urllib.request.HTTPPasswordMgr uses commonprefix instead of commonpath

[nagdon]

BPO	42766
Nosy	@orsenthil, @serhiy-storchaka, @Fongeme
PRs	bpo-42766 Fix 2 bugs in urllib.request.HTTPPasswordMgr.is_suburi #24181
Superseder	bpo-46756: Incorrect authorization check in urllib.request

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2022-02-25.12:00:31.021>
created_at = <Date 2020-12-28.15:42:33.956>
labels = ['type-bug', 'library', '3.10']
title = 'urllib.request.HTTPPasswordMgr uses commonprefix instead of commonpath'
updated_at = <Date 2022-02-25.12:00:31.019>
user = 'https://bugs.python.org/nagdon'

bugs.python.org fields:

activity = <Date 2022-02-25.12:00:31.019>
actor = 'serhiy.storchaka'
assignee = 'none'
closed = True
closed_date = <Date 2022-02-25.12:00:31.021>
closer = 'serhiy.storchaka'
components = ['Library (Lib)']
creation = <Date 2020-12-28.15:42:33.956>
creator = 'nagdon'
dependencies = []
files = []
hgrepos = []
issue_num = 42766
keywords = ['patch']
message_count = 2.0
messages = ['383898', '413986']
nosy_count = 4.0
nosy_names = ['orsenthil', 'serhiy.storchaka', 'nagdon', 'Fongeme']
pr_nums = ['24181']
priority = 'normal'
resolution = 'duplicate'
stage = 'resolved'
status = 'closed'
superseder = '46756'
type = 'behavior'
url = 'https://bugs.python.org/issue42766'
versions = ['Python 3.10']

[nagdon]

The is_suburi(self, base, test) method of HTTPPasswordMgr in the urllib.request module tries to "Check if test is below base in a URI tree", but it uses the posixpath.commonprefix() function. This is problematic because commonprefix ignores the path structure (for example commonprefix(['/usr/lib', '/usr/local/lib'])=='/usr/l') and therefore the current implementation of is_suburi is essentially equivalent to calling str.startswith after some normalization steps.

If we want to say that example.com/resource101 is *NOT* below example.com/resource1 in a URI tree, then the call to commonprefix should be replaced by a call to posixpath.commonpath(), which does the right thing.

[serhiy-storchaka]

Sorry I did not notice this issue. It is now solved in bpo-46756.

In any case thank you for the report and the PR.