From 76cd81d60310d65d01f9d7b48a8985d8ab89c8b4 Mon Sep 17 00:00:00 2001 From: Senthil Kumaran Date: Thu, 29 Apr 2021 10:16:50 -0700 Subject: bpo-43882 - urllib.parse should sanitize urls containing ASCII newline and tabs. (GH-25595) * issue43882 - urllib.parse should sanitize urls containing ASCII newline and tabs. Co-authored-by: Gregory P. Smith Co-authored-by: Serhiy Storchaka --- Lib/urllib/parse.py | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'Lib/urllib/parse.py') diff --git a/Lib/urllib/parse.py b/Lib/urllib/parse.py index 21cae47bf3..c11c695a74 100644 --- a/Lib/urllib/parse.py +++ b/Lib/urllib/parse.py @@ -78,6 +78,9 @@ scheme_chars = ('abcdefghijklmnopqrstuvwxyz' '0123456789' '+-.') +# Unsafe bytes to be removed per WHATWG spec +_UNSAFE_URL_BYTES_TO_REMOVE = ['\t', '\r', '\n'] + # XXX: Consider replacing with functools.lru_cache MAX_CACHE_SIZE = 20 _parse_cache = {} @@ -469,6 +472,9 @@ def urlsplit(url, scheme='', allow_fragments=True): else: scheme, url = url[:i].lower(), url[i+1:] + for b in _UNSAFE_URL_BYTES_TO_REMOVE: + url = url.replace(b, "") + if url[:2] == '//': netloc, url = _splitnetloc(url, 2) if (('[' in netloc and ']' not in netloc) or -- cgit v1.2.1