| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
|
|
|
| |
(GH-22762)
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The AbstractBasicAuthHandler class of the urllib.request module uses
an inefficient regular expression which can be exploited by an
attacker to cause a denial of service. Fix the regex to prevent the
catastrophic backtracking. Vulnerability reported by Ben Caller
and Matt Schwager.
AbstractBasicAuthHandler of urllib.request now parses all
WWW-Authenticate HTTP headers and accepts multiple challenges per
header: use the realm of the first Basic challenge.
Co-Authored-By: Serhiy Storchaka <storchaka@gmail.com>
|
|
|
|
|
|
|
|
|
| |
parsing of URLs (GH-15522)" (GH-16724)
This reverts commit 87bd2071c756188b6cd577889fb1682831142ceb.
https://bugs.python.org/issue38449
|
| |
|
|
|
|
|
| |
(GH-15522)
https://bugs.python.org/issue22347
|
| |
|
|
|
|
|
|
|
|
| |
urllib.request tests now call urlcleanup() to remove temporary files
created by urlretrieve() tests and to clear the _opener global
variable set by urlopen() and functions calling indirectly urlopen().
regrtest now checks if urllib.request._url_tempfiles and
urllib.request._opener are changed by tests.
|
| |
|
| |
|
|
|
| |
Also uncomment and fix a path test.
|
|
|
|
| |
urllib.request module. (#918)
|
| |
|
|
|
|
|
|
|
| |
The previous attempt to determine the file’s Content-Length gave a false
positive for pipes on Windows.
Also, drop the special case for sending zero-length iterable bodies.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
When the body object is a file, its size is no longer determined with
fstat(), since that can report the wrong result (e.g. reading from a pipe).
Instead, determine the size using seek(), or fall back to chunked encoding
for unseekable files.
Also, change the logic for detecting text files to check for TextIOBase
inheritance, rather than inspecting the “mode” attribute, which may not
exist (e.g. BytesIO and StringIO). The Content-Length for text files is no
longer determined ahead of time, because the original logic could have been
wrong depending on the codec and newline translation settings.
Patch by Demian Brecht and Rolf Krahl, with a few tweaks by me.
|
|
|
|
|
|
|
|
|
| |
Some servers send Location header fields with non-ASCII bytes, but "http.
client" requires the request target to be ASCII-encodable, otherwise a
UnicodeEncodeError is raised. Based on patch by Christian Heimes.
Python 2 does not suffer any problem because it allows non-ASCII bytes in the
HTTP request target.
|
| |
|
|
|
|
| |
Patch contributed by Chi Hsuan Yen.
|
|
|
|
|
|
|
|
| |
AbstractDigestAuthHandler.get_algorithm_impls
Raise ValueError if algorithm is not MD5 or SHA.
Initial patch by Mathieu Dupuy.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This fix is a superset of the functionality introduced by the issue #19494
enhancement, and supersedes that fix. Instead of a new handler, we have a new
password manager that tracks whether we should send the auth for a given uri.
This allows us to say "always send", satisfying #19494, or track that we've
succeeded in auth and send the creds right away on every *subsequent* request.
The support for using the password manager is added to AbstractBasicAuth,
which means the proxy handler also now can handle prior auth if passed
the new password manager.
Patch by Akshit Khurana, docs mostly by me.
|
|\
| |
| |
| |
| | |
Also, remove support.run_doctest() since there is no doctests in
test_urllib2 and urllib.request.
|
| |
| |
| |
| |
| | |
Also, remove support.run_doctest() since there is no doctests in
test_urllib2 and urllib.request.
|
|\ \
| |/
| |
| | |
directory containing a backslash.
|
| |
| |
| |
| | |
directory containing a backslash.
|
|/
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This auth handler adds the Authorization header to the first
HTTP request rather than waiting for a HTTP 401 Unauthorized
response from the server as the default HTTPBasicAuthHandler
does.
This allows working with websites like https://api.github.com which do
not follow the strict interpretation of RFC, but more the dicta in the
end of section 2 of RFC 2617:
> A client MAY preemptively send the corresponding Authorization
> header with requests for resources in that space without receipt
> of another challenge from the server. Similarly, when a client
> sends a request to a proxy, it may reuse a userid and password in
> the Proxy-Authorization header field without receiving another
> challenge from the proxy server. See section 4 for security
> considerations associated with Basic authentication.
Patch by Matej Cepl.
|
|
|
|
| |
response is received. Patch by Martin Panter.
|
| |
|
| |
|
|
|
|
| |
failures when ssl is not present.
|
|
|
|
|
| |
68335b8afb1f 3.4
ad0c75b7bd7d default
|
| |
|
|\ |
|
| |
| |
| |
| |
| |
| |
| | |
Discovery and patch by Wenzhu Man. University of Waterloo apparently
maps the local name 'test' to localhost, which is in the bypass list,
causing the test to fail. So change 'test' to a name unlikely to get
mapped to localhost.
|
|\ \
| |/
| |
| | |
tests.
|
| |
| |
| |
| | |
tests.
|
| | |
|
| | |
|
| | |
|
| |
| |
| |
| | |
overrides.
|
| |
| |
| |
| |
| |
| | |
result under all circumstances.
Document the change of Request.full_url to a property.
|
| |
| |
| |
| | |
bugs with assignment to full_url. Patch by Demian Brecht.
|
| |
| |
| |
| | |
expansion.
|
| |
| |
| |
| | |
This is a follow on to issue 16464. Original patch by Daniel Wozniak.
|
|\ \
| |/ |
|
| |\ |
|
| | |
| | |
| | |
| | | |
Based on patch contributed by Daniel Wozniak
|
|\ \ \
| |/ / |
|