diff options
| author | Illia Volochii <illia.volochii@gmail.com> | 2023-05-17 08:49:20 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-05-17 08:49:20 (GMT) |
| commit | 2f630e1ce18ad2e07428296532a68b11dc66ad10 (patch) | |
| tree | 9304975238c9ef66124cbb4a43f8b7f006ffd3fe /Misc | |
| parent | b58bc8c2a9a316891a5ea1a0487aebfc86c2793a (diff) | |
| download | cpython-2f630e1ce18ad2e07428296532a68b11dc66ad10.zip cpython-2f630e1ce18ad2e07428296532a68b11dc66ad10.tar.gz cpython-2f630e1ce18ad2e07428296532a68b11dc66ad10.tar.bz2 | |
gh-102153: Start stripping C0 control and space chars in `urlsplit` (#102508)
`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit #25595.
This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/#url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).
---------
Co-authored-by: Gregory P. Smith [Google] <greg@krypto.org>
Diffstat (limited to 'Misc')
| -rw-r--r-- | Misc/NEWS.d/next/Security/2023-03-07-20-59-17.gh-issue-102153.14CLSZ.rst | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/Misc/NEWS.d/next/Security/2023-03-07-20-59-17.gh-issue-102153.14CLSZ.rst b/Misc/NEWS.d/next/Security/2023-03-07-20-59-17.gh-issue-102153.14CLSZ.rst new file mode 100644 index 0000000..e57ac4e --- /dev/null +++ b/Misc/NEWS.d/next/Security/2023-03-07-20-59-17.gh-issue-102153.14CLSZ.rst @@ -0,0 +1,3 @@ +:func:`urllib.parse.urlsplit` now strips leading C0 control and space +characters following the specification for URLs defined by WHATWG in +response to CVE-2023-24329. Patch by Illia Volochii. |