From b7378d77289c911ca6a0c0afaf513879002df7d5 Mon Sep 17 00:00:00 2001 From: "Gregory P. Smith" Date: Wed, 1 May 2019 16:39:21 -0400 Subject: bpo-30458: Use InvalidURL instead of ValueError. (GH-13044) Use http.client.InvalidURL instead of ValueError as the new error case's exception. --- Lib/http/client.py | 2 +- Lib/test/test_urllib.py | 10 ++++++---- .../next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst | 1 + .../next/Security/2019-04-10-08-53-30.bpo-36276.51E-DA.rst | 1 - 4 files changed, 8 insertions(+), 6 deletions(-) create mode 100644 Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst delete mode 100644 Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-36276.51E-DA.rst diff --git a/Lib/http/client.py b/Lib/http/client.py index 99d6a68..f71a062 100644 --- a/Lib/http/client.py +++ b/Lib/http/client.py @@ -1091,7 +1091,7 @@ class HTTPConnection: url = '/' # Prevent CVE-2019-9740. if match := _contains_disallowed_url_pchar_re.search(url): - raise ValueError(f"URL can't contain control characters. {url!r} " + raise InvalidURL(f"URL can't contain control characters. {url!r} " f"(found at least {match.group()!r})") request = '%s %s %s' % (method, url, self._http_vsn_str) diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py index c5b23f9..7214492 100644 --- a/Lib/test/test_urllib.py +++ b/Lib/test/test_urllib.py @@ -343,11 +343,12 @@ class urlopen_HttpTests(unittest.TestCase, FakeHTTPMixin, FakeFTPMixin): # calls urllib.parse.quote() on the URL which makes all of the # above attempts at injection within the url _path_ safe. escaped_char_repr = repr(char).replace('\\', r'\\') + InvalidURL = http.client.InvalidURL with self.assertRaisesRegex( - ValueError, f"contain control.*{escaped_char_repr}"): + InvalidURL, f"contain control.*{escaped_char_repr}"): urllib.request.urlopen(f"http:{schemeless_url}") with self.assertRaisesRegex( - ValueError, f"contain control.*{escaped_char_repr}"): + InvalidURL, f"contain control.*{escaped_char_repr}"): urllib.request.urlopen(f"https:{schemeless_url}") # This code path quotes the URL so there is no injection. resp = urlopen(f"http:{schemeless_url}") @@ -367,10 +368,11 @@ class urlopen_HttpTests(unittest.TestCase, FakeHTTPMixin, FakeFTPMixin): # urlopen uses FancyURLOpener which goes via a codepath that # calls urllib.parse.quote() on the URL which makes all of the # above attempts at injection within the url _path_ safe. + InvalidURL = http.client.InvalidURL with self.assertRaisesRegex( - ValueError, r"contain control.*\\r.*(found at least . .)"): + InvalidURL, r"contain control.*\\r.*(found at least . .)"): urllib.request.urlopen(f"http:{schemeless_url}") - with self.assertRaisesRegex(ValueError, r"contain control.*\\n"): + with self.assertRaisesRegex(InvalidURL, r"contain control.*\\n"): urllib.request.urlopen(f"https:{schemeless_url}") # This code path quotes the URL so there is no injection. resp = urlopen(f"http:{schemeless_url}") diff --git a/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst b/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst new file mode 100644 index 0000000..ed8027f --- /dev/null +++ b/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst @@ -0,0 +1 @@ +Address CVE-2019-9740 by disallowing URL paths with embedded whitespace or control characters through into the underlying http client request. Such potentially malicious header injection URLs now cause an http.client.InvalidURL exception to be raised. diff --git a/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-36276.51E-DA.rst b/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-36276.51E-DA.rst deleted file mode 100644 index 4fed4d5..0000000 --- a/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-36276.51E-DA.rst +++ /dev/null @@ -1 +0,0 @@ -Address CVE-2019-9740 by disallowing URL paths with embedded whitespace or control characters through into the underlying http client request. Such potentially malicious header injection URLs now cause a ValueError to be raised. \ No newline at end of file -- cgit v0.12