diff options
| author | Senthil Kumaran <senthil@python.org> | 2021-05-21 12:30:04 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-05-21 12:30:04 (GMT) |
| commit | 0593ae84af9e0e8332644e7ed13d7fd8306c4e1a (patch) | |
| tree | 0ba20048f4d9ee21f376b66aabfd93e3cba6c22d /Doc/whatsnew | |
| parent | b9258b03b864520525176f927156b85a532a9d7c (diff) | |
| download | cpython-0593ae84af9e0e8332644e7ed13d7fd8306c4e1a.zip cpython-0593ae84af9e0e8332644e7ed13d7fd8306c4e1a.tar.gz cpython-0593ae84af9e0e8332644e7ed13d7fd8306c4e1a.tar.bz2 | |
[3.9] bpo-43882 - Mention urllib.parse changes in Whats new section. (GH-26276)
* [3.9] bpo-43882 - Mention urllib.parse changes in Whats new section.
* Add the missing section.
Diffstat (limited to 'Doc/whatsnew')
| -rw-r--r-- | Doc/whatsnew/3.9.rst | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/Doc/whatsnew/3.9.rst b/Doc/whatsnew/3.9.rst index 7f790e5..c29715d 100644 --- a/Doc/whatsnew/3.9.rst +++ b/Doc/whatsnew/3.9.rst @@ -1560,3 +1560,17 @@ IPv4 address sent from the remote server when setting up a passive data channel. We reuse the ftp server IP address instead. For unusual code requiring the old behavior, set a ``trust_server_pasv_ipv4_address`` attribute on your FTP instance to ``True``. (See :issue:`43285`) + +Notable changes in Python 3.9.5 +=============================== + +urllib.parse +------------ + +The presence of newline or tab characters in parts of a URL allows for some +forms of attacks. Following the WHATWG specification that updates :rfc:`3986`, +ASCII newline ``\n``, ``\r`` and tab ``\t`` characters are stripped from the +URL by the parser in :mod:`urllib.parse` preventing such attacks. The removal +characters are controlled by a new module level variable +``urllib.parse._UNSAFE_URL_BYTES_TO_REMOVE``. (See :issue:`43882`) + |