summaryrefslogtreecommitdiffstats
path: root/Lib/urllib/request.py
Commit message (Collapse)AuthorAgeFilesLines
* bpo-39503: CVE-2020-8492: Fix AbstractBasicAuthHandler (GH-18284) (GH-19297)Miss Islington (bot)2020-04-021-19/+50
| | | | | | | | | | | | | | | | The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient regular expression which can be exploited by an attacker to cause a denial of service. Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben Caller and Matt Schwager. AbstractBasicAuthHandler of urllib.request now parses all WWW-Authenticate HTTP headers and accepts multiple challenges per header: use the realm of the first Basic challenge. Co-Authored-By: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Victor Stinner <vstinner@python.org> (cherry picked from commit 0b297d4ff1c0e4480ad33acae793fbaf4bf015b4)
* bpo-39548: Fix handling of 'WWW-Authenticate' header for Digest Auth (GH-18338)Miss Islington (bot)2020-02-291-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | * bpo-39548: Fix handling of 'WWW-Authenticate' header for Digest authentication - The 'qop' value in the 'WWW-Authenticate' header is optional. The presence of 'qop' in the header should be checked before its value is parsed with 'split'. Signed-off-by: Stephen Balousek <stephen@balousek.net> * bpo-39548: Fix handling of 'WWW-Authenticate' header for Digest authentication - Add NEWS item Signed-off-by: Stephen Balousek <stephen@balousek.net> * Update Misc/NEWS.d/next/Library/2020-02-06-05-33-52.bpo-39548.DF4FFe.rst Co-Authored-By: Brandt Bucher <brandtbucher@gmail.com> Co-authored-by: Brandt Bucher <brandtbucher@gmail.com> (cherry picked from commit 5e260e0fde211829fcb67060cfd602f4b679f802) Co-authored-by: Stephen Balousek <sbalousek@users.noreply.github.com>
* bpo-39057: Fix urllib.request.proxy_bypass_environment(). (GH-17619)Miss Islington (bot)2020-01-051-11/+13
| | | | | | Ignore leading dots and no longer ignore a trailing newline. (cherry picked from commit 6a265f0d0c0a4b3b8fecf4275d49187a384167f4) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
* bpo-38686: fix HTTP Digest handling in request.py (GH-17045)Miss Islington (bot)2019-11-221-2/+4
| | | | | | | | | | | | | | | | | | | | | | | * fix HTTP Digest handling in request.py There is a bug triggered when server replies to a request with `WWW-Authenticate: Digest` where `qop="auth,auth-int"` rather than mere `qop="auth"`. Having both `auth` and `auth-int` is legitimate according to the `qop-options` rule in §3.2.1 of [[https://www.ietf.org/rfc/rfc2617.txt|RFC 2617]]: > qop-options = "qop" "=" <"> 1GH-qop-value <"> > qop-value = "auth" | "auth-int" | token > **qop-options**: [...] If present, it is a quoted string **of one or more** tokens indicating the "quality of protection" values supported by the server. The value `"auth"` indicates authentication; the value `"auth-int"` indicates authentication with integrity protection This is description confirmed by the definition of the [//n//]`GH-`[//m//]//rule// extended-BNF pattern defined in §2.1 of [[https://www.ietf.org/rfc/rfc2616.txt|RFC 2616]] as 'a comma-separated list of //rule// with at least //n// and at most //m// items'. When this reply is parsed by `get_authorization`, request.py only tests for identity with `'auth'`, failing to recognize it as one of the supported modes the server announced, and claims that `"qop 'auth,auth-int' is not supported"`. * 📜🤖 Added by blurb_it. * bpo-38686 review fix: remember why. * fix trailing space in Lib/urllib/request.py Co-Authored-By: Brandt Bucher <brandtbucher@gmail.com> (cherry picked from commit 14a89c47983f2fb9e7fdf33c769e622eefd3a14a) Co-authored-by: PypeBros <PypeBros@users.noreply.github.com>
* bpo-35907, CVE-2019-9948: urllib rejects local_file:// scheme (GH-13474) ↵Victor Stinner2019-05-221-1/+1
| | | | | | | | | | (GH-13505) CVE-2019-9948: Avoid file reading as disallowing the unnecessary URL scheme in URLopener().open() and URLopener().retrieve() of urllib.request. Co-Authored-By: SH <push0ebp@gmail.com> (cherry picked from commit 0c2b6a3943aa7b022e8eb4bfd9bffcddebf9a587)
* closes bpo-35309: cpath should be capath (GH-10701)Miss Islington (bot)2018-11-251-1/+1
| | | | | (cherry picked from commit 158695817d736df8b18682866033c87e46252309) Co-authored-by: Boštjan Mejak <bostjan.xperia@gmail.com>
* Revert unneccessary changes made in bpo-30296 and apply other improvements. ↵Miss Islington (bot)2018-02-261-1/+2
| | | | | | | (GH-2624) (cherry picked from commit 3f2e6f15d64d81633b1fc0b308afc0d6e9026b61) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
* urllib.request: Remove unused import (GH-5268)INADA Naoki2018-01-221-1/+0
|
* bpo-30296 Remove unnecessary tuples, lists, sets, and dicts (#1489)Jon Dufresne2017-05-181-6/+5
| | | | | | | | * Replaced list(<generator expression>) with list comprehension * Replaced dict(<generator expression>) with dict comprehension * Replaced set(<list literal>) with set literal * Replaced builtin func(<list comprehension>) with func(<generator expression>) when supported (e.g. any(), all(), tuple(), min(), & max())
* Remove OSError related comment in urllib.request. (#1070)Senthil Kumaran2017-04-101-1/+0
|
* Remove invalid comment in urllib.request. (#1054)Senthil Kumaran2017-04-091-6/+2
|
* Issue #29142: Merge 3.6.Xiang Zhang2017-01-091-0/+1
|\
| * Issue #29142: Merge 3.5.Xiang Zhang2017-01-091-0/+1
| |\
| | * Issue #29142: Fix suffixes in no_proxy handling in urllib.Xiang Zhang2017-01-091-0/+1
| | | | | | | | | | | | | | | | | | In urllib.request, suffixes in no_proxy environment variable with leading dots could match related hostnames again (e.g. .b.c matches a.b.c). Patch by Milan Oberkirch.
| | * Issue #22450: Use "Accept: */*" in the default headers for urllib.requestRaymond Hettinger2016-09-091-1/+1
| | |
* | | Remove unused imports.Serhiy Storchaka2016-12-161-1/+0
|/ /
* | Issue #28022: Deprecate ssl-related arguments in favor of SSLContext.Christian Heimes2016-09-101-0/+3
| | | | | | | | | | | | | | The deprecation include manual creation of SSLSocket and certfile/keyfile (or similar) in ftplib, httplib, imaplib, smtplib, poplib and urllib. ssl.wrap_socket() is not marked as deprecated yet.
* | MergeRaymond Hettinger2016-09-091-1/+1
| |
* | Issue #12319: Support for chunked encoding of HTTP request bodiesMartin Panter2016-08-241-23/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the body object is a file, its size is no longer determined with fstat(), since that can report the wrong result (e.g. reading from a pipe). Instead, determine the size using seek(), or fall back to chunked encoding for unseekable files. Also, change the logic for detecting text files to check for TextIOBase inheritance, rather than inspecting the “mode” attribute, which may not exist (e.g. BytesIO and StringIO). The Content-Length for text files is no longer determined ahead of time, because the original logic could have been wrong depending on the codec and newline translation settings. Patch by Demian Brecht and Rolf Krahl, with a few tweaks by me.
* | [merge from 3.5] - Prevent HTTPoxy attack (CVE-2016-1000110)Senthil Kumaran2016-07-311-0/+6
|\ \ | |/ | | | | | | | | | | Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which indicates that the script is in CGI mode. Issue #27568 Reported and patch contributed by Rémi Rampin.
| * [merge from 3.4] - Prevent HTTPoxy attack (CVE-2016-1000110)Senthil Kumaran2016-07-311-0/+6
| |\ | | | | | | | | | | | | | | | | | | Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which indicates that the script is in CGI mode. Issue #27568 Reported and patch contributed by Rémi Rampin.
| | * [merge from 3.3] Prevent HTTPoxy attack (CVE-2016-1000110)Senthil Kumaran2016-07-311-0/+7
| | |\ | | | | | | | | | | | | | | | | | | | | | | | | Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which indicates that the script is in CGI mode. Issue #27568 Reported and patch contributed by Rémi Rampin.
| | | * Prevent HTTPoxy attack (CVE-2016-1000110)Senthil Kumaran2016-07-311-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which indicates that the script is in CGI mode. Issue #27568 Reported and patch contributed by Rémi Rampin.
| | | * Backporing the fix from Issue #12692Senthil Kumaran2013-12-291-0/+6
| | | |
* | | | Issue #22797: Synchronize urlopen() doc string with RST documentationMartin Panter2016-06-041-6/+11
| | | |
* | | | More typo fixes for 3.6Martin Panter2016-06-041-1/+1
| | | |
* | | | Clean up urlopen doc string.R David Murray2016-06-041-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | Clarifies what is returned when and that the methods are common between the two. Patch by Alexander Liu as part of #22797.
* | | | Issue #14132, Issue #17214: Merge two redirect handling fixes from 3.5Martin Panter2016-05-161-2/+12
|\ \ \ \ | |/ / /
| * | | Issue #17214: Percent-encode non-ASCII bytes in redirect targetsMartin Panter2016-05-161-1/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some servers send Location header fields with non-ASCII bytes, but "http. client" requires the request target to be ASCII-encodable, otherwise a UnicodeEncodeError is raised. Based on patch by Christian Heimes. Python 2 does not suffer any problem because it allows non-ASCII bytes in the HTTP request target.
| * | | Issue #14132: Fix redirect handling when target is just a query stringMartin Panter2016-05-161-1/+1
| | | |
* | | | merge from 3.5Senthil Kumaran2016-05-131-0/+1
|\ \ \ \ | |/ / / | | | | | | | | | | | | | | | | Issue #26892: Honor debuglevel flag in urllib.request.HTTPHandler. Patch contributed by Chi Hsuan Yen.
| * | | Issue #26892: Honor debuglevel flag in urllib.request.HTTPHandler.Senthil Kumaran2016-05-131-0/+1
| | | | | | | | | | | | | | | | Patch contributed by Chi Hsuan Yen.
* | | | Issue #26864: Merge no_proxy fixes from 3.5Martin Panter2016-04-301-2/+6
|\ \ \ \ | |/ / /
| * | | Issue #26864: Fix case insensitivity and suffix comparison with no_proxyMartin Panter2016-04-301-2/+6
| | | | | | | | | | | | | | | | Patch by Xiang Zhang.
* | | | merge 3.5Senthil Kumaran2016-04-251-10/+34
|\ \ \ \ | |/ / / | | | | | | | | | | | | | | | | | | | | Issue #26804: urllib.request will prefer lower_case proxy environment variables over UPPER_CASE or Mixed_Case ones. Patch contributed by Hans-Peter Jansen. Reviewed by Martin Panter and Senthil Kumaran.
| * | | Issue #26804: urllib.request will prefer lower_case proxy environment variablesSenthil Kumaran2016-04-251-10/+34
| | | | | | | | | | | | | | | | | | | | | | | | over UPPER_CASE or Mixed_Case ones. Patch contributed by Hans-Peter Jansen. Reviewed by Martin Panter and Senthil Kumaran.
* | | | Issue #2202: Fix UnboundLocalError in ↵Berker Peksag2016-03-061-0/+3
|\ \ \ \ | |/ / / | | | | | | | | | | | | | | | | | | | | | | | | AbstractDigestAuthHandler.get_algorithm_impls Raise ValueError if algorithm is not MD5 or SHA. Initial patch by Mathieu Dupuy.
| * | | Issue #2202: Fix UnboundLocalError in ↵Berker Peksag2016-03-061-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | AbstractDigestAuthHandler.get_algorithm_impls Raise ValueError if algorithm is not MD5 or SHA. Initial patch by Mathieu Dupuy.
* | | | Issue #25985: sys.version_info is now used instead of sys.versionSerhiy Storchaka2016-02-111-1/+1
| | | | | | | | | | | | | | | | to format short Python version.
* | | | Issue #12923: Merge FancyURLopener fix from 3.5Martin Panter2016-02-061-11/+13
|\ \ \ \ | |/ / /
| * | | Issue #12923: Reset FancyURLopener's redirect counter even on exceptionMartin Panter2016-02-041-11/+13
| | | | | | | | | | | | | | | | Based on patches by Brian Brazil and Daniel Rocco.
* | | | Issue #25899: Converted non-ASCII characters in docstrings and manpageSerhiy Storchaka2015-12-181-3/+3
|\ \ \ \ | |/ / / | | | | | | | | | | | | to ASCII replacements. Removed UTF-8 BOM from Misc/NEWS. Original patch by Chris Angelico.
* | | | Issue #25576: Apply fix to new urlopen() doc stringMartin Panter2015-11-241-7/+2
| | | |
* | | | Add missing docstringRaymond Hettinger2015-08-181-0/+65
|/ / /
* | | Issue #24021: docstring for urllib.urlcleanup.Robert Collins2015-08-041-0/+1
|\ \ \ | |/ / | | | | | | Patch from Daniel Andrade Groppe and Peter Lovett
| * | Issue #24021: docstring for urllib.urlcleanup.Robert Collins2015-08-041-0/+1
| | | | | | | | | | | | Patch from Daniel Andrade Groppe and Peter Lovett
* | | #7159: generalize urllib prior auth support.R David Murray2015-04-161-18/+60
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fix is a superset of the functionality introduced by the issue #19494 enhancement, and supersedes that fix. Instead of a new handler, we have a new password manager that tracks whether we should send the auth for a given uri. This allows us to say "always send", satisfying #19494, or track that we've succeeded in auth and send the creds right away on every *subsequent* request. The support for using the password manager is added to AbstractBasicAuth, which means the proxy handler also now can handle prior auth if passed the new password manager. Patch by Akshit Khurana, docs mostly by me.
* | | (Merge 3.4) Issue #23881: urllib.request.ftpwrapper constructor now closes theVictor Stinner2015-04-071-1/+5
|\ \ \ | |/ / | | | | | | socket if the FTP connection failed to fix a ResourceWarning.
| * | Issue #23881: urllib.request.ftpwrapper constructor now closes the socket ifVictor Stinner2015-04-071-1/+5
| | | | | | | | | | | | the FTP connection failed to fix a ResourceWarning.
* | | merge 3.4Benjamin Peterson2014-12-071-2/+2
|\ \ \ | |/ /
generated by cgit v0.12 at 2026-01-10 20:29:48 (GMT)