diff options
| author | Adam Goldschmidt <adamgold7@gmail.com> | 2021-02-14 22:41:57 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-02-14 22:41:57 (GMT) |
| commit | fcbe0cb04d35189401c0c880ebfb4311e952d776 (patch) | |
| tree | 48ca1701d13be00517881423fcfd99b8a9ae9445 /Doc/whatsnew/3.7.rst | |
| parent | 1b57426e3a7842b4e6f9fc13ffb657c78e5443d4 (diff) | |
| download | cpython-fcbe0cb04d35189401c0c880ebfb4311e952d776.zip cpython-fcbe0cb04d35189401c0c880ebfb4311e952d776.tar.gz cpython-fcbe0cb04d35189401c0c880ebfb4311e952d776.tar.bz2 | |
bpo-42967: only use '&' as a query string separator (#24297)
bpo-42967: [security] Address a web cache-poisoning issue reported in urllib.parse.parse_qsl().
urllib.parse will only us "&" as query string separator by default instead of both ";" and "&" as allowed in earlier versions. An optional argument seperator with default value "&" is added to specify the separator.
Co-authored-by: Éric Araujo <merwok@netwok.org>
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Éric Araujo <merwok@netwok.org>
Diffstat (limited to 'Doc/whatsnew/3.7.rst')
| -rw-r--r-- | Doc/whatsnew/3.7.rst | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/Doc/whatsnew/3.7.rst b/Doc/whatsnew/3.7.rst index 7590af3..75e1973 100644 --- a/Doc/whatsnew/3.7.rst +++ b/Doc/whatsnew/3.7.rst @@ -2557,3 +2557,16 @@ because of the behavior of the socket option ``SO_REUSEADDR`` in UDP. For more details, see the documentation for ``loop.create_datagram_endpoint()``. (Contributed by Kyle Stanley, Antoine Pitrou, and Yury Selivanov in :issue:`37228`.) + +Notable changes in Python 3.7.10 +================================ + +Earlier Python versions allowed using both ``;`` and ``&`` as +query parameter separators in :func:`urllib.parse.parse_qs` and +:func:`urllib.parse.parse_qsl`. Due to security concerns, and to conform with +newer W3C recommendations, this has been changed to allow only a single +separator key, with ``&`` as the default. This change also affects +:func:`cgi.parse` and :func:`cgi.parse_multipart` as they use the affected +functions internally. For more details, please see their respective +documentation. +(Contributed by Adam Goldschmidt, Senthil Kumaran and Ken Jin in :issue:`42967`.) |