[2.7] bpo-30458: Disallow control chars in http URLs. (GH-12755) (GH-13154) by vstinner · Pull Request #13315 · python/cpython

vstinner

Disallow control chars in http URLs in urllib2.urlopen.  This
addresses a potential security problem for applications that do not
sanity check their URLs where http request headers could be injected.

Disable https related urllib tests on a build without ssl (GH-13032)
These tests require an SSL enabled build. Skip these tests when
python is built without SSL to fix test failures.

Use httplib.InvalidURL instead of ValueError as the new error case's
exception. (GH-13044)

Backport Co-Authored-By: Miro Hrončok <miro@hroncok.cz>

(cherry picked from commit 7e200e0)

Notes on backport to Python 2.7:

* test_urllib tests urllib.urlopen() which quotes the URL and so is
  not vulerable to HTTP Header Injection.
* Add tests to test_urllib2 on urllib2.urlopen().
* Reject non-ASCII characters: range 0x80-0xff.

vstinner deleted the url-no-control-chars27 branch

May 21, 2019 13:12

jeff5 added a commit to jython/jython that referenced this pull request

Mar 13, 2022

This change brings selected modules and tests from CPython 2.7.18 to our
lib-python. Where we have specialised versions for Jython, we
cherry-pick tests and code that relate to the CVE. We use the 2.7
back-port from CPython as a guide (python/cpython#13315).