mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-28 04:35:02 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

gh-105704: Disallow square brackets ([ and ]) in domain names for parsed URLs (#129418)

Browse source 
* gh-105704: Disallow square brackets ( and ) in domain names for parsed URLs

* Use Sphinx references

Co-authored-by: Peter Bierma <zintensitydev@gmail.com>

* Add mismatched bracket test cases, fix news format

* Add more test coverage for ports

---------

Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
This commit is contained in:
Seth Michael Larson 2025-01-31 11:41:34 -06:00 • committed by GitHub
parent 54f74b80ae
commit d89a5f6a6e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 58 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

20
Lib/urllib/parse.py
View file

@ -439,6 +439,23 @@ def _checknetloc(netloc):
raise ValueError("netloc '" + netloc + "' contains invalid " +
"characters under NFKC normalization")
def _check_bracketed_netloc(netloc):
# Note that this function must mirror the splitting
# done in NetlocResultMixins._hostinfo().
hostname_and_port = netloc.rpartition('@')[2]
before_bracket, have_open_br, bracketed = hostname_and_port.partition('[')
if have_open_br:
# No data is allowed before a bracket.
if before_bracket:
raise ValueError("Invalid IPv6 URL")
hostname, _, port = bracketed.partition(']')
# No data is allowed after the bracket but before the port delimiter.
if port and not port.startswith(":"):
raise ValueError("Invalid IPv6 URL")
else:
hostname, _, port = hostname_and_port.partition(':')
_check_bracketed_host(hostname)
# Valid bracketed hosts are defined in
# https://www.rfc-editor.org/rfc/rfc3986#page-49 and https://url.spec.whatwg.org/
def _check_bracketed_host(hostname):
@ -505,8 +522,7 @@ def _urlsplit(url, scheme=None, allow_fragments=True):
(']' in netloc and '[' not in netloc)):
raise ValueError("Invalid IPv6 URL")
if '[' in netloc and ']' in netloc:
bracketed_host = netloc.partition('[')[2].partition(']')[0]
_check_bracketed_host(bracketed_host)
_check_bracketed_netloc(netloc)
if allow_fragments and '#' in url:
url, fragment = url.split('#', 1)
if '?' in url: