FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

bpo-38576: Disallow control characters in hostnames in http.client by epicfaace · Pull Request #18995 · python/cpython · GitHub

  1. python
  2. cpython

Repository navigation

bpo-38576: Disallow control characters in hostnames in http.client - #18995

Merged
gpshead merged 2 commits into
python:masterfrom
epicfaace:url
Mar 14, 2020
ConversationCommits (2)ChecksFiles changed
Merged

bpo-38576: Disallow control characters in hostnames in http.client#18995
gpshead merged 2 commits into
python:masterfrom
epicfaace:url

Conversation

epicfaace commented Mar 14, 2020 •
edited by bedevere-bot
Loading

Copy link
Copy Markdown
Contributor

Extends #12755 to apply to hostnames.

https://bugs.python.org/issue38576

gpshead self-assigned this Mar 14, 2020
gpshead added needs backport to 3.6 type-bug An unexpected behavior, bug, or error type-security A security issue labels Mar 14, 2020

gpshead commented Mar 14, 2020

Copy link
Copy Markdown
Member

Thanks!

While reviewing I also looked over the _get_hostport(host, port) call that happens before _validate_host(host). I do not believe that will cause any problems, the validation is still doing the right thing even if that transformed host to extract a port number.

gpshead merged commit 9165add into python:master Mar 14, 2020

miss-islington commented Mar 14, 2020

Copy link
Copy Markdown
Contributor

Thanks @epicfaace for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.6, 3.7, 3.8.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Mar 14, 2020
bpo-38576: Disallow control characters in hostnames in http.client (p…
f8213f0 
…ythonGH-18995)

Add host validation for control characters for more CVE-2019-18348 protection.
(cherry picked from commit 9165add)

Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>

bedevere-bot commented Mar 14, 2020

Copy link
Copy Markdown

GH-19000 is a backport of this pull request to the 3.8 branch.

bedevere-bot commented Mar 14, 2020

Copy link
Copy Markdown

GH-19001 is a backport of this pull request to the 3.7 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Mar 14, 2020
bpo-38576: Disallow control characters in hostnames in http.client (p…
1e24df6 
…ythonGH-18995)

Add host validation for control characters for more CVE-2019-18348 protection.
(cherry picked from commit 9165add)

Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>

bedevere-bot commented Mar 14, 2020

Copy link
Copy Markdown

GH-19002 is a backport of this pull request to the 3.6 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Mar 14, 2020
bpo-38576: Disallow control characters in hostnames in http.client (p…
66627ba 
…ythonGH-18995)

Add host validation for control characters for more CVE-2019-18348 protection.
(cherry picked from commit 9165add)

Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>
miss-islington added a commit that referenced this pull request Mar 14, 2020
bpo-38576: Disallow control characters in hostnames in http.client (G…
34f85af 
…H-18995)

Add host validation for control characters for more CVE-2019-18348 protection.
(cherry picked from commit 9165add)

Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>
miss-islington added a commit that referenced this pull request Mar 14, 2020
bpo-38576: Disallow control characters in hostnames in http.client (G…
ff69c9d 
…H-18995)

Add host validation for control characters for more CVE-2019-18348 protection.
(cherry picked from commit 9165add)

Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>
epicfaace deleted the url branch March 14, 2020 20:09
ned-deily pushed a commit that referenced this pull request Mar 14, 2020
bpo-38576: Disallow control characters in hostnames in http.client (G…
83fc701 
…H-18995) (GH-19002)

Add host validation for control characters for more CVE-2019-18348 protection.
(cherry picked from commit 9165add)

Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>

tapakund commented Mar 31, 2020

Copy link
Copy Markdown

#19231 is a back port of this PR to 3.5 branch.

tim-one mentioned this pull request Feb 28, 2022
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

gpshead gpshead approved these changes

Assignees

gpshead

Labels

type-bug An unexpected behavior, bug, or error type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

Back | FazBrowse Home | New Git URL