From 8f99cc799e4393bf1112b9395b2342f81b3f45ef Mon Sep 17 00:00:00 2001 From: push0ebp Date: Thu, 14 Feb 2019 02:05:46 +0900 Subject: [PATCH 1/2] bpo-35907: Avoid file reading as disallowing the unnecessary URL scheme in urllib --- Lib/test/test_urllib.py | 12 ++++++++++++ Lib/urllib.py | 5 ++++- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py index 1ce9201c0693..e5f210e62a18 100644 --- a/Lib/test/test_urllib.py +++ b/Lib/test/test_urllib.py @@ -1023,6 +1023,18 @@ def open_spam(self, url): "spam://c:|windows%/:=&?~#+!$,;'@()*[]|/path/"), "//c:|windows%/:=&?~#+!$,;'@()*[]|/path/") + def test_local_file_open(self): + class DummyURLopener(urllib.URLopener): + def open_local_file(self, url): + return url + self.assertEqual(DummyURLopener().open( + 'local-file://example'), '//example') + self.assertEqual(DummyURLopener().open( + 'local_file://example'), '//example') + self.assertRaises(IOError, urllib.urlopen, + 'local-file://example') + self.assertRaises(IOError, urllib.urlopen, + 'local_file://example') # Just commented them out. # Can't really tell why keep failing in windows and sparc. diff --git a/Lib/urllib.py b/Lib/urllib.py index d85504a5cb7e..a24e9a5c68fb 100644 --- a/Lib/urllib.py +++ b/Lib/urllib.py @@ -203,7 +203,10 @@ def open(self, fullurl, data=None): name = 'open_' + urltype self.type = urltype name = name.replace('-', '_') - if not hasattr(self, name): + + # bpo-35907: # disallow the file reading with the type not allowed + if not hasattr(self, name) or \ + (self == _urlopener and name == 'open_local_file'): if proxy: return self.open_unknown_proxy(proxy, fullurl, data) else: From b86392511acd4cd30dc68711fa22f9f93228715a Mon Sep 17 00:00:00 2001 From: "blurb-it[bot]" Date: Wed, 13 Feb 2019 17:21:11 +0000 Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=93=9C=F0=9F=A4=96=20Added=20by=20blu?= =?UTF-8?q?rb=5Fit.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../NEWS.d/next/Library/2019-02-13-17-21-10.bpo-35907.ckk2zg.rst | 1 + 1 file changed, 1 insertion(+) create mode 100644 Misc/NEWS.d/next/Library/2019-02-13-17-21-10.bpo-35907.ckk2zg.rst diff --git a/Misc/NEWS.d/next/Library/2019-02-13-17-21-10.bpo-35907.ckk2zg.rst b/Misc/NEWS.d/next/Library/2019-02-13-17-21-10.bpo-35907.ckk2zg.rst new file mode 100644 index 000000000000..8118a5f40583 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2019-02-13-17-21-10.bpo-35907.ckk2zg.rst @@ -0,0 +1 @@ +Avoid file reading as disallowing the unnecessary URL scheme in urllib.urlopen \ No newline at end of file