summaryrefslogtreecommitdiffstats
path: root/Lib/urllib/parse.py
Commit message (Collapse)AuthorAgeFilesLines
* [3.9] gh-102153: Start stripping C0 control and space chars in `urlsplit` ↵Miss Islington (bot)2023-05-221-0/+12
| | | | | | | | | | | | | | | | | | | | | (GH-102508) (GH-104575) (GH-104592) (#104593) gh-102153: Start stripping C0 control and space chars in `urlsplit` (GH-102508) `urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit GH-25595. This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329). I simplified the docs by eliding the state of the world explanatory paragraph in this security release only backport. (people will see that in the mainline /3/ docs) (cherry picked from commit 2f630e1ce18ad2e07428296532a68b11dc66ad10) (cherry picked from commit 610cc0ab1b760b2abaac92bd256b96191c46b941) (cherry picked from commit f48a96a28012d28ae37a2f4587a780a5eb779946) Co-authored-by: Illia Volochii <illia.volochii@gmail.com> Co-authored-by: Gregory P. Smith [Google] <greg@krypto.org>
* [3.9] bpo-43882 Remove the newline, and tab early. From query and fragments. ↵Senthil Kumaran2021-05-031-3/+5
| | | | | (#25853) * Remove the newline, and tab early. From query and fragments.
* [3.9] bpo-43882 - urllib.parse should sanitize urls containing ASCII newline ↵Miss Islington (bot)2021-04-291-0/+6
| | | | | | | | | | and tabs. (GH-25595) (GH-25725) * bpo-43882 - urllib.parse should sanitize urls containing ASCII newline and tabs. (GH-25595) Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> (cherry picked from commit 76cd81d60310d65d01f9d7b48a8985d8ab89c8b4) Co-authored-by: Senthil Kumaran <skumaran@gatech.edu>
* bpo-42967: coerce bytes separator to string in urllib.parse_qs(l) (GH-24818)Miss Islington (bot)2021-04-111-0/+1
| | | | | | | | | | * coerce bytes separator to string * Add news * Update Misc/NEWS.d/next/Library/2021-03-11-00-31-41.bpo-42967.2PeQRw.rst (cherry picked from commit b38601d49675d90e1ee6faa47f7adaeca992d02d) Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
* [3.9] bpo-42967: only use '&' as a query string separator (GH-24297) (#24528)Senthil Kumaran2021-02-151-5/+14
| | | | | | | | | | | | | (cherry picked from commit fcbe0cb04d35189401c0c880ebfb4311e952d776) * [3.9] bpo-42967: only use '&' as a query string separator (GH-24297) bpo-42967: [security] Address a web cache-poisoning issue reported in urllib.parse.parse_qsl(). urllib.parse will only us "&" as query string separator by default instead of both ";" and "&" as allowed in earlier versions. An optional argument seperator with default value "&" is added to specify the separator. Co-authored-by: Éric Araujo <merwok@netwok.org> Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com> Co-authored-by: Adam Goldschmidt <adamgold7@gmail.com>
* bpo-39481: PEP 585 for a variety of modules (GH-19423)Batuhan Taşkaya2020-04-101-0/+3
| | | | | | | | | | - concurrent.futures - ctypes - http.cookies - multiprocessing - queue - tempfile - unittest.case - urllib.parse
* bpo-37970: update and improve urlparse and urlsplit doc-strings (GH-16458)idomic2020-02-161-6/+35
|
* bpo-39057: Fix urllib.request.proxy_bypass_environment(). (GH-17619)Serhiy Storchaka2020-01-051-2/+2
| | | Ignore leading dots and no longer ignore a trailing newline.
* bpo-27657: Fix urlparse() with numeric paths (#661)Tim Graham2019-10-181-21/+1
| | | | | | | | | | * bpo-27657: Fix urlparse() with numeric paths Revert parsing decision from bpo-754016 in favor of the documented consensus in bpo-16932 of how to treat strings without a // to designate the netloc. * bpo-22891: Remove urlsplit() optimization for 'http' prefixed inputs.
* bpo-32498: urllib.parse.unquote also accepts bytes (GH-7768)Stein Karlsen2019-10-141-0/+2
|
* bpo-36742: Corrects fix to handle decomposition in usernames (#13812)Steve Dower2019-06-041-3/+3
|
* bpo-35397: Remove deprecation and document urllib.parse.unwrap (GH-11481)Rémi Lapeyre2019-05-271-7/+5
|
* bpo-36742: Fixes handling of pre-normalization characters in urlsplit() ↵Steve Dower2019-04-301-4/+7
| | | | (GH-13017)
* bpo-12910: update and correct quote docstring (#2568)Jörn Hees2019-04-101-13/+20
| | | | | | Fixes some mistakes and misleadings in the quote function docstring: - reserved chars are never actually used by quote code, unreserved chars are - reserved chars were wrong and incomplete - mentioned that use-case is not minimal quoting wrt. RFC, but cautious quoting
* bpo-36216: Add check for characters in netloc that normalize to separators ↵Steve Dower2019-03-071-0/+17
| | | | (GH-12201)
* bpo-34866: Adding max_num_fields to cgi.FieldStorage (GH-9660)matthewbelisle-wf2018-10-191-3/+19
| | | | Adding `max_num_fields` to `cgi.FieldStorage` to make DOS attacks harder by limiting the number of `MiniFieldStorage` objects created by `FieldStorage`.
* bpo-27485: Rename and deprecate undocumented functions in urllib.parse (GH-2205)Cheryl Sabella2018-04-251-4/+99
|
* bpo-33034: Improve exception message when cast fails for ↵Matt Eaton2018-03-201-1/+5
| | | | {Parse,Split}Result.port (GH-6078)
* bpo-32323: urllib.parse.urlsplit() must not lowercase() IPv6 scope value (#4867)Коренберг Марк2017-12-211-4/+6
|
* remove a redundant lower in urllib.parse.urlsplit (#3008)Oren Milman2017-09-031-2/+1
|
* urllib: Simplify splithost by calling into urlparse. (#1849)postmasters2017-06-201-1/+1
| | | | | | | | The current regex based splitting produces a wrong result. For example:: http://abc#@def Web browsers parse that URL as ``http://abc/#@def``, that is, the host is ``abc``, the path is ``/``, and the fragment is ``#@def``.
* bpo-29976: urllib.parse clarify '' in scheme values. (GH-984)Senthil Kumaran2017-05-181-11/+19
|
* correct parse_qs and parse_qsl test case descriptions. (#968)Senthil Kumaran2017-04-051-13/+17
| | | * correct parse_qs and parse_qsl test case descriptions.
* bpo-16285: Update urllib quoting to RFC 3986 (#173)Ratnadeep Debnath2017-02-251-3/+6
| | | | | | | | | | * bpo-16285: Update urllib quoting to RFC 3986 urllib.parse.quote is now based on RFC 3986, and hence includes `'~'` in the set of characters that is not escaped by default. Patch by Christian Theune and Ratnadeep Debnath.
* Issue #28992: Use bytes.fromhex().Serhiy Storchaka2016-12-211-1/+1
|
* Issue #25895: Merge from 3.5Berker Peksag2016-09-161-2/+3
|\
| * Issue #25895: Enable WebSocket URL schemes in urllib.parse.urljoinBerker Peksag2016-09-161-2/+3
| | | | | | | | Patch by Gergely Imreh and Markus Holtermann.
* | merge from 3.5Senthil Kumaran2016-01-261-15/+0
|\ \ | |/ | | | | Remove unnecessary test case comment in urllib.parse.py. These are asserted as test cases.
| * Remove unnecessary test case comment in urllib.parse.py. These are asserted ↵Senthil Kumaran2016-01-261-15/+0
| | | | | | | | as test cases.
* | Issue #25822: Add docstrings to the fields of urllib.parse results.Senthil Kumaran2016-01-141-2/+65
| | | | | | | | Patch contributed by Swati Jaiswal.
* | Issue #20059: urllib.parse raises ValueError on all invalid ports.Robert Collins2015-08-091-2/+1
|/ | | | Patch by Martin Panter.
* Issue #13866: add *quote_via* argument to urlencode.R David Murray2015-05-181-14/+15
| | | | | Patch by samwyse, completed by Arnon Yaari, and reviewed by Martin Panter.
* Issue #23703: Fix a regression in urljoin() introduced in 901e4e52b20a.Berker Peksag2015-04-151-2/+1
| | | | Patch by Demian Brecht.
* Issue #23411: Added DefragResult, ParseResult, SplitResult, DefragResultBytes,Serhiy Storchaka2015-04-071-1/+3
| | | | | ParseResultBytes, and SplitResultBytes to urllib.parse.__all__. Patch by Martin Panter.
* Issue #23563: Optimized utility functions in urllib.parse.Serhiy Storchaka2015-03-031-60/+28
|
* Merge: #23040: Clarify treatment of encoding and errors when component is bytes.R David Murray2014-12-251-4/+5
|\
| * #23040: Clarify treatment of encoding and errors when component is bytes.R David Murray2014-12-251-4/+5
| | | | | | | | Patch by Wojtek Ruszczewski.
* | Issue #22278: Fix urljoin problem with relative urls, a regression observedSenthil Kumaran2014-09-221-1/+5
| | | | | | | | | | | | after changes to issue22118 were submitted. Patch contributed by Demian Brecht and reviewed by Antoine Pitrou.
* | Issue #22118: Switch urllib.parse to use RFC 3986 semantics for the ↵Antoine Pitrou2014-08-211-25/+38
| | | | | | | | | | | | resolution of relative URLs, rather than RFCs 1808 and 2396. Patch by Demian Brecht.
* | Issue #22033: Reprs of most Python implemened classes now contain actualSerhiy Storchaka2014-07-251-1/+1
|/ | | | class name instead of hardcoded one.
* Issue #20879: Delay the initialization of encoding and decoding tables forVictor Stinner2014-03-171-2/+7
| | | | | | base32, ascii85 and base85 codecs in the base64 module, and delay the initialization of the unquote_to_bytes() table of the urllib.parse module, to not waste memory if these modules are not used.
* Issue #20270: urllib.urlparse now supports empty ports.Serhiy Storchaka2014-01-181-14/+17
|\
| * Issue #20270: urllib.urlparse now supports empty ports.Serhiy Storchaka2014-01-181-14/+17
| |
* | merge from 3.3Senthil Kumaran2013-09-061-4/+4
|\ \ | |/ | | | | | | Improve urlencode docstring. Patch by Brian Brazil. Closes issue #15350
| * Improve urlencode docstring. Patch by Brian Brazil.Senthil Kumaran2013-09-061-4/+4
| |
* | Remove redundant importsRaymond Hettinger2013-04-071-9/+0
|/
* Issue #1285086: Get rid of the refcounting hack and speed upSerhiy Storchaka2013-03-141-36/+27
| | | | urllib.parse.unquote() and urllib.parse.unquote_to_bytes().
* Fix issue16713 - tel url parsing with paramsSenthil Kumaran2012-12-241-1/+1
|
* Closes #9374: add back now-unused module attributes; removing them is a ↵Georg Brandl2012-08-241-0/+10
| | | | backward compatibility issue, since they have a public-seeming name.
* urllib.parse cleanup. rename keywords used as variablesSenthil Kumaran2012-06-291-7/+7
|
generated by cgit v0.12 at 2025-09-12 01:22:30 (GMT)