diff options
| author | Senthil Kumaran <senthil@uthcode.com> | 2021-04-29 17:16:50 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-04-29 17:16:50 (GMT) |
| commit | 76cd81d60310d65d01f9d7b48a8985d8ab89c8b4 (patch) | |
| tree | 9a68f606c0d7a11720853a4acaf2b61d718061ac /Doc/library/urllib.parse.rst | |
| parent | 14fc2bdfab857718429029e53ceffca456178827 (diff) | |
| download | cpython-76cd81d60310d65d01f9d7b48a8985d8ab89c8b4.zip cpython-76cd81d60310d65d01f9d7b48a8985d8ab89c8b4.tar.gz cpython-76cd81d60310d65d01f9d7b48a8985d8ab89c8b4.tar.bz2 | |
bpo-43882 - urllib.parse should sanitize urls containing ASCII newline and tabs. (GH-25595)
* issue43882 - urllib.parse should sanitize urls containing ASCII newline and tabs.
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Diffstat (limited to 'Doc/library/urllib.parse.rst')
| -rw-r--r-- | Doc/library/urllib.parse.rst | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/Doc/library/urllib.parse.rst b/Doc/library/urllib.parse.rst index 67c2120..0aaac56 100644 --- a/Doc/library/urllib.parse.rst +++ b/Doc/library/urllib.parse.rst @@ -312,6 +312,9 @@ or on combining URL components into a URL string. ``#``, ``@``, or ``:`` will raise a :exc:`ValueError`. If the URL is decomposed before parsing, no error will be raised. + Following the `WHATWG spec`_ that updates RFC 3986, ASCII newline + ``\n``, ``\r`` and tab ``\t`` characters are stripped from the URL. + .. versionchanged:: 3.6 Out-of-range port numbers now raise :exc:`ValueError`, instead of returning :const:`None`. @@ -320,6 +323,10 @@ or on combining URL components into a URL string. Characters that affect netloc parsing under NFKC normalization will now raise :exc:`ValueError`. + .. versionchanged:: 3.10 + ASCII newline and tab characters are stripped from the URL. + +.. _WHATWG spec: https://url.spec.whatwg.org/#concept-basic-url-parser .. function:: urlunsplit(parts) @@ -674,6 +681,10 @@ task isn't already covered by the URL parsing functions above. .. seealso:: + `WHATWG`_ - URL Living standard + Working Group for the URL Standard that defines URLs, domains, IP addresses, the + application/x-www-form-urlencoded format, and their API. + :rfc:`3986` - Uniform Resource Identifiers This is the current standard (STD66). Any changes to urllib.parse module should conform to this. Certain deviations could be observed, which are @@ -697,3 +708,5 @@ task isn't already covered by the URL parsing functions above. :rfc:`1738` - Uniform Resource Locators (URL) This specifies the formal syntax and semantics of absolute URLs. + +.. _WHATWG: https://url.spec.whatwg.org/ |