FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

gh-99418: Make urllib.parse.urlparse enforce that a scheme must begin with an alphabetical ASCII character. by kenballus · Pull Request #99421 · python/cpython · GitHub

/ cpython Public

gh-99418: Make urllib.parse.urlparse enforce that a scheme must begin with an alphabetical ASCII character. - #99421

Merged
gpshead merged 2 commits into
python:mainfrom
kenballus:main
Nov 13, 2022
ConversationCommits (2)ChecksFiles changed
Merged

gh-99418: Make urllib.parse.urlparse enforce that a scheme must begin with an alphabetical ASCII character.#99421
gpshead merged 2 commits into
python:mainfrom
kenballus:main

Conversation

kenballus commented Nov 12, 2022 •
edited by bedevere-bot
Loading

Copy link
Copy Markdown
Contributor

urllib.parse.urlparse does not enforce that a scheme must begin with a character from [A-Za-z]. This patch adds a check to enforce that rule.

bedevere-bot mentioned this pull request Nov 12, 2022
Closed
gpshead self-assigned this Nov 13, 2022
gpshead added the needs backport to 3.11 only security fixes label Nov 13, 2022
gpshead merged commit 439b9cf into python:main Nov 13, 2022

miss-islington commented Nov 13, 2022

Copy link
Copy Markdown
Contributor

Thanks @kenballus for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

bedevere-bot commented Nov 13, 2022

Copy link
Copy Markdown

GH-99446 is a backport of this pull request to the 3.11 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Nov 13, 2022
pythongh-99418: Make urllib.parse.urlparse enforce that a scheme must…
4e0f5af 
… begin with an alphabetical ASCII character. (pythonGH-99421)

Prevent urllib.parse.urlparse from accepting schemes that don't begin with an alphabetical ASCII character.

RFC 3986 defines a scheme like this: `scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )`
RFC 2234 defines an ALPHA like this: `ALPHA = %x41-5A / %x61-7A`

The WHATWG URL spec defines a scheme like this:
`"A URL-scheme string must be one ASCII alpha, followed by zero or more of ASCII alphanumeric, U+002B (+), U+002D (-), and U+002E (.)."`
(cherry picked from commit 439b9cf)

Co-authored-by: Ben Kallus <49924171+kenballus@users.noreply.github.com>
bedevere-bot removed the needs backport to 3.11 only security fixes label Nov 13, 2022
miss-islington added a commit that referenced this pull request Nov 13, 2022
gh-99418: Make urllib.parse.urlparse enforce that a scheme must begin…
72d356e 
… with an alphabetical ASCII character. (GH-99421)

Prevent urllib.parse.urlparse from accepting schemes that don't begin with an alphabetical ASCII character.

RFC 3986 defines a scheme like this: `scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )`
RFC 2234 defines an ALPHA like this: `ALPHA = %x41-5A / %x61-7A`

The WHATWG URL spec defines a scheme like this:
`"A URL-scheme string must be one ASCII alpha, followed by zero or more of ASCII alphanumeric, U+002B (+), U+002D (-), and U+002E (.)."`
(cherry picked from commit 439b9cf)

Co-authored-by: Ben Kallus <49924171+kenballus@users.noreply.github.com>
AdrianBunk mentioned this pull request Feb 22, 2023
Closed
kwsp mentioned this pull request Mar 9, 2023
Closed

vstinner commented Apr 5, 2023

Copy link
Copy Markdown
Member

CVE-2023-24329 was assigned to this issue.

vstinner changed the title gh-99418: Make urllib.parse.urlparse enforce that a scheme must begin with an alphabetical ASCII character. [CVE-2023-24329] gh-99418: Make urllib.parse.urlparse enforce that a scheme must begin with an alphabetical ASCII character. Apr 5, 2023

gpshead commented Apr 27, 2023

Copy link
Copy Markdown
Member

CVE-2023-24329 was assigned to this issue.

That this PR does not fix that CVE. The CVE is inaccurate. See #102153.

gpshead changed the title [CVE-2023-24329] gh-99418: Make urllib.parse.urlparse enforce that a scheme must begin with an alphabetical ASCII character. gh-99418: Make urllib.parse.urlparse enforce that a scheme must begin with an alphabetical ASCII character. Apr 27, 2023
This was referenced Oct 11, 2023
Closed
Merged
gentoo-bot pushed a commit to gentoo/cpython that referenced this pull request May 21, 2024
pythongh-99418: Make urllib.parse.urlparse enforce that a scheme must…
5355793 
… begin with an alphabetical ASCII character. (pythonGH-99421)

Prevent urllib.parse.urlparse from accepting schemes that don't begin with an alphabetical ASCII character.

RFC 3986 defines a scheme like this: `scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )`
RFC 2234 defines an ALPHA like this: `ALPHA = %x41-5A / %x61-7A`

The WHATWG URL spec defines a scheme like this:
`"A URL-scheme string must be one ASCII alpha, followed by zero or more of ASCII alphanumeric, U+002B (+), U+002D (-), and U+002E (.)."`
(cherry picked from commit 439b9cf)

Co-authored-by: Ben Kallus <49924171+kenballus@users.noreply.github.com>
gentoo-bot pushed a commit to gentoo/cpython that referenced this pull request May 21, 2024
pythongh-99418: Make urllib.parse.urlparse enforce that a scheme must…
60effed 
… begin with an alphabetical ASCII character. (pythonGH-99421)

Prevent urllib.parse.urlparse from accepting schemes that don't begin with an alphabetical ASCII character.

RFC 3986 defines a scheme like this: `scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )`
RFC 2234 defines an ALPHA like this: `ALPHA = %x41-5A / %x61-7A`

The WHATWG URL spec defines a scheme like this:
`"A URL-scheme string must be one ASCII alpha, followed by zero or more of ASCII alphanumeric, U+002B (+), U+002D (-), and U+002E (.)."`
(cherry picked from commit 439b9cf)

Co-authored-by: Ben Kallus <49924171+kenballus@users.noreply.github.com>
gentoo-bot pushed a commit to gentoo/cpython that referenced this pull request Sep 19, 2024
pythongh-99418: Make urllib.parse.urlparse enforce that a scheme must…
64a1112 
… begin with an alphabetical ASCII character. (pythonGH-99421)

Prevent urllib.parse.urlparse from accepting schemes that don't begin with an alphabetical ASCII character.

RFC 3986 defines a scheme like this: `scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )`
RFC 2234 defines an ALPHA like this: `ALPHA = %x41-5A / %x61-7A`

The WHATWG URL spec defines a scheme like this:
`"A URL-scheme string must be one ASCII alpha, followed by zero or more of ASCII alphanumeric, U+002B (+), U+002D (-), and U+002E (.)."`
(cherry picked from commit 439b9cf)

Co-authored-by: Ben Kallus <49924171+kenballus@users.noreply.github.com>
gentoo-bot pushed a commit to gentoo/cpython that referenced this pull request Sep 19, 2024
pythongh-99418: Make urllib.parse.urlparse enforce that a scheme must…
8ba4d66 
… begin with an alphabetical ASCII character. (pythonGH-99421)

Prevent urllib.parse.urlparse from accepting schemes that don't begin with an alphabetical ASCII character.

RFC 3986 defines a scheme like this: `scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )`
RFC 2234 defines an ALPHA like this: `ALPHA = %x41-5A / %x61-7A`

The WHATWG URL spec defines a scheme like this:
`"A URL-scheme string must be one ASCII alpha, followed by zero or more of ASCII alphanumeric, U+002B (+), U+002D (-), and U+002E (.)."`
(cherry picked from commit 439b9cf)

Co-authored-by: Ben Kallus <49924171+kenballus@users.noreply.github.com>
sajjaphani mentioned this pull request May 19, 2025
Closed
gentoo-bot pushed a commit to gentoo/cpython that referenced this pull request Jul 30, 2025
pythongh-99418: Make urllib.parse.urlparse enforce that a scheme must…
7e53cdb 
… begin with an alphabetical ASCII character. (pythonGH-99421)

Prevent urllib.parse.urlparse from accepting schemes that don't begin with an alphabetical ASCII character.

RFC 3986 defines a scheme like this: `scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )`
RFC 2234 defines an ALPHA like this: `ALPHA = %x41-5A / %x61-7A`

The WHATWG URL spec defines a scheme like this:
`"A URL-scheme string must be one ASCII alpha, followed by zero or more of ASCII alphanumeric, U+002B (+), U+002D (-), and U+002E (.)."`
(cherry picked from commit 439b9cf)

Co-authored-by: Ben Kallus <49924171+kenballus@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

gpshead gpshead approved these changes

Assignees

gpshead

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

Back | FazBrowse Home | New Git URL