diff options
| author | Senthil Kumaran <senthil@uthcode.com> | 2021-04-29 17:16:50 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-04-29 17:16:50 (GMT) |
| commit | 76cd81d60310d65d01f9d7b48a8985d8ab89c8b4 (patch) | |
| tree | 9a68f606c0d7a11720853a4acaf2b61d718061ac /Misc | |
| parent | 14fc2bdfab857718429029e53ceffca456178827 (diff) | |
| download | cpython-76cd81d60310d65d01f9d7b48a8985d8ab89c8b4.zip cpython-76cd81d60310d65d01f9d7b48a8985d8ab89c8b4.tar.gz cpython-76cd81d60310d65d01f9d7b48a8985d8ab89c8b4.tar.bz2 | |
bpo-43882 - urllib.parse should sanitize urls containing ASCII newline and tabs. (GH-25595)
* issue43882 - urllib.parse should sanitize urls containing ASCII newline and tabs.
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Diffstat (limited to 'Misc')
| -rw-r--r-- | Misc/NEWS.d/next/Security/2021-04-25-07-46-37.bpo-43882.Jpwx85.rst | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/Misc/NEWS.d/next/Security/2021-04-25-07-46-37.bpo-43882.Jpwx85.rst b/Misc/NEWS.d/next/Security/2021-04-25-07-46-37.bpo-43882.Jpwx85.rst new file mode 100644 index 0000000..a326d07 --- /dev/null +++ b/Misc/NEWS.d/next/Security/2021-04-25-07-46-37.bpo-43882.Jpwx85.rst @@ -0,0 +1,6 @@ +The presence of newline or tab characters in parts of a URL could allow +some forms of attacks. + +Following the controlling specification for URLs defined by WHATWG +:func:`urllib.parse` now removes ASCII newlines and tabs from URLs, +preventing such attacks. |