From 4cbb23f8f278fd1f71dcd5968aa0b3f0b4f3bd5d Mon Sep 17 00:00:00 2001 From: Senthil Kumaran Date: Sat, 30 Jul 2016 23:24:16 -0700 Subject: Prevent HTTPoxy attack (CVE-2016-1000110) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which indicates that the script is in CGI mode. Issue #27568 Reported and patch contributed by Rémi Rampin. --- Lib/urllib/request.py | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'Lib/urllib/request.py') diff --git a/Lib/urllib/request.py b/Lib/urllib/request.py index ef62acc710..537b765a12 100644 --- a/Lib/urllib/request.py +++ b/Lib/urllib/request.py @@ -2366,6 +2366,13 @@ def getproxies_environment(): name = name.lower() if value and name[-6:] == '_proxy': proxies[name[:-6]] = value + + # CVE-2016-1000110 - If we are running as CGI script, forget HTTP_PROXY + # (non-all-lowercase) as it may be set from the web server by a "Proxy:" + # header from the client + if 'REQUEST_METHOD' in os.environ: + proxies.pop('http', None) + return proxies def proxy_bypass_environment(host): -- cgit v1.2.1