bpo-35907, CVE-2019-9948: urllib rejects local_file:// scheme by vstinner · Pull Request #13474 · python/cpython · GitHub

CVE-2019-9948: Avoid file reading as disallowing the unnecessary URL
scheme in URLopener().open() of urllib.request.

https://bugs.python.org/issue35907

This PR is very close to PR #11842, I just added the unit test:

             self.assertRaises(IOError, urllib.request.URLopener().open, url)

@tiran: Would you mind to review this forward port of PR #11842? Fix for https://bugs.python.org/issue35907

@tirkarthi @gpshead: Would you mind to review this HTTP security fix?

Are we making this change to the deprecated legacy interface urllib.request.URLopener().retrieve too? If so I would prefer adding below test since it also now throws IOError that used to return a result. I guess Python 2 also has urlretrieve which now forbids local_file

Note : urlretrieve was untested but documented that it used to throw NameError (https://bugs.python.org/issue36948) . Please also check Windows compatibility if urlretrieve tests have to be added since I mistakenly broke two Windows buildbots in the issue.

self.assertRaises(urllib.request.URLopener().rertrieve, url)

Sorry, my test was wrong. urlretrieve requires a file. Maybe above urlretrieve tests can be used to just check for local-file:// too? Change in behavior as below

Before PR :

cpython git:(master) ✗ touch /tmp/a.txt
cpython git:(master) ✗ ./python.exe -q
>>> import urllib.request
>>> urllib.request.URLopener().retrieve('local_file://localhost/tmp/a.txt')
sys:1: DeprecationWarning: URLopener style of invoking requests is deprecated. Use newer urlopen functions/methods
('/var/folders/2b/mhgtnnpx4z943t4cc9yvw4qw0000gn/T/tmpmx6km86p.txt', <email.message.Message object at 0x1066a2a00>)

After PR :

cpython git:(master) ✗ touch /tmp/a.txt
cpython git:(master) ✗ ./python.exe -q
>>> import urllib.request
>>> urllib.request.URLopener().retrieve('local_file://localhost/tmp/a.txt')
sys:1: DeprecationWarning: URLopener style of invoking requests is deprecated. Use newer urlopen functions/methods
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/Users/karthikeyansingaravelan/stuff/python/cpython/Lib/urllib/request.py", line 1789, in retrieve
    fp = self.open(url, data)
  File "/Users/karthikeyansingaravelan/stuff/python/cpython/Lib/urllib/request.py", line 1752, in open
    return self.open_unknown(fullurl, data)
  File "/Users/karthikeyansingaravelan/stuff/python/cpython/Lib/urllib/request.py", line 1766, in open_unknown
    raise OSError('url error', 'unknown url type', type)
OSError: [Errno url error] unknown url type: 'local_file'

I didn't know URLopener().retrieve :-) My PR impacts it as well.

I added requested tests.

CVE-2019-9948: Avoid file reading as disallowing the unnecessary URL scheme in URLopener().open() and URLopener().retrieve() of urllib.request. Co-Authored-By: SH <push0ebp@gmail.com>

I rebased my PR to modify the commit message: mention also URLopener().retrieve().

LGTM. Thanks :)

Thanks @vstinner for the PR 🌮🎉.. I'm working now to backport this PR to: 3.7.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

Sorry, @vstinner, I could not cleanly backport this to 3.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 0c2b6a3943aa7b022e8eb4bfd9bffcddebf9a587 3.7

GH-13505 is a backport of this pull request to the 3.7 branch.

…) (GH-13505) CVE-2019-9948: Avoid file reading as disallowing the unnecessary URL scheme in URLopener().open() and URLopener().retrieve() of urllib.request. Co-Authored-By: SH <push0ebp@gmail.com> (cherry picked from commit 0c2b6a3)

This text doesn't make sense as written. "as disallowing the unnecessary URL scheme" says nothing. WHAT url scheme did we just break our users applications by refusing to support? Those need to be listed in the NEWS entry.

CVE-2019-9948: Drop support for the unintended local_file:// URL scheme in ...

…) (GH-13505) (#13510) CVE-2019-9948: Avoid file reading by disallowing local-file:// and local_file:// URL schemes in URLopener().open() and URLopener().retrieve() of urllib.request. Co-Authored-By: SH <push0ebp@gmail.com>

vstinner added the type-security A security issue label May 21, 2019

the-knights-who-say-ni added the CLA signed label May 21, 2019

bedevere-bot added the awaiting core review label May 21, 2019

vstinner requested a review from tiran May 21, 2019 21:31

vstinner added the needs backport to 3.7 label May 21, 2019

push0ebp mentioned this pull request May 22, 2019

[2.7] bpo-35907: Avoid file reading as disallowing the unnecessary URL scheme in urllib (GH-11842) #11842

Merged

vstinner requested a review from gpshead May 22, 2019 11:02

tirkarthi reviewed May 22, 2019

View reviewed changes

bpo-35907 , CVE-2019-9948 : urllib rejects local_file:// scheme

7b04bc2

CVE-2019-9948: Avoid file reading as disallowing the unnecessary URL scheme in URLopener().open() and URLopener().retrieve() of urllib.request. Co-Authored-By: SH <push0ebp@gmail.com>

tirkarthi approved these changes May 22, 2019

View reviewed changes

vstinner merged commit 0c2b6a3 into python:master May 22, 2019

bedevere-bot removed the awaiting core review label May 22, 2019

vstinner deleted the local_file branch May 22, 2019 20:15

miss-islington assigned vstinner May 22, 2019

bedevere-bot removed the needs backport to 3.7 label May 22, 2019

gpshead reviewed May 22, 2019

View reviewed changes

coderabbitai Bot mentioned this pull request May 22, 2026

chore: add Dynamo recipe bring-up skills ai-dynamo/dynamo#9782

Merged

coderabbitai Bot mentioned this pull request Jun 4, 2026

Feature/#9 infraops health monitors FISA-Agri-Pay/mcp-aiops-backend#10

Merged

This was referenced Jun 15, 2026

fix: harden OpenAI-compatible agent transport nyldn/claude-octopus#512

Merged

Add radix prefix cache backend hw-native-sys/pypto-serving#39

Open

feat: daily snapshot capture + open_issues/archived (feed-v2) komi-store/komi-store-backend-data#3

Merged

coderabbitai Bot mentioned this pull request Jun 20, 2026

Fix duplicated top nav, add api-football teams + odds sync morebnyemba/SLYKCASINO#19

Merged

3 tasks done

coderabbitai Bot mentioned this pull request Jul 24, 2026

Fix missing default fallbacks for undefined venue rating scores SatyamPandey-07/WorkSphere#1676

Merged

4 of 5 tasks

		@@ -0,0 +1,2 @@
		CVE-2019-9948: Avoid file reading as disallowing the unnecessary URL scheme in

bpo-35907, CVE-2019-9948: urllib rejects local_file:// scheme by vstinner · Pull Request #13474 · python/cpython · GitHub

Repository navigation

bpo-35907, CVE-2019-9948: urllib rejects local_file:// scheme - #13474

bpo-35907, CVE-2019-9948: urllib rejects local_file:// scheme#13474vstinner merged 1 commit intopython:masterpython/cpython:masterfrom vstinner:local_fileCopy head branch name to clipboard

Conversation

vstinner commented May 21, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vstinner commented May 21, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vstinner commented May 21, 2019

Uh oh!

vstinner commented May 22, 2019

Uh oh!

tirkarthi May 22, 2019

Choose a reason for hiding this comment

Uh oh!

tirkarthi May 22, 2019

Choose a reason for hiding this comment

Uh oh!

vstinner May 22, 2019

Choose a reason for hiding this comment

Uh oh!

vstinner commented May 22, 2019

Uh oh!

tirkarthi left a comment

Choose a reason for hiding this comment

Uh oh!

miss-islington commented May 22, 2019

Uh oh!

miss-islington commented May 22, 2019

Uh oh!

bedevere-bot commented May 22, 2019

Uh oh!

gpshead May 22, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

bpo-35907, CVE-2019-9948: urllib rejects local_file:// scheme#13474
vstinner merged 1 commit into
python:masterfrom
vstinner:local_file

vstinner commented May 21, 2019 •
edited
Loading

vstinner commented May 21, 2019 •
edited
Loading

gpshead May 22, 2019 •
edited
Loading