From 4cbb23f8f278fd1f71dcd5968aa0b3f0b4f3bd5d Mon Sep 17 00:00:00 2001 From: Senthil Kumaran Date: Sat, 30 Jul 2016 23:24:16 -0700 Subject: Prevent HTTPoxy attack (CVE-2016-1000110) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which indicates that the script is in CGI mode. Issue #27568 Reported and patch contributed by Rémi Rampin. --- Doc/howto/urllib2.rst | 5 +++++ Doc/library/urllib.request.rst | 13 +++++++++++++ 2 files changed, 18 insertions(+) (limited to 'Doc') diff --git a/Doc/howto/urllib2.rst b/Doc/howto/urllib2.rst index 5a2266070a..cc0d85e0bb 100644 --- a/Doc/howto/urllib2.rst +++ b/Doc/howto/urllib2.rst @@ -538,6 +538,11 @@ setting up a `Basic Authentication`_ handler: :: through a proxy. However, this can be enabled by extending urllib.request as shown in the recipe [#]_. +.. note:: + + `HTTP_PROXY`` will be ignored if a variable ``REQUEST_METHOD`` is set; see + the documentation on :func:`~urllib.request.getproxies`. + Sockets and Layers ================== diff --git a/Doc/library/urllib.request.rst b/Doc/library/urllib.request.rst index 6493a292aa..f4f8692269 100644 --- a/Doc/library/urllib.request.rst +++ b/Doc/library/urllib.request.rst @@ -161,6 +161,14 @@ The :mod:`urllib.request` module defines the following functions: cannot find it, looks for proxy information from Mac OSX System Configuration for Mac OS X and Windows Systems Registry for Windows. + .. note:: + + If the environment variable ``REQUEST_METHOD`` is set, which usually + indicates your script is running in a CGI environment, the environment + variable ``HTTP_PROXY`` (uppercase ``_PROXY``) will be ignored. This is + because that variable can be injected by a client using the "Proxy:" HTTP + header. If you need to use an HTTP proxy in a CGI environment use + ``ProxyHandler`` explicitly. The following classes are provided: @@ -265,6 +273,11 @@ The following classes are provided: To disable autodetected proxy pass an empty dictionary. + .. note:: + + ``HTTP_PROXY`` will be ignored if a variable ``REQUEST_METHOD`` is set; + see the documentation on :func:`~urllib.request.getproxies`. + .. class:: HTTPPasswordMgr() -- cgit v1.2.1