diff options
| author | Ben Kallus <49924171+kenballus@users.noreply.github.com> | 2022-11-13 18:25:55 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-11-13 18:25:55 (GMT) |
| commit | 439b9cfaf43080e91c4ad69f312f21fa098befc7 (patch) | |
| tree | 307fe4dc0c0d7fbdc8c9bc856c36b96d06bdff4c /Lib/urllib | |
| parent | 50b0415127009119882e32377d25a4d191088a76 (diff) | |
| download | cpython-439b9cfaf43080e91c4ad69f312f21fa098befc7.zip cpython-439b9cfaf43080e91c4ad69f312f21fa098befc7.tar.gz cpython-439b9cfaf43080e91c4ad69f312f21fa098befc7.tar.bz2 | |
gh-99418: Make urllib.parse.urlparse enforce that a scheme must begin with an alphabetical ASCII character. (#99421)
Prevent urllib.parse.urlparse from accepting schemes that don't begin with an alphabetical ASCII character.
RFC 3986 defines a scheme like this: `scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )`
RFC 2234 defines an ALPHA like this: `ALPHA = %x41-5A / %x61-7A`
The WHATWG URL spec defines a scheme like this:
`"A URL-scheme string must be one ASCII alpha, followed by zero or more of ASCII alphanumeric, U+002B (+), U+002D (-), and U+002E (.)."`
Diffstat (limited to 'Lib/urllib')
| -rw-r--r-- | Lib/urllib/parse.py | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/Lib/urllib/parse.py b/Lib/urllib/parse.py index 9a3102a..4f6867a 100644 --- a/Lib/urllib/parse.py +++ b/Lib/urllib/parse.py @@ -460,7 +460,7 @@ def urlsplit(url, scheme='', allow_fragments=True): allow_fragments = bool(allow_fragments) netloc = query = fragment = '' i = url.find(':') - if i > 0: + if i > 0 and url[0].isascii() and url[0].isalpha(): for c in url[:i]: if c not in scheme_chars: break |