mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-09-18 14:40:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

bpo-45874: Handle empty query string correctly in urllib.parse.parse_qsl (#29716)

Browse source
This commit is contained in:
Christian Sattler 2021-12-12 09:41:12 +01:00 • committed by GitHub
parent 4325a766f5
commit e6fe10d340
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 7 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Lib/test/test_cgi.py
View file

@ -51,7 +51,7 @@ def do_test(buf, method):
return ComparableException(err) return ComparableException(err)
parse_strict_test_cases = [ parse_strict_test_cases = [
("", ValueError("bad query field: ''")), ("", {}),
("&", ValueError("bad query field: ''")), ("&", ValueError("bad query field: ''")),
("&&", ValueError("bad query field: ''")), ("&&", ValueError("bad query field: ''")),
# Should the next few really be valid? # Should the next few really be valid?

5
Lib/urllib/parse.py
View file

@ -740,12 +740,13 @@ def parse_qsl(qs, keep_blank_values=False, strict_parsing=False,
# is less than max_num_fields. This prevents a memory exhaustion DOS # is less than max_num_fields. This prevents a memory exhaustion DOS
# attack via post bodies with many fields. # attack via post bodies with many fields.
if max_num_fields is not None: if max_num_fields is not None:
num_fields = 1 + qs.count(separator) num_fields = 1 + qs.count(separator) if qs else 0
if max_num_fields < num_fields: if max_num_fields < num_fields:
raise ValueError('Max number of fields exceeded') raise ValueError('Max number of fields exceeded')
r = [] r = []
for name_value in qs.split(separator): query_args = qs.split(separator) if qs else []
for name_value in query_args:
if not name_value and not strict_parsing: if not name_value and not strict_parsing:
continue continue
nv = name_value.split('=', 1) nv = name_value.split('=', 1)

3
Misc/NEWS.d/next/Library/2021-12-02-11-55-45.bpo-45874.dtJIsN.rst Normal file
View file

@ -0,0 +1,3 @@
The empty query string, consisting of no query arguments, is now handled
correctly in ``urllib.parse.parse_qsl``. This caused problems before when
strict parsing was enabled.