[3.8] gh-102153: Start stripping C0 control and space chars in `urlsp… by ngie-eign · Pull Request #104918 · python/cpython

…lit`

gh-102153: Start stripping C0 control and space chars in urlsplit (GH-102508)

urllib.parse.urlsplit has already been respecting the WHATWG spec a bit GH-25595.

This adds more sanitizing to respect the "Remove any leading C0 control or space from input" rule in response to CVE-2023-24329.

I simplified the docs by eliding the state of the world explanatory paragraph in this security release only backport. (people will see that in the mainline /3/ docs)

PR Note

This is a manual back port of the fix originally pushed to main as 2f630e1.