diff options
| author | Victor Stinner <vstinner@redhat.com> | 2019-05-22 21:28:03 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-05-22 21:28:03 (GMT) |
| commit | 942c31dffbe886ff02e25a319cc3891220b8c641 (patch) | |
| tree | 8b5f603fd738d6758debc9e202abbe3e35535aa9 | |
| parent | b15bde8058e821b383d81fcae68b335a752083ca (diff) | |
| download | cpython-942c31dffbe886ff02e25a319cc3891220b8c641.zip cpython-942c31dffbe886ff02e25a319cc3891220b8c641.tar.gz cpython-942c31dffbe886ff02e25a319cc3891220b8c641.tar.bz2 | |
bpo-35907: Complete test_urllib.test_local_file_open() (GH-13506)
Test also URLopener().open(), URLopener().retrieve(), and
DummyURLopener().retrieve().
| -rw-r--r-- | Lib/test/test_urllib.py | 6 | ||||
| -rw-r--r-- | Misc/NEWS.d/next/Library/2019-02-13-17-21-10.bpo-35907.ckk2zg.rst | 4 |
2 files changed, 8 insertions, 2 deletions
diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py index ae1f6c0..22b0874 100644 --- a/Lib/test/test_urllib.py +++ b/Lib/test/test_urllib.py @@ -1049,12 +1049,16 @@ class URLopener_Tests(unittest.TestCase): "//c:|windows%/:=&?~#+!$,;'@()*[]|/path/") def test_local_file_open(self): + # bpo-35907, CVE-2019-9948: urllib must reject local_file:// scheme class DummyURLopener(urllib.URLopener): def open_local_file(self, url): return url for url in ('local_file://example', 'local-file://example'): - self.assertRaises(IOError, DummyURLopener().open, url) self.assertRaises(IOError, urllib.urlopen, url) + self.assertRaises(IOError, urllib.URLopener().open, url) + self.assertRaises(IOError, urllib.URLopener().retrieve, url) + self.assertRaises(IOError, DummyURLopener().open, url) + self.assertRaises(IOError, DummyURLopener().retrieve, url) # Just commented them out. # Can't really tell why keep failing in windows and sparc. diff --git a/Misc/NEWS.d/next/Library/2019-02-13-17-21-10.bpo-35907.ckk2zg.rst b/Misc/NEWS.d/next/Library/2019-02-13-17-21-10.bpo-35907.ckk2zg.rst index bb187d8..6a448ce 100644 --- a/Misc/NEWS.d/next/Library/2019-02-13-17-21-10.bpo-35907.ckk2zg.rst +++ b/Misc/NEWS.d/next/Library/2019-02-13-17-21-10.bpo-35907.ckk2zg.rst @@ -1 +1,3 @@ -CVE-2019-9948: Avoid file reading as disallowing the unnecessary URL scheme in urllib.urlopen +CVE-2019-9948: Avoid file reading as disallowing the unnecessary URL scheme in +:func:`urllib.urlopen`, :meth:`urllib.URLopener.open` and +:meth:`urllib.URLopener.retrieve`. |