blob: d47425d239b2f77050182b5fe4cb66e536d300a9 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
|
From 72d356e3584ebfb8e813a8e9f2cd3dccf233c0d9 Mon Sep 17 00:00:00 2001
From: "Miss Islington (bot)"
<31488909+miss-islington@users.noreply.github.com>
Date: Sun, 13 Nov 2022 11:00:25 -0800
Subject: [PATCH] gh-99418: Make urllib.parse.urlparse enforce that a scheme
must begin with an alphabetical ASCII character. (GH-99421)
Prevent urllib.parse.urlparse from accepting schemes that don't begin with an alphabetical ASCII character.
RFC 3986 defines a scheme like this: `scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )`
RFC 2234 defines an ALPHA like this: `ALPHA = %x41-5A / %x61-7A`
The WHATWG URL spec defines a scheme like this:
`"A URL-scheme string must be one ASCII alpha, followed by zero or more of ASCII alphanumeric, U+002B (+), U+002D (-), and U+002E (.)."`
(cherry picked from commit 439b9cfaf43080e91c4ad69f312f21fa098befc7)
Co-authored-by: Ben Kallus <49924171+kenballus@users.noreply.github.com>
--- end original header ---
CVE: CVE-2023-24329
Upstream-Status: Backport [see below]
Taken from https://github.com/python/cpython.git
commit 72d356e3584ebfb8e813a8e9f2cd3dccf233c0d9
CVE fix extracted; test case and update to NEWS abandoned.
Defuzzed.
Signed-off-by: Joe Slater <joe.slater@windriver.com>
---
Lib/urllib/parse.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Lib/urllib/parse.py b/Lib/urllib/parse.py
index 26ddf30..1c53acb 100644
--- a/Lib/urllib/parse.py
+++ b/Lib/urllib/parse.py
@@ -469,7 +469,7 @@ def urlsplit(url, scheme='', allow_fragments=True):
clear_cache()
netloc = query = fragment = ''
i = url.find(':')
- if i > 0:
+ if i > 0 and url[0].isascii() and url[0].isalpha():
for c in url[:i]:
if c not in scheme_chars:
break
--
2.25.1
|
