diff options
| author | Senthil Kumaran <skumaran@gatech.edu> | 2021-02-15 18:03:31 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-02-15 18:03:31 (GMT) |
| commit | c9f07813ab8e664d8c34413c4fc2d4f86c061a92 (patch) | |
| tree | afacb993137021a44a30a87d55d8507c93963c22 /Doc/whatsnew/3.6.rst | |
| parent | 242f6c9ffe3dd8f613942d5364b816cc89c384be (diff) | |
| download | cpython-c9f07813ab8e664d8c34413c4fc2d4f86c061a92.zip cpython-c9f07813ab8e664d8c34413c4fc2d4f86c061a92.tar.gz cpython-c9f07813ab8e664d8c34413c4fc2d4f86c061a92.tar.bz2 | |
[3.9] bpo-42967: only use '&' as a query string separator (GH-24297) (#24528)
(cherry picked from commit fcbe0cb04d35189401c0c880ebfb4311e952d776)
* [3.9] bpo-42967: only use '&' as a query string separator (GH-24297)
bpo-42967: [security] Address a web cache-poisoning issue reported in urllib.parse.parse_qsl().
urllib.parse will only us "&" as query string separator by default instead of both ";" and "&" as allowed in earlier versions. An optional argument seperator with default value "&" is added to specify the separator.
Co-authored-by: Éric Araujo <merwok@netwok.org>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Adam Goldschmidt <adamgold7@gmail.com>
Diffstat (limited to 'Doc/whatsnew/3.6.rst')
| -rw-r--r-- | Doc/whatsnew/3.6.rst | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/Doc/whatsnew/3.6.rst b/Doc/whatsnew/3.6.rst index 85a6657..03a877a 100644 --- a/Doc/whatsnew/3.6.rst +++ b/Doc/whatsnew/3.6.rst @@ -2443,3 +2443,16 @@ because of the behavior of the socket option ``SO_REUSEADDR`` in UDP. For more details, see the documentation for ``loop.create_datagram_endpoint()``. (Contributed by Kyle Stanley, Antoine Pitrou, and Yury Selivanov in :issue:`37228`.) + +Notable changes in Python 3.6.13 +================================ + +Earlier Python versions allowed using both ``;`` and ``&`` as +query parameter separators in :func:`urllib.parse.parse_qs` and +:func:`urllib.parse.parse_qsl`. Due to security concerns, and to conform with +newer W3C recommendations, this has been changed to allow only a single +separator key, with ``&`` as the default. This change also affects +:func:`cgi.parse` and :func:`cgi.parse_multipart` as they use the affected +functions internally. For more details, please see their respective +documentation. +(Contributed by Adam Goldschmidt, Senthil Kumaran and Ken Jin in :issue:`42967`.) |