diff options
| author | Senthil Kumaran <senthil@uthcode.com> | 2012-05-15 14:30:25 (GMT) |
|---|---|---|
| committer | Senthil Kumaran <senthil@uthcode.com> | 2012-05-15 14:30:25 (GMT) |
| commit | 34f3fcc269be2ecded57ff3ae336977c5e74c42f (patch) | |
| tree | 1abc52f596e83d0f4737281d1c663b7b65736512 /Lib | |
| parent | 539f239e88cbcbdb11014c82ee5a5d8ee9536ec6 (diff) | |
| download | cpython-34f3fcc269be2ecded57ff3ae336977c5e74c42f.zip cpython-34f3fcc269be2ecded57ff3ae336977c5e74c42f.tar.gz cpython-34f3fcc269be2ecded57ff3ae336977c5e74c42f.tar.bz2 | |
Issue #12541: Be lenient with quotes around Realm field of HTTP Basic Authentation in urllib2.
G: changed Misc/NEWS
Diffstat (limited to 'Lib')
| -rw-r--r-- | Lib/test/test_urllib2.py | 15 | ||||
| -rw-r--r-- | Lib/urllib/request.py | 2 |
2 files changed, 16 insertions, 1 deletions
diff --git a/Lib/test/test_urllib2.py b/Lib/test/test_urllib2.py index 3d80e01..911a0af 100644 --- a/Lib/test/test_urllib2.py +++ b/Lib/test/test_urllib2.py @@ -1218,6 +1218,21 @@ class HandlerTests(unittest.TestCase): def test_basic_auth_with_single_quoted_realm(self): self.test_basic_auth(quote_char="'") + def test_basic_auth_with_unquoted_realm(self): + opener = OpenerDirector() + password_manager = MockPasswordManager() + auth_handler = urllib.request.HTTPBasicAuthHandler(password_manager) + realm = "ACME Widget Store" + http_handler = MockHTTPHandler( + 401, 'WWW-Authenticate: Basic realm=%s\r\n\r\n' % realm) + opener.add_handler(auth_handler) + opener.add_handler(http_handler) + self._test_basic_auth(opener, auth_handler, "Authorization", + realm, http_handler, password_manager, + "http://acme.example.com/protected", + "http://acme.example.com/protected", + ) + def test_proxy_basic_auth(self): opener = OpenerDirector() ph = urllib.request.ProxyHandler(dict(http="proxy.example.com:3128")) diff --git a/Lib/urllib/request.py b/Lib/urllib/request.py index fe2cfcd..cbcbe1a 100644 --- a/Lib/urllib/request.py +++ b/Lib/urllib/request.py @@ -794,7 +794,7 @@ class AbstractBasicAuthHandler: # allow for double- and single-quoted realm values # (single quotes are a violation of the RFC, but appear in the wild) rx = re.compile('(?:.*,)*[ \t]*([^ \t]+)[ \t]+' - 'realm=(["\'])(.*?)\\2', re.I) + 'realm=(["\']?)([^"\']*)\\2', re.I) # XXX could pre-emptively send auth info already accepted (RFC 2617, # end of section 2, and section 1.2 immediately after "credentials" |