mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-18 07:41:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

Merge issue 11662 from 2.6.

Browse source
This commit is contained in:
Guido van Rossum 2011-03-29 12:53:55 -07:00
commit 07ef62c47c
5 changed files with 61 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
Lib/urllib2.py
View file

@ -578,6 +578,17 @@ class HTTPRedirectHandler(BaseHandler):
newurl = urlparse.urljoin(req.get_full_url(), newurl)
# For security reasons we do not allow redirects to protocols
# other than HTTP, HTTPS or FTP.
newurl_lower = newurl.lower()
if not (newurl_lower.startswith('http://') or
newurl_lower.startswith('https://') or
newurl_lower.startswith('ftp://')):
raise HTTPError(newurl, code,
msg + " - Redirection to url '%s' is not allowed" %
newurl,
headers, fp)
# XXX Probably want to forget about the state of the current
# request, although that might interact poorly with other
# handlers that also use handler-specific request attributes