forked from pool/python39
Matej Cepl
64818e1d6b
- Security
- gh-135034: Fixes multiple issues that allowed tarfile
extraction filters (filter="data" and filter="tar") to be
bypassed using crafted symlinks and hard links.
- Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
(bsc#1244059), CVE-2025-4330 (bsc#1244060), and
CVE-2025-4517 (bsc#1244032).
- gh-133767: Fix use-after-free in the “unicode-escape”
decoder with a non-“strict” error handler (CVE-2025-4516,
bsc#1243273).
- gh-128840: Short-circuit the processing of long IPv6
addresses early in ipaddress to prevent excessive memory
consumption and a minor denial-of-service.
- gh-80222: Fix bug in the folding of quoted strings
when flattening an email message using a modern email
policy. Previously when a quoted string was folded so
that it spanned more than one line, the surrounding
quotes and internal escapes would be omitted. This could
theoretically be used to spoof header lines using a
carefully constructed quoted string if the resulting
rendered email was transmitted or re-parsed.
- Library
- gh-128840: Fix parsing long IPv6 addresses with embedded
IPv4 address.
- gh-134062: ipaddress: fix collisions in __hash__() for
IPv4Network and IPv6Network objects.
- gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
according to RFC 3596, §2.5. Patch by Bénédikt Tran.
- bpo-43633: Improve the textual representation of
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python39?expand=0&rev=233
98 lines
4.9 KiB
Diff
98 lines
4.9 KiB
Diff
From 37bc08c699f48461be5e000b2da9212237a1ca0f Mon Sep 17 00:00:00 2001
|
|
From: JohnJamesUtley <jjutley231@gmail.com>
|
|
Date: Tue, 25 Apr 2023 16:01:03 -0400
|
|
Subject: [PATCH 1/4] Adds checks to ensure that bracketed hosts found by
|
|
urlsplit are of IPv6 or IPvFuture format
|
|
|
|
---
|
|
Lib/test/test_urlparse.py | 26 ++++++++++
|
|
Lib/urllib/parse.py | 16 +++++-
|
|
Misc/NEWS.d/next/Library/2023-04-26-09-54-25.gh-issue-103848.aDSnpR.rst | 2
|
|
3 files changed, 43 insertions(+), 1 deletion(-)
|
|
create mode 100644 Misc/NEWS.d/next/Library/2023-04-26-09-54-25.gh-issue-103848.aDSnpR.rst
|
|
|
|
--- a/Lib/test/test_urlparse.py
|
|
+++ b/Lib/test/test_urlparse.py
|
|
@@ -1135,6 +1135,32 @@ class UrlParseTestCase(unittest.TestCase
|
|
self.assertEqual(p2.scheme, 'tel')
|
|
self.assertEqual(p2.path, '+31641044153')
|
|
|
|
+ def test_invalid_bracketed_hosts(self):
|
|
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[192.0.2.146]/Path?Query')
|
|
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[important.com:8000]/Path?Query')
|
|
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v123r.IP]/Path?Query')
|
|
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v12ae]/Path?Query')
|
|
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v.IP]/Path?Query')
|
|
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v123.]/Path?Query')
|
|
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v]/Path?Query')
|
|
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af::2309::fae7:1234]/Path?Query')
|
|
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af:2309::fae7:1234:2342:438e:192.0.2.146]/Path?Query')
|
|
+ self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@]v6a.ip[/Path')
|
|
+
|
|
+ def test_splitting_bracketed_hosts(self):
|
|
+ p1 = urllib.parse.urlsplit('scheme://user@[v6a.ip]/path?query')
|
|
+ self.assertEqual(p1.hostname, 'v6a.ip')
|
|
+ self.assertEqual(p1.username, 'user')
|
|
+ self.assertEqual(p1.path, '/path')
|
|
+ p2 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7%test]/path?query')
|
|
+ self.assertEqual(p2.hostname, '0439:23af:2309::fae7%test')
|
|
+ self.assertEqual(p2.username, 'user')
|
|
+ self.assertEqual(p2.path, '/path')
|
|
+ p3 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7:1234:192.0.2.146%test]/path?query')
|
|
+ self.assertEqual(p3.hostname, '0439:23af:2309::fae7:1234:192.0.2.146%test')
|
|
+ self.assertEqual(p3.username, 'user')
|
|
+ self.assertEqual(p3.path, '/path')
|
|
+
|
|
def test_port_casting_failure_message(self):
|
|
message = "Port could not be cast to integer value as 'oracle'"
|
|
p1 = urllib.parse.urlparse('http://Server=sde; Service=sde:oracle')
|
|
--- a/Lib/urllib/parse.py
|
|
+++ b/Lib/urllib/parse.py
|
|
@@ -36,6 +36,7 @@ import sys
|
|
import types
|
|
import collections
|
|
import warnings
|
|
+import ipaddress
|
|
|
|
__all__ = ["urlparse", "urlunparse", "urljoin", "urldefrag",
|
|
"urlsplit", "urlunsplit", "urlencode", "parse_qs",
|
|
@@ -442,6 +443,17 @@ def _checknetloc(netloc):
|
|
raise ValueError("netloc '" + netloc + "' contains invalid " +
|
|
"characters under NFKC normalization")
|
|
|
|
+# Valid bracketed hosts are defined in
|
|
+# https://www.rfc-editor.org/rfc/rfc3986#page-49 and https://url.spec.whatwg.org/
|
|
+def _check_bracketed_host(hostname):
|
|
+ if hostname.startswith('v'):
|
|
+ if not re.match(r"\Av[a-fA-F0-9]+\..+\Z", hostname):
|
|
+ raise ValueError(f"IPvFuture address is invalid")
|
|
+ else:
|
|
+ ip = ipaddress.ip_address(hostname) # Throws Value Error if not IPv6 or IPv4
|
|
+ if isinstance(ip, ipaddress.IPv4Address):
|
|
+ raise ValueError(f"An IPv4 address cannot be in brackets")
|
|
+
|
|
def urlsplit(url, scheme='', allow_fragments=True):
|
|
"""Parse a URL into 5 components:
|
|
<scheme>://<netloc>/<path>?<query>#<fragment>
|
|
@@ -488,12 +500,14 @@ def urlsplit(url, scheme='', allow_fragm
|
|
break
|
|
else:
|
|
scheme, url = url[:i].lower(), url[i+1:]
|
|
-
|
|
if url[:2] == '//':
|
|
netloc, url = _splitnetloc(url, 2)
|
|
if (('[' in netloc and ']' not in netloc) or
|
|
(']' in netloc and '[' not in netloc)):
|
|
raise ValueError("Invalid IPv6 URL")
|
|
+ if '[' in netloc and ']' in netloc:
|
|
+ bracketed_host = netloc.partition('[')[2].partition(']')[0]
|
|
+ _check_bracketed_host(bracketed_host)
|
|
if allow_fragments and '#' in url:
|
|
url, fragment = url.split('#', 1)
|
|
if '?' in url:
|
|
--- /dev/null
|
|
+++ b/Misc/NEWS.d/next/Library/2023-04-26-09-54-25.gh-issue-103848.aDSnpR.rst
|
|
@@ -0,0 +1,2 @@
|
|
+Add checks to ensure that ``[`` bracketed ``]`` hosts found by
|
|
+:func:`urllib.parse.urlsplit` are of IPv6 or IPvFuture format.
|