diff options
| author | Senthil Kumaran <senthil@uthcode.com> | 2016-07-31 06:48:19 (GMT) |
|---|---|---|
| committer | Senthil Kumaran <senthil@uthcode.com> | 2016-07-31 06:48:19 (GMT) |
| commit | 7bfbd1d3c56b2a5281edeb7a8e21598618b7c1a3 (patch) | |
| tree | eb60c18adf0f714205c773f832ff487572e9bed0 /Lib/urllib/request.py | |
| parent | dbaa559b7fc6b80c1f230119f609b99b5b3844f3 (diff) | |
| parent | 17742f2d45c9dd7ca777e33601a26e80576fdbf6 (diff) | |
| download | cpython-7bfbd1d3c56b2a5281edeb7a8e21598618b7c1a3.zip cpython-7bfbd1d3c56b2a5281edeb7a8e21598618b7c1a3.tar.gz cpython-7bfbd1d3c56b2a5281edeb7a8e21598618b7c1a3.tar.bz2 | |
merge heads
Diffstat (limited to 'Lib/urllib/request.py')
| -rw-r--r-- | Lib/urllib/request.py | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/Lib/urllib/request.py b/Lib/urllib/request.py index 1731fe3..3be327d 100644 --- a/Lib/urllib/request.py +++ b/Lib/urllib/request.py @@ -2412,6 +2412,12 @@ def getproxies_environment(): name = name.lower() if value and name[-6:] == '_proxy': proxies[name[:-6]] = value + # CVE-2016-1000110 - If we are running as CGI script, forget HTTP_PROXY + # (non-all-lowercase) as it may be set from the web server by a "Proxy:" + # header from the client + # If "proxy" is lowercase, it will still be used thanks to the next block + if 'REQUEST_METHOD' in os.environ: + proxies.pop('http', None) for name, value in os.environ.items(): if name[-6:] == '_proxy': name = name.lower() |