Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

gh-67693: Fix urlunparse() and urlunsplit() for URIs with path starting with multiple slashes and no authority#113563

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
serhiy-storchaka merged 10 commits intopython:mainfromserhiy-storchaka:urls2
May 14, 2024

Conversation

serhiy-storchaka
Copy link
Member

@serhiy-storchakaserhiy-storchaka commentedDec 29, 2023
edited by bedevere-appbot
Loading

@serhiy-storchakaserhiy-storchaka added needs backport to 3.11only security fixes needs backport to 3.12only security fixes labelsDec 29, 2023
@serhiy-storchakaserhiy-storchaka changed the titlegh-78457: Fix urlunparse() and urlunsplit() for URIs with path starting with multiple slashes and no authoritygh-67693: Fix urlunparse() and urlunsplit() for URIs with path starting with multiple slashes and no authorityDec 29, 2023
@serhiy-storchaka
Copy link
MemberAuthor

It fixes also more serious security issue#67693.

Copy link
Member

@vadmiumvadmium left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

The code changes and tests look good to me.

('//path/to/file',
('', 'path', '/to/file', '', '', ''),
('', 'path', '/to/file', '', '')),
('////path/to/file',
Copy link
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

This case was broken.

('scheme://path/to/file',
('scheme', 'path', '/to/file', '', '', ''),
('scheme', 'path', '/to/file', '', '')),
('scheme:////path/to/file',
Copy link
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

This case was broken.

('file:///tmp/junk.txt',
('file', '', '/tmp/junk.txt', '', '', ''),
('file', '', '/tmp/junk.txt', '', '')),
('file:////tmp/junk.txt',
Copy link
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

This case was broken.

('file:////tmp/junk.txt',
('file', '', '//tmp/junk.txt', '', '', ''),
('file', '', '//tmp/junk.txt', '', '')),
('file://///tmp/junk.txt',
Copy link
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

This case was broken.

Copy link
Contributor

@sethmlarsonsethmlarson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

LGTM!

@serhiy-storchakaserhiy-storchaka merged commite237b25 intopython:mainMay 14, 2024
@miss-islington-app
Copy link

Thanks@serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.8, 3.9, 3.10, 3.11, 3.12, 3.13.
🐍🍒⛏🤖

@bedevere-app
Copy link

GH-119025 is a backport of this pull request to the3.11 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.11only security fixes labelMay 14, 2024
@bedevere-app
Copy link

GH-119026 is a backport of this pull request to the3.10 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.10only security fixes labelMay 14, 2024
serhiy-storchaka added a commit to serhiy-storchaka/cpython that referenced this pull requestMay 14, 2024
…h path starting with multiple slashes and no authority (pythonGH-113563)(cherry picked from commite237b25)Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@bedevere-app
Copy link

GH-119027 is a backport of this pull request to the3.9 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.9only security fixes labelMay 14, 2024
serhiy-storchaka added a commit to serhiy-storchaka/cpython that referenced this pull requestMay 14, 2024
… path starting with multiple slashes and no authority (pythonGH-113563)(cherry picked from commite237b25)Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@bedevere-app
Copy link

GH-119028 is a backport of this pull request to the3.8 branch.

serhiy-storchaka added a commit to serhiy-storchaka/cpython that referenced this pull requestMay 14, 2024
…h path starting with multiple slashes and no authority (pythonGH-113563)(cherry picked from commite237b25)Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
serhiy-storchaka added a commit that referenced this pull requestMay 14, 2024
… starting with multiple slashes and no authority (GH-113563) (GH-119023)(cherry picked from commite237b25)Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
serhiy-storchaka added a commit that referenced this pull requestMay 14, 2024
… starting with multiple slashes and no authority (GH-113563) (GH-119024)(cherry picked from commite237b25)Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
matthewhughes934 pushed a commit to matthewhughes934/pip that referenced this pull requestJun 23, 2024
There was a behavioural change to `urllib.parse.urlunparse`[1] thataffects some of our tests on Windows. With the understanding that thenew behaviour is indeed desired, split up some tests relying on thisbehaviour depending on the version of Python.This currently affects only 3.12 and 3.13 but there are other backportsfor that change in review upstream, so we'll likely need to update thisin the future.[1]python/cpython#113563
matthewhughes934 pushed a commit to matthewhughes934/pip that referenced this pull requestJun 23, 2024
There was a behavioural change to `urllib.parse.urlunparse`[1] thataffects some of our tests on Windows. With the understanding that thenew behaviour is indeed desired, split up some tests relying on thisbehaviour depending on the version of Python.This currently affects only 3.12 and 3.13 but there are other backportsfor that change in review upstream, so we'll likely need to update thisin the future.[1]python/cpython#113563
matthewhughes934 pushed a commit to matthewhughes934/pip that referenced this pull requestJun 23, 2024
There was a behavioural change to `urllib.parse.urlunparse`[1] thataffects some of our tests on Windows. With the understanding that thenew behaviour is indeed desired, split up some tests relying on thisbehaviour depending on the version of Python.This currently affects only 3.12 and 3.13 but there are other backportsfor that change in review upstream, so we'll likely need to update thisin the future.[1]python/cpython#113563
matthewhughes934 pushed a commit to matthewhughes934/pip that referenced this pull requestJun 23, 2024
There was a behavioural change to `urllib.parse.urlunparse`[1] thataffects some of our tests on Windows. With the understanding that thenew behaviour is indeed desired, split up some tests relying on thisbehaviour depending on the version of Python.This currently affects only 3.12 and 3.13 but there are other backportsfor that change in review upstream, so we'll likely need to update thisin the future.[1]python/cpython#113563
matthewhughes934 pushed a commit to matthewhughes934/pip that referenced this pull requestJun 24, 2024
There was a behavioural change to `urllib.parse.urlunparse`[1] thataffects some of our tests on Windows. With the understanding that thenew behaviour is indeed desired, split up some tests relying on thisbehaviour depending on the version of Python.The sample URL used to check this behaviour was taken from a test in theupstream change (with the new behaviour this URL will round-tripparsing)[1]python/cpython#113563
pradyunsg pushed a commit to pypa/pip that referenced this pull requestJun 25, 2024
There was a behavioural change to `urllib.parse.urlunparse`[1] thataffects some of our tests on Windows. With the understanding that thenew behaviour is indeed desired, split up some tests relying on thisbehaviour depending on the version of Python.The sample URL used to check this behaviour was taken from a test in theupstream change (with the new behaviour this URL will round-tripparsing)[1]python/cpython#113563
estyxx pushed a commit to estyxx/cpython that referenced this pull requestJul 17, 2024
ambv pushed a commit that referenced this pull requestSep 4, 2024
… starting with multiple slashes and no authority (GH-113563) (#119025)(cherry picked from commite237b25)
ambv pushed a commit that referenced this pull requestSep 4, 2024
… starting with multiple slashes and no authority (GH-113563) (#119026)(cherry picked from commite237b25)
ambv added a commit that referenced this pull requestSep 4, 2024
…starting with multiple slashes and no authority (GH-113563) (#119028)(cherry picked from commite237b25)Co-authored-by: Łukasz Langa <lukasz@langa.pl>
ambv added a commit that referenced this pull requestSep 5, 2024
…starting with multiple slashes and no authority (GH-113563) (#119027)(cherry picked from commite237b25)Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>Co-authored-by: Łukasz Langa <lukasz@langa.pl>
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers

@vadmiumvadmiumvadmium left review comments

@sethmlarsonsethmlarsonsethmlarson approved these changes

Labels
type-securityA security issue
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

4 participants
@serhiy-storchaka@vadmium@sethmlarson@epicfaace

[8]ページ先頭

©2009-2025 Movatter.jp