From 6a2a6c2ee37dad75134c212d43e48702f1b219a9 Mon Sep 17 00:00:00 2001 From: Senthil Kumaran Date: Tue, 15 May 2012 22:24:10 +0800 Subject: Issue #12541: Be lenient with quotes around Realm field with HTTP Basic Authentation in urllib2. --- Lib/test/test_urllib2.py | 16 ++++++++++++++++ Lib/urllib2.py | 2 +- Misc/NEWS | 3 +++ 3 files changed, 20 insertions(+), 1 deletion(-) diff --git a/Lib/test/test_urllib2.py b/Lib/test/test_urllib2.py index 7f230e2..ad558da 100644 --- a/Lib/test/test_urllib2.py +++ b/Lib/test/test_urllib2.py @@ -1112,6 +1112,22 @@ class HandlerTests(unittest.TestCase): def test_basic_auth_with_single_quoted_realm(self): self.test_basic_auth(quote_char="'") + def test_basic_auth_with_unquoted_realm(self): + opener = OpenerDirector() + password_manager = MockPasswordManager() + auth_handler = urllib2.HTTPBasicAuthHandler(password_manager) + realm = "ACME Widget Store" + http_handler = MockHTTPHandler( + 401, 'WWW-Authenticate: Basic realm=%s\r\n\r\n' % realm) + opener.add_handler(auth_handler) + opener.add_handler(http_handler) + self._test_basic_auth(opener, auth_handler, "Authorization", + realm, http_handler, password_manager, + "http://acme.example.com/protected", + "http://acme.example.com/protected", + ) + + def test_proxy_basic_auth(self): opener = OpenerDirector() ph = urllib2.ProxyHandler(dict(http="proxy.example.com:3128")) diff --git a/Lib/urllib2.py b/Lib/urllib2.py index 5471acd..21b5262 100644 --- a/Lib/urllib2.py +++ b/Lib/urllib2.py @@ -828,7 +828,7 @@ class AbstractBasicAuthHandler: # allow for double- and single-quoted realm values # (single quotes are a violation of the RFC, but appear in the wild) rx = re.compile('(?:.*,)*[ \t]*([^ \t]+)[ \t]+' - 'realm=(["\'])(.*?)\\2', re.I) + 'realm=(["\']?)([^"\']*)\\2', re.I) # XXX could pre-emptively send auth info already accepted (RFC 2617, # end of section 2, and section 1.2 immediately after "credentials" diff --git a/Misc/NEWS b/Misc/NEWS index 6b44b44..2ab141b 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -60,6 +60,9 @@ Core and Builtins Library ------- +- Issue #12541: Be lenient with quotes around Realm field with HTTP Basic + Authentation in urllib2. + - Issue #14662: Prevent shutil failures on OS X when destination does not support chflag operations. Patch by Hynek Schlawack. -- cgit v0.12