diff options
| author | Senthil Kumaran <senthil@uthcode.com> | 2016-07-31 06:34:34 (GMT) |
|---|---|---|
| committer | Senthil Kumaran <senthil@uthcode.com> | 2016-07-31 06:34:34 (GMT) |
| commit | 436fe5a447abb69e5e5a4f453325c422af02dcaa (patch) | |
| tree | 6087c6640f2e39e4e8bd1e7b7b6490e8e0b7f324 /Doc/howto | |
| parent | b7b5d35545d2d078e868cbda485bc4651edec4ff (diff) | |
| parent | 4cbb23f8f278fd1f71dcd5968aa0b3f0b4f3bd5d (diff) | |
| download | cpython-436fe5a447abb69e5e5a4f453325c422af02dcaa.zip cpython-436fe5a447abb69e5e5a4f453325c422af02dcaa.tar.gz cpython-436fe5a447abb69e5e5a4f453325c422af02dcaa.tar.bz2 | |
[merge from 3.3] Prevent HTTPoxy attack (CVE-2016-1000110)
Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which
indicates that the script is in CGI mode.
Issue #27568 Reported and patch contributed by Rémi Rampin.
Diffstat (limited to 'Doc/howto')
| -rw-r--r-- | Doc/howto/urllib2.rst | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/Doc/howto/urllib2.rst b/Doc/howto/urllib2.rst index 9052ed5..4a67b30 100644 --- a/Doc/howto/urllib2.rst +++ b/Doc/howto/urllib2.rst @@ -538,6 +538,11 @@ setting up a `Basic Authentication`_ handler: :: through a proxy. However, this can be enabled by extending urllib.request as shown in the recipe [#]_. +.. note:: + + `HTTP_PROXY`` will be ignored if a variable ``REQUEST_METHOD`` is set; see + the documentation on :func:`~urllib.request.getproxies`. + Sockets and Layers ================== |