Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit29f348e

Browse files
gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (#103849)
* Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format---------Co-authored-by: Gregory P. Smith <greg@krypto.org>
1 parent2c863b3 commit29f348e

File tree

3 files changed

+43
-1
lines changed

3 files changed

+43
-1
lines changed

‎Lib/test/test_urlparse.py

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1042,6 +1042,32 @@ def test_issue14072(self):
10421042
self.assertEqual(p2.scheme,'tel')
10431043
self.assertEqual(p2.path,'+31641044153')
10441044

1045+
deftest_invalid_bracketed_hosts(self):
1046+
self.assertRaises(ValueError,urllib.parse.urlsplit,'Scheme://user@[192.0.2.146]/Path?Query')
1047+
self.assertRaises(ValueError,urllib.parse.urlsplit,'Scheme://user@[important.com:8000]/Path?Query')
1048+
self.assertRaises(ValueError,urllib.parse.urlsplit,'Scheme://user@[v123r.IP]/Path?Query')
1049+
self.assertRaises(ValueError,urllib.parse.urlsplit,'Scheme://user@[v12ae]/Path?Query')
1050+
self.assertRaises(ValueError,urllib.parse.urlsplit,'Scheme://user@[v.IP]/Path?Query')
1051+
self.assertRaises(ValueError,urllib.parse.urlsplit,'Scheme://user@[v123.]/Path?Query')
1052+
self.assertRaises(ValueError,urllib.parse.urlsplit,'Scheme://user@[v]/Path?Query')
1053+
self.assertRaises(ValueError,urllib.parse.urlsplit,'Scheme://user@[0439:23af::2309::fae7:1234]/Path?Query')
1054+
self.assertRaises(ValueError,urllib.parse.urlsplit,'Scheme://user@[0439:23af:2309::fae7:1234:2342:438e:192.0.2.146]/Path?Query')
1055+
self.assertRaises(ValueError,urllib.parse.urlsplit,'Scheme://user@]v6a.ip[/Path')
1056+
1057+
deftest_splitting_bracketed_hosts(self):
1058+
p1=urllib.parse.urlsplit('scheme://user@[v6a.ip]/path?query')
1059+
self.assertEqual(p1.hostname,'v6a.ip')
1060+
self.assertEqual(p1.username,'user')
1061+
self.assertEqual(p1.path,'/path')
1062+
p2=urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7%test]/path?query')
1063+
self.assertEqual(p2.hostname,'0439:23af:2309::fae7%test')
1064+
self.assertEqual(p2.username,'user')
1065+
self.assertEqual(p2.path,'/path')
1066+
p3=urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7:1234:192.0.2.146%test]/path?query')
1067+
self.assertEqual(p3.hostname,'0439:23af:2309::fae7:1234:192.0.2.146%test')
1068+
self.assertEqual(p3.username,'user')
1069+
self.assertEqual(p3.path,'/path')
1070+
10451071
deftest_port_casting_failure_message(self):
10461072
message="Port could not be cast to integer value as 'oracle'"
10471073
p1=urllib.parse.urlparse('http://Server=sde; Service=sde:oracle')

‎Lib/urllib/parse.py

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
importre
3434
importtypes
3535
importwarnings
36+
importipaddress
3637

3738
__all__= ["urlparse","urlunparse","urljoin","urldefrag",
3839
"urlsplit","urlunsplit","urlencode","parse_qs",
@@ -427,6 +428,17 @@ def _checknetloc(netloc):
427428
raiseValueError("netloc '"+netloc+"' contains invalid "+
428429
"characters under NFKC normalization")
429430

431+
# Valid bracketed hosts are defined in
432+
# https://www.rfc-editor.org/rfc/rfc3986#page-49 and https://url.spec.whatwg.org/
433+
def_check_bracketed_host(hostname):
434+
ifhostname.startswith('v'):
435+
ifnotre.match(r"\Av[a-fA-F0-9]+\..+\Z",hostname):
436+
raiseValueError(f"IPvFuture address is invalid")
437+
else:
438+
ip=ipaddress.ip_address(hostname)# Throws Value Error if not IPv6 or IPv4
439+
ifisinstance(ip,ipaddress.IPv4Address):
440+
raiseValueError(f"An IPv4 address cannot be in brackets")
441+
430442
# typed=True avoids BytesWarnings being emitted during cache key
431443
# comparison since this API supports both bytes and str input.
432444
@functools.lru_cache(typed=True)
@@ -466,12 +478,14 @@ def urlsplit(url, scheme='', allow_fragments=True):
466478
break
467479
else:
468480
scheme,url=url[:i].lower(),url[i+1:]
469-
470481
ifurl[:2]=='//':
471482
netloc,url=_splitnetloc(url,2)
472483
if (('['innetlocand']'notinnetloc)or
473484
(']'innetlocand'['notinnetloc)):
474485
raiseValueError("Invalid IPv6 URL")
486+
if'['innetlocand']'innetloc:
487+
bracketed_host=netloc.partition('[')[2].partition(']')[0]
488+
_check_bracketed_host(bracketed_host)
475489
ifallow_fragmentsand'#'inurl:
476490
url,fragment=url.split('#',1)
477491
if'?'inurl:
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Add checks to ensure that ``[`` bracketed ``]`` hosts found by
2+
:func:`urllib.parse.urlsplit` are of IPv6 or IPvFuture format.

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp