mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-04 08:59:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

[3.11] gh-105704: Disallow square brackets ([ and ]) in domain names for parsed URLs (GH-129418) (#129528)

Browse source 
Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
This commit is contained in:
Miss Islington (bot) 2025-02-19 14:13:52 +01:00 • committed by GitHub
parent 7cff053efe
commit 526617ed68
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 58 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

37
Lib/test/test_urlparse.py
View file

@ -1224,16 +1224,51 @@ class UrlParseTestCase(unittest.TestCase):
self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af::2309::fae7:1234]/Path?Query')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af:2309::fae7:1234:2342:438e:192.0.2.146]/Path?Query')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@]v6a.ip[/Path')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip]')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip].suffix')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip]/')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip].suffix/')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip]?')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip].suffix?')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]/')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix/')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]?')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix?')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:a')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:a')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:a1')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:a1')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:1a')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:1a')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:/')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:?')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://user@prefix.[v6a.ip]')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://user@[v6a.ip].suffix')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip]')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://]v6a.ip[')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://]v6a.ip')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip[')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip].suffix')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix]v6a.ip[suffix')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix]v6a.ip')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip[suffix')
def test_splitting_bracketed_hosts(self):
p1 = urllib.parse.urlsplit('scheme://user@[v6a.ip]/path?query')
p1 = urllib.parse.urlsplit('scheme://user@[v6a.ip]:1234/path?query')
self.assertEqual(p1.hostname, 'v6a.ip')
self.assertEqual(p1.username, 'user')
self.assertEqual(p1.path, '/path')
self.assertEqual(p1.port, 1234)
p2 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7%test]/path?query')
self.assertEqual(p2.hostname, '0439:23af:2309::fae7%test')
self.assertEqual(p2.username, 'user')
self.assertEqual(p2.path, '/path')
self.assertIs(p2.port, None)
p3 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7:1234:192.0.2.146%test]/path?query')
self.assertEqual(p3.hostname, '0439:23af:2309::fae7:1234:192.0.2.146%test')
self.assertEqual(p3.username, 'user')

20
Lib/urllib/parse.py
View file

@ -436,6 +436,23 @@ def _checknetloc(netloc):
raise ValueError("netloc '" + netloc + "' contains invalid " +
"characters under NFKC normalization")
def _check_bracketed_netloc(netloc):
# Note that this function must mirror the splitting
# done in NetlocResultMixins._hostinfo().
hostname_and_port = netloc.rpartition('@')[2]
before_bracket, have_open_br, bracketed = hostname_and_port.partition('[')
if have_open_br:
# No data is allowed before a bracket.
if before_bracket:
raise ValueError("Invalid IPv6 URL")
hostname, _, port = bracketed.partition(']')
# No data is allowed after the bracket but before the port delimiter.
if port and not port.startswith(":"):
raise ValueError("Invalid IPv6 URL")
else:
hostname, _, port = hostname_and_port.partition(':')
_check_bracketed_host(hostname)
# Valid bracketed hosts are defined in
# https://www.rfc-editor.org/rfc/rfc3986#page-49 and https://url.spec.whatwg.org/
def _check_bracketed_host(hostname):
@ -496,8 +513,7 @@ def urlsplit(url, scheme='', allow_fragments=True):
(']' in netloc and '[' not in netloc)):
raise ValueError("Invalid IPv6 URL")
if '[' in netloc and ']' in netloc:
bracketed_host = netloc.partition('[')[2].partition(']')[0]
_check_bracketed_host(bracketed_host)
_check_bracketed_netloc(netloc)
if allow_fragments and '#' in url:
url, fragment = url.split('#', 1)
if '?' in url:

4
Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst Normal file
View file

@ -0,0 +1,4 @@
When using :func:`urllib.parse.urlsplit` and :func:`urllib.parse.urlparse` host
parsing would not reject domain names containing square brackets (``[`` and
``]``). Square brackets are only valid for IPv6 and IPvFuture hosts according to
`RFC 3986 Section 3.2.2 <https://www.rfc-editor.org/rfc/rfc3986#section-3.2.2>`__.