diff options
| author | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2023-05-17 23:06:06 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-05-17 23:06:06 (GMT) |
| commit | f48a96a28012d28ae37a2f4587a780a5eb779946 (patch) | |
| tree | c9d5e9271a27e75b4f394ba441da49a8df4bd176 /Lib/test/test_subprocess.py | |
| parent | 425065bb002b9cbf9c12f61a6f3102f2ce2b8d14 (diff) | |
| download | cpython-f48a96a28012d28ae37a2f4587a780a5eb779946.zip cpython-f48a96a28012d28ae37a2f4587a780a5eb779946.tar.gz cpython-f48a96a28012d28ae37a2f4587a780a5eb779946.tar.bz2 | |
[3.10] [3.11] gh-102153: Start stripping C0 control and space chars in `urlsplit` (GH-102508) (GH-104575) (#104592)
gh-102153: Start stripping C0 control and space chars in `urlsplit` (GH-102508)
`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit GH-25595.
This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).
I simplified the docs by eliding the state of the world explanatory
paragraph in this security release only backport. (people will see
that in the mainline /3/ docs)
---------
(cherry picked from commit 2f630e1ce18ad2e07428296532a68b11dc66ad10)
(cherry picked from commit 610cc0ab1b760b2abaac92bd256b96191c46b941)
Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
Co-authored-by: Gregory P. Smith [Google] <greg@krypto.org>
Diffstat (limited to 'Lib/test/test_subprocess.py')
0 files changed, 0 insertions, 0 deletions