summaryrefslogtreecommitdiffstats
path: root/Lib/test/test_urllib.py
diff options
context:
space:
mode:
authorSenthil Kumaran <senthil@uthcode.com>2016-07-31 06:39:06 (GMT)
committerSenthil Kumaran <senthil@uthcode.com>2016-07-31 06:39:06 (GMT)
commit17742f2d45c9dd7ca777e33601a26e80576fdbf6 (patch)
treef83a9638dd08398dd1c93e4941a794a836b67f8c /Lib/test/test_urllib.py
parent3a32bdfaa7494bfc172b04bdb1c8159978af8d42 (diff)
parent436fe5a447abb69e5e5a4f453325c422af02dcaa (diff)
downloadcpython-17742f2d45c9dd7ca777e33601a26e80576fdbf6.zip
cpython-17742f2d45c9dd7ca777e33601a26e80576fdbf6.tar.gz
cpython-17742f2d45c9dd7ca777e33601a26e80576fdbf6.tar.bz2
[merge from 3.4] - Prevent HTTPoxy attack (CVE-2016-1000110)
Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which indicates that the script is in CGI mode. Issue #27568 Reported and patch contributed by RĂ©mi Rampin.
Diffstat (limited to 'Lib/test/test_urllib.py')
-rw-r--r--Lib/test/test_urllib.py12
1 files changed, 12 insertions, 0 deletions
diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py
index 5d05f8d..c26c52a 100644
--- a/Lib/test/test_urllib.py
+++ b/Lib/test/test_urllib.py
@@ -232,6 +232,18 @@ class ProxyTests(unittest.TestCase):
self.assertTrue(urllib.request.proxy_bypass_environment('anotherdomain.com:8888'))
self.assertTrue(urllib.request.proxy_bypass_environment('newdomain.com:1234'))
+ def test_proxy_cgi_ignore(self):
+ try:
+ self.env.set('HTTP_PROXY', 'http://somewhere:3128')
+ proxies = urllib.request.getproxies_environment()
+ self.assertEqual('http://somewhere:3128', proxies['http'])
+ self.env.set('REQUEST_METHOD', 'GET')
+ proxies = urllib.request.getproxies_environment()
+ self.assertNotIn('http', proxies)
+ finally:
+ self.env.unset('REQUEST_METHOD')
+ self.env.unset('HTTP_PROXY')
+
def test_proxy_bypass_environment_host_match(self):
bypass = urllib.request.proxy_bypass_environment
self.env.set('NO_PROXY',