diff options
| author | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2021-04-29 17:57:31 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-04-29 17:57:31 (GMT) |
| commit | 491fde0161d5e527eeff8586dd3972d7d3a631a7 (patch) | |
| tree | ec36ee7cb682f714570318fd8dc50970018269fd /Lib/urllib/parse.py | |
| parent | 8d47f92d46a92a5931b8f3dcb4a484df672fc4de (diff) | |
| download | cpython-491fde0161d5e527eeff8586dd3972d7d3a631a7.zip cpython-491fde0161d5e527eeff8586dd3972d7d3a631a7.tar.gz cpython-491fde0161d5e527eeff8586dd3972d7d3a631a7.tar.bz2 | |
[3.9] bpo-43882 - urllib.parse should sanitize urls containing ASCII newline and tabs. (GH-25595) (GH-25725)
* bpo-43882 - urllib.parse should sanitize urls containing ASCII newline and tabs. (GH-25595)
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
(cherry picked from commit 76cd81d60310d65d01f9d7b48a8985d8ab89c8b4)
Co-authored-by: Senthil Kumaran <skumaran@gatech.edu>
Diffstat (limited to 'Lib/urllib/parse.py')
| -rw-r--r-- | Lib/urllib/parse.py | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/Lib/urllib/parse.py b/Lib/urllib/parse.py index 21cae47..c11c695 100644 --- a/Lib/urllib/parse.py +++ b/Lib/urllib/parse.py @@ -78,6 +78,9 @@ scheme_chars = ('abcdefghijklmnopqrstuvwxyz' '0123456789' '+-.') +# Unsafe bytes to be removed per WHATWG spec +_UNSAFE_URL_BYTES_TO_REMOVE = ['\t', '\r', '\n'] + # XXX: Consider replacing with functools.lru_cache MAX_CACHE_SIZE = 20 _parse_cache = {} @@ -469,6 +472,9 @@ def urlsplit(url, scheme='', allow_fragments=True): else: scheme, url = url[:i].lower(), url[i+1:] + for b in _UNSAFE_URL_BYTES_TO_REMOVE: + url = url.replace(b, "") + if url[:2] == '//': netloc, url = _splitnetloc(url, 2) if (('[' in netloc and ']' not in netloc) or |