b32844716f04ddc47642b184a42f7c9ad65 Mon Sep 17 00:00:00 2001 From: "blurb-it[bot]" Date: Sun, 24 Mar 2019 14:36:24 +0000 Subject: [PATCH 2/3] =?UTF-8?q?=F0=9F=93=9C=F0=9F=A4=96=20Added=20by=20blu?= =?UTF-8?q?rb=5Fit.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../NEWS.d/next/Library/2019-03-24-14-36-23.bpo-35906.TU53mt.rst | 1 + 1 file changed, 1 insertion(+) create mode 100644 Misc/NEWS.d/next/Library/2019-03-24-14-36-23.bpo-35906.TU53mt.rst diff --git a/Misc/NEWS.d/next/Library/2019-03-24-14-36-23.bpo-35906.TU53mt.rst b/Misc/NEWS.d/next/Library/2019-03-24-14-36-23.bpo-35906.TU53mt.rst new file mode 100644 index 00000000000000..a3c8f4e309b723 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2019-03-24-14-36-23.bpo-35906.TU53mt.rst @@ -0,0 +1 @@ +Fix CRLF injection in urllib as disallowing line breaks in parse \ No newline at end of file From 4c6887b067ba87722ef93af902b509e938e1dae0 Mon Sep 17 00:00:00 2001 From: SH Date: Sun, 24 Mar 2019 23:51:08 +0900 Subject: [PATCH 3/3] Fix white space issue --- Lib/test/test_urlparse.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py index 0b44ba7bcd94ac..8174c86856df17 100644 --- a/Lib/test/test_urlparse.py +++ b/Lib/test/test_urlparse.py @@ -1061,13 +1061,13 @@ def test_splithost(self): # bpo-35906: disallow line breaks self.assertEqual(splithost('//127.0.0.1:1234/?q=HTTP/1.1\r\nHeader: Value'), - (None, '//127.0.0.1:1234/?q=HTTP/1.1\r\nHeader: Value')) + (None, '//127.0.0.1:1234/?q=HTTP/1.1\r\nHeader: Value')) self.assertEqual(splithost('//127.0.0.1:1234?q=HTTP/1.1\r\nHeader: Value'), - (None, '//127.0.0.1:1234?q=HTTP/1.1\r\nHeader: Value')) + (None, '//127.0.0.1:1234?q=HTTP/1.1\r\nHeader: Value')) self.assertEqual(splithost('//127.0.0.1:1234#q=HTTP/1.1\r\nHeader: Value'), - (None, '//127.0.0.1:1234#q=HTTP/1.1\r\nHeader: Value')) + (None, '//127.0.0.1:1234#q=HTTP/1.1\r\nHeader: Value')) def test_splituser(self): splituser = urllib.parse._splituser