[merge from 3.3] Prevent HTTPoxy attack (CVE-2016-1000110)

Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which
indicates that the script is in CGI mode.

Issue #27568 Reported and patch contributed by Rémi Rampin.

1 files changed, 13 insertions, 0 deletions

diff --git a/Doc/library/urllib.request.rst b/Doc/library/urllib.request.rst
index 4e595de..44db3e1 100644
--- a/Doc/library/urllib.request.rst
+++ b/Doc/library/urllib.request.rst
@@ -166,6 +166,14 @@ The :mod:`urllib.request` module defines the following functions:
    cannot find it, looks for proxy information from Mac OSX System
    Configuration for Mac OS X and Windows Systems Registry for Windows.
 
+   .. note::
+
+      If the environment variable ``REQUEST_METHOD`` is set, which usually
+      indicates your script is running in a CGI environment, the environment
+      variable ``HTTP_PROXY`` (uppercase ``_PROXY``) will be ignored. This is
+      because that variable can be injected by a client using the "Proxy:" HTTP
+      header. If you need to use an HTTP proxy in a CGI environment use
+      ``ProxyHandler`` explicitly.
 
 The following classes are provided:
 
@@ -268,6 +276,11 @@ The following classes are provided:
 
    To disable autodetected proxy pass an empty dictionary.
 
+   .. note::
+
+      ``HTTP_PROXY`` will be ignored if a variable ``REQUEST_METHOD`` is set;
+      see the documentation on :func:`~urllib.request.getproxies`.
+
 
 .. class:: HTTPPasswordMgr()