Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[3.7] gh-102153: Start stripping C0 control and space chars in urlsplit (GH-102508) (GH-104575) (GH-104592) (#104593) #104896

Merged
merged 2 commits into from Jun 5, 2023
Merged

[3.7] gh-102153: Start stripping C0 control and space chars in urlsplit (GH-102508) (GH-104575) (GH-104592) (#104593) #104896

merged 2 commits into from Jun 5, 2023

Commits on May 24, 2023

  1. [3.7] pythongh-102153: Start stripping C0 control and space chars in … 

    …`urlsplit` (pythonGH-102508) (pythonGH-104575) (pythonGH-104592) (python#104593)

pythongh-102153: Start stripping C0 control and space chars in `urlsplit` (pythonGH-102508)

`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit pythonGH-25595.

This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).

I simplified the docs by eliding the state of the world explanatory
paragraph in this security release only backport.  (people will see
that in the mainline /3/ docs)

(cherry picked from commit d7f8a5f)
(cherry picked from commit 2f630e1)
(cherry picked from commit 610cc0a)
(cherry picked from commit f48a96a)

Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
Co-authored-by: Gregory P. Smith [Google] <greg@krypto.org>
    @miss-islington @illia-v
    @gpshead @stratakis
    3 people authored and stratakis committed May 24, 2023
    Configuration menu
    Copy the full SHA
    24f5316 View commit details
    Browse the repository at this point in the history

Commits on May 27, 2023

  1. Merge branch '3.7' into 3.7_CVE-2023-24329

    @ned-deily
    ned-deily committed May 27, 2023
    Configuration menu
    Copy the full SHA
    ed04634 View commit details
    Browse the repository at this point in the history