summaryrefslogtreecommitdiffstats
path: root/Lib/urllib/request.py
Commit message (Collapse)AuthorAgeFilesLines
* Update URLs in comments and metadata to use HTTPS (GH-27458) (GH-27478)Miss Islington (bot)2021-07-301-1/+1
| | | | | (cherry picked from commit be42c06bb01206209430f3ac08b72643dc7cad1c) Co-authored-by: Noah Kantrowitz <noah@coderanger.net>
* bpo-43075: Fix ReDoS in urllib AbstractBasicAuthHandler (GH-24391)Yeting Li2021-04-071-1/+1
| | | | | | | Fix Regular Expression Denial of Service (ReDoS) vulnerability in urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable regex has quadratic worst-case complexity and it allows cause a denial of service when identifying crafted invalid RFCs. This ReDoS issue is on the client side and needs remote attackers to control the HTTP server.
* Allow / character in username,password fields in _PROXY envvars. (#23973)Senthil Kumaran2020-12-291-1/+5
|
* bpo-40968: Send http/1.1 ALPN extension (#20959)Christian Heimes2020-11-131-0/+2
| | | Signed-off-by: Christian Heimes <christian@python.org>
* bpo-41471: Ignore invalid prefix lengths in system proxy settings on macOS ↵Ronald Oussoren2020-10-191-0/+5
| | | | (GH-22762)
* bpo-39503: CVE-2020-8492: Fix AbstractBasicAuthHandler (GH-18284)Victor Stinner2020-04-021-19/+50
| | | | | | | | | | | | | The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient regular expression which can be exploited by an attacker to cause a denial of service. Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben Caller and Matt Schwager. AbstractBasicAuthHandler of urllib.request now parses all WWW-Authenticate HTTP headers and accepts multiple challenges per header: use the realm of the first Basic challenge. Co-Authored-By: Serhiy Storchaka <storchaka@gmail.com>
* bpo-39548: Fix handling of 'WWW-Authenticate' header for Digest Auth (GH-18338)Stephen Balousek2020-02-291-3/+3
| | | | | | | | | | | | | | | | | | | | | | * bpo-39548: Fix handling of 'WWW-Authenticate' header for Digest authentication - The 'qop' value in the 'WWW-Authenticate' header is optional. The presence of 'qop' in the header should be checked before its value is parsed with 'split'. Signed-off-by: Stephen Balousek <stephen@balousek.net> * bpo-39548: Fix handling of 'WWW-Authenticate' header for Digest authentication - Add NEWS item Signed-off-by: Stephen Balousek <stephen@balousek.net> * Update Misc/NEWS.d/next/Library/2020-02-06-05-33-52.bpo-39548.DF4FFe.rst Co-Authored-By: Brandt Bucher <brandtbucher@gmail.com> Co-authored-by: Brandt Bucher <brandtbucher@gmail.com>
* bpo-39057: Fix urllib.request.proxy_bypass_environment(). (GH-17619)Serhiy Storchaka2020-01-051-11/+13
| | | Ignore leading dots and no longer ignore a trailing newline.
* bpo-38686: fix HTTP Digest handling in request.py (#17045)PypeBros2019-11-221-2/+4
| | | | | | | | | | | | | | | | | | | | | * fix HTTP Digest handling in request.py There is a bug triggered when server replies to a request with `WWW-Authenticate: Digest` where `qop="auth,auth-int"` rather than mere `qop="auth"`. Having both `auth` and `auth-int` is legitimate according to the `qop-options` rule in §3.2.1 of [[https://www.ietf.org/rfc/rfc2617.txt|RFC 2617]]: > qop-options = "qop" "=" <"> 1#qop-value <"> > qop-value = "auth" | "auth-int" | token > **qop-options**: [...] If present, it is a quoted string **of one or more** tokens indicating the "quality of protection" values supported by the server. The value `"auth"` indicates authentication; the value `"auth-int"` indicates authentication with integrity protection This is description confirmed by the definition of the [//n//]`#`[//m//]//rule// extended-BNF pattern defined in §2.1 of [[https://www.ietf.org/rfc/rfc2616.txt|RFC 2616]] as 'a comma-separated list of //rule// with at least //n// and at most //m// items'. When this reply is parsed by `get_authorization`, request.py only tests for identity with `'auth'`, failing to recognize it as one of the supported modes the server announced, and claims that `"qop 'auth,auth-int' is not supported"`. * 📜🤖 Added by blurb_it. * bpo-38686 review fix: remember why. * fix trailing space in Lib/urllib/request.py Co-Authored-By: Brandt Bucher <brandtbucher@gmail.com>
* Remove binding of captured exceptions when not used to reduce the chances of ↵Pablo Galindo2019-11-191-1/+1
| | | | | | | creating cycles (GH-17246) Capturing exceptions into names can lead to reference cycles though the __traceback__ attribute of the exceptions in some obscure cases that have been reported previously and fixed individually. As these variables are not used anyway, we can remove the binding to reduce the chances of creating reference cycles. See for example GH-13135
* bpo-25068: urllib.request.ProxyHandler now lowercases the dict keys (GH-13489)Zackery Spytz2019-09-131-0/+1
|
* bpo-12707: deprecate info(), geturl(), getcode() methods in favor of ↵Ashwin Ramaswami2019-09-131-11/+3
| | | | | headers, url, and status properties for HTTPResponse and addinfourl (GH-11447) Co-Authored-By: epicfaace <aramaswamis@gmail.com>
* bpo-35397: Remove deprecation and document urllib.parse.unwrap (GH-11481)Rémi Lapeyre2019-05-271-4/+4
|
* bpo-36842: Implement PEP 578 (GH-12613)Steve Dower2019-05-231-0/+1
| | | Adds sys.audit, sys.addaudithook, io.open_code, and associated C APIs.
* bpo-35907, CVE-2019-9948: urllib rejects local_file:// scheme (GH-13474)Victor Stinner2019-05-221-1/+1
| | | | | | | CVE-2019-9948: Avoid file reading as disallowing the unnecessary URL scheme in URLopener().open() and URLopener().retrieve() of urllib.request. Co-Authored-By: SH <push0ebp@gmail.com>
* bpo-36948: Fix NameError in urllib.request.URLopener.retrieve (GH-13389)Xtreak2019-05-191-5/+5
|
* bpo-36431: Use PEP 448 dict unpacking for merging two dicts. (GH-12553)Serhiy Storchaka2019-03-271-2/+1
|
* closes bpo-35309: cpath should be capath (GH-10699)Boštjan Mejak2018-11-251-1/+1
|
* bpo-27485: Rename and deprecate undocumented functions in urllib.parse (GH-2205)Cheryl Sabella2018-04-251-53/+53
|
* Revert unneccessary changes made in bpo-30296 and apply other improvements. ↵Serhiy Storchaka2018-02-261-1/+2
| | | | (GH-2624)
* urllib.request: Remove unused import (GH-5268)INADA Naoki2018-01-221-1/+0
|
* bpo-30296 Remove unnecessary tuples, lists, sets, and dicts (#1489)Jon Dufresne2017-05-181-6/+5
| | | | | | | | * Replaced list(<generator expression>) with list comprehension * Replaced dict(<generator expression>) with dict comprehension * Replaced set(<list literal>) with set literal * Replaced builtin func(<list comprehension>) with func(<generator expression>) when supported (e.g. any(), all(), tuple(), min(), & max())
* Remove OSError related comment in urllib.request. (#1070)Senthil Kumaran2017-04-101-1/+0
|
* Remove invalid comment in urllib.request. (#1054)Senthil Kumaran2017-04-091-6/+2
|
* Issue #29142: Merge 3.6.Xiang Zhang2017-01-091-0/+1
|\
| * Issue #29142: Merge 3.5.Xiang Zhang2017-01-091-0/+1
| |\
| | * Issue #29142: Fix suffixes in no_proxy handling in urllib.Xiang Zhang2017-01-091-0/+1
| | | | | | | | | | | | | | | | | | In urllib.request, suffixes in no_proxy environment variable with leading dots could match related hostnames again (e.g. .b.c matches a.b.c). Patch by Milan Oberkirch.
| | * Issue #22450: Use "Accept: */*" in the default headers for urllib.requestRaymond Hettinger2016-09-091-1/+1
| | |
* | | Remove unused imports.Serhiy Storchaka2016-12-161-1/+0
|/ /
* | Issue #28022: Deprecate ssl-related arguments in favor of SSLContext.Christian Heimes2016-09-101-0/+3
| | | | | | | | | | | | | | The deprecation include manual creation of SSLSocket and certfile/keyfile (or similar) in ftplib, httplib, imaplib, smtplib, poplib and urllib. ssl.wrap_socket() is not marked as deprecated yet.
* | MergeRaymond Hettinger2016-09-091-1/+1
| |
* | Issue #12319: Support for chunked encoding of HTTP request bodiesMartin Panter2016-08-241-23/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the body object is a file, its size is no longer determined with fstat(), since that can report the wrong result (e.g. reading from a pipe). Instead, determine the size using seek(), or fall back to chunked encoding for unseekable files. Also, change the logic for detecting text files to check for TextIOBase inheritance, rather than inspecting the “mode” attribute, which may not exist (e.g. BytesIO and StringIO). The Content-Length for text files is no longer determined ahead of time, because the original logic could have been wrong depending on the codec and newline translation settings. Patch by Demian Brecht and Rolf Krahl, with a few tweaks by me.
* | [merge from 3.5] - Prevent HTTPoxy attack (CVE-2016-1000110)Senthil Kumaran2016-07-311-0/+6
|\ \ | |/ | | | | | | | | | | Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which indicates that the script is in CGI mode. Issue #27568 Reported and patch contributed by Rémi Rampin.
| * [merge from 3.4] - Prevent HTTPoxy attack (CVE-2016-1000110)Senthil Kumaran2016-07-311-0/+6
| |\ | | | | | | | | | | | | | | | | | | Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which indicates that the script is in CGI mode. Issue #27568 Reported and patch contributed by Rémi Rampin.
| | * [merge from 3.3] Prevent HTTPoxy attack (CVE-2016-1000110)Senthil Kumaran2016-07-311-0/+7
| | |\ | | | | | | | | | | | | | | | | | | | | | | | | Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which indicates that the script is in CGI mode. Issue #27568 Reported and patch contributed by Rémi Rampin.
| | | * Prevent HTTPoxy attack (CVE-2016-1000110)Senthil Kumaran2016-07-311-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which indicates that the script is in CGI mode. Issue #27568 Reported and patch contributed by Rémi Rampin.
| | | * Backporing the fix from Issue #12692Senthil Kumaran2013-12-291-0/+6
| | | |
* | | | Issue #22797: Synchronize urlopen() doc string with RST documentationMartin Panter2016-06-041-6/+11
| | | |
* | | | More typo fixes for 3.6Martin Panter2016-06-041-1/+1
| | | |
* | | | Clean up urlopen doc string.R David Murray2016-06-041-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | Clarifies what is returned when and that the methods are common between the two. Patch by Alexander Liu as part of #22797.
* | | | Issue #14132, Issue #17214: Merge two redirect handling fixes from 3.5Martin Panter2016-05-161-2/+12
|\ \ \ \ | |/ / /
| * | | Issue #17214: Percent-encode non-ASCII bytes in redirect targetsMartin Panter2016-05-161-1/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some servers send Location header fields with non-ASCII bytes, but "http. client" requires the request target to be ASCII-encodable, otherwise a UnicodeEncodeError is raised. Based on patch by Christian Heimes. Python 2 does not suffer any problem because it allows non-ASCII bytes in the HTTP request target.
| * | | Issue #14132: Fix redirect handling when target is just a query stringMartin Panter2016-05-161-1/+1
| | | |
* | | | merge from 3.5Senthil Kumaran2016-05-131-0/+1
|\ \ \ \ | |/ / / | | | | | | | | | | | | | | | | Issue #26892: Honor debuglevel flag in urllib.request.HTTPHandler. Patch contributed by Chi Hsuan Yen.
| * | | Issue #26892: Honor debuglevel flag in urllib.request.HTTPHandler.Senthil Kumaran2016-05-131-0/+1
| | | | | | | | | | | | | | | | Patch contributed by Chi Hsuan Yen.
* | | | Issue #26864: Merge no_proxy fixes from 3.5Martin Panter2016-04-301-2/+6
|\ \ \ \ | |/ / /
| * | | Issue #26864: Fix case insensitivity and suffix comparison with no_proxyMartin Panter2016-04-301-2/+6
| | | | | | | | | | | | | | | | Patch by Xiang Zhang.
* | | | merge 3.5Senthil Kumaran2016-04-251-10/+34
|\ \ \ \ | |/ / / | | | | | | | | | | | | | | | | | | | | Issue #26804: urllib.request will prefer lower_case proxy environment variables over UPPER_CASE or Mixed_Case ones. Patch contributed by Hans-Peter Jansen. Reviewed by Martin Panter and Senthil Kumaran.
| * | | Issue #26804: urllib.request will prefer lower_case proxy environment variablesSenthil Kumaran2016-04-251-10/+34
| | | | | | | | | | | | | | | | | | | | | | | | over UPPER_CASE or Mixed_Case ones. Patch contributed by Hans-Peter Jansen. Reviewed by Martin Panter and Senthil Kumaran.
* | | | Issue #2202: Fix UnboundLocalError in ↵Berker Peksag2016-03-061-0/+3
|\ \ \ \ | |/ / / | | | | | | | | | | | | | | | | | | | | | | | | AbstractDigestAuthHandler.get_algorithm_impls Raise ValueError if algorithm is not MD5 or SHA. Initial patch by Mathieu Dupuy.
generated by cgit v0.12 at 2025-04-07 15:20:43 (GMT)