Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

bpo-38576: Disallow control characters in hostnames in http.client#18995

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
gpshead merged 2 commits intopython:masterfromepicfaace:url
Mar 14, 2020

Conversation

epicfaace
Copy link
Contributor

@epicfaaceepicfaace commentedMar 14, 2020•
edited by bedevere-bot
Loading

Extends#12755 to apply to hostnames.

https://bugs.python.org/issue38576

@gpsheadgpshead self-assigned thisMar 14, 2020
@gpsheadgpshead added needs backport to 3.6 type-bugAn unexpected behavior, bug, or error type-securityA security issue labelsMar 14, 2020
@gpshead
Copy link
Member

Thanks!

While reviewing I also looked over the_get_hostport(host, port) call that happens before_validate_host(host). I do not believe that will cause any problems, the validation is still doing the right thing even if that transformed host to extract a port number.

@gpsheadgpshead merged commit9165add intopython:masterMar 14, 2020
@miss-islington
Copy link
Contributor

Thanks@epicfaace for the PR, and@gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.6, 3.7, 3.8.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestMar 14, 2020
…ythonGH-18995)Add host validation for control characters for moreCVE-2019-18348 protection.(cherry picked from commit9165add)Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>
@bedevere-bot
Copy link

GH-19000 is a backport of this pull request to the3.8 branch.

@bedevere-bot
Copy link

GH-19001 is a backport of this pull request to the3.7 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestMar 14, 2020
…ythonGH-18995)Add host validation for control characters for moreCVE-2019-18348 protection.(cherry picked from commit9165add)Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>
@bedevere-bot
Copy link

GH-19002 is a backport of this pull request to the3.6 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestMar 14, 2020
…ythonGH-18995)Add host validation for control characters for moreCVE-2019-18348 protection.(cherry picked from commit9165add)Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>
miss-islington added a commit that referenced this pull requestMar 14, 2020
…H-18995)Add host validation for control characters for moreCVE-2019-18348 protection.(cherry picked from commit9165add)Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>
miss-islington added a commit that referenced this pull requestMar 14, 2020
…H-18995)Add host validation for control characters for moreCVE-2019-18348 protection.(cherry picked from commit9165add)Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>
@epicfaaceepicfaace deleted the url branchMarch 14, 2020 20:09
ned-deily pushed a commit that referenced this pull requestMar 14, 2020
…H-18995) (GH-19002)Add host validation for control characters for moreCVE-2019-18348 protection.(cherry picked from commit9165add)Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>
@tapakund
Copy link

#19231 is a back port of this PR to 3.5 branch.

Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers

@gpsheadgpsheadgpshead approved these changes

Assignees

@gpsheadgpshead

Labels
type-bugAn unexpected behavior, bug, or errortype-securityA security issue
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

6 participants
@epicfaace@gpshead@miss-islington@bedevere-bot@tapakund@the-knights-who-say-ni
[8]ページ先頭
©2009-2025 Movatter.jp