GeezerVison

urllib.parse space handling CVE-2023-24329 appears unfixed #102153

Closed

bedevere-bot added the awaiting review label

illia-v mentioned this pull request

gh-102153: fix CVE-2023-24329 #102470

Closed


          Add a period

84231ba

AlexWaygood added the stdlib Standard Library Python modules in the Lib/ directory label

https://url.spec.whatwg.org/#concept-basic-url-parser

xiaoge1001 commented Mar 8, 2023

Copy link

Copy Markdown

It's great. it handle some bad input URLs and make urlsplit more robust.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

xiaoge1001 commented Mar 8, 2023

Copy link

Copy Markdown

Does anyone review #102470 or #102508?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

illia-v added 2 commits

March 8, 2023 14:15


          Simplify code

716e1c2


          Merge remote-tracking branch 'python/main' into pythongh-102153

d81766d

gpshead self-assigned this

Mar 8, 2023

gpshead commented Mar 9, 2023

Copy link

Copy Markdown

Member

This PR moves us in the direction I'd like to see the APIs go. I'm not sure it could ever be backported as a security fix for the long list of analysis reasons I just posted over in the Issue, but it might make sense in 3.12.

I believe there's still an open question of trailing spaces on paths potentially carrying meaning in some (presumably not-HTTP) scenarios (see the Issue analysis). So stripping all of the C0 characters early on might not be the right approach. But they should be stripped from most places. Lets keep this PR around as a likely option.

(I'll still put a do-not-submit tag on it for now, just as an indicator that we're not ready to accept it yet).

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

gpshead added the DO-NOT-MERGE label

Mar 9, 2023

xiaoge1001 commented Mar 25, 2023 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Is it planned to merge the current patch to python3.12? I don't find there's been any discussion recently.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

gpshead added 2 commits

April 27, 2023 15:27


          Expand the constant instead of computing it at import time.

a13bf41


          Only lstrip the URL to avoid breaking applications.

c863a81

Many existing applications rely (for better or worse) on the trailing spaces
being preserved by this API.  So this moves more conservative and keeps those.
The issue this change is addressing is triggered by leading spaces.

One example library relyong on behavior: Django's URL validator library (at
least in Django 3.2 and earlier; I have not checked later versions).  If
trailing spaces are stripped, its logic that involves urllib.parse for one logic
path within its checks can fail to reject some URLs as invalid.

gpshead removed the DO-NOT-MERGE label

May 2, 2023


          Fix the unittests to allow trailing C0

fd3e429

Also be explicit about specifying utf-8 on encode and decode.

gpshead commented May 2, 2023

Copy link

Copy Markdown

Member

Results from internal testing across a huge body of code (including test suites of many open source libraries and applications): Stripping the C0 characters from the left hand side doesn't appear to cause any problems. Stripping them from the right hand side of the URL does, as existing code calling urllib.parse such as django.core.validators.URLValidator.__call__ (at least up through 3.2, the code has changed slightly in 4.2 but I believe that remains true).

i've updated the PR to use lstrip on the url.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

gpshead commented May 2, 2023

Copy link

Copy Markdown

Member

I'm a lot more confident that we could actually backport this as a security bug fix without breaking the world now.

As for documentation to be added to warn users of these APIs, I'm not quite sure how to word that and what to convey yet. I've opened up as a discussion in https://discuss.python.org/t/how-to-word-a-warning-about-security-uses-in-urllib-parse-docs/26399.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

gpshead added type-security

A security issue

type-bug An unexpected behavior, bug, or error labels

May 2, 2023

frenzymadness reviewed

May 3, 2023

View reviewed changes

frenzymadness left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The first beta is expected to be released on Monday and it'd be very nice to have this in the release.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

Doc/library/urllib.parse.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

Misc/NEWS.d/next/Security/2023-03-07-20-59-17.gh-issue-102153.14CLSZ.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.

gpshead and others added 2 commits

May 3, 2023 14:20


          remove a duplicate word

456d238

Co-authored-by: Lumír 'Frenzy' Balhar <[email protected]>


          Update 2023-03-07-20-59-17.gh-issue-102153.14CLSZ.rst

0f7f9ea

remove "trailing"

gpshead commented May 3, 2023

Copy link

Copy Markdown

Member

I intend to get this in before the next releases are cut. The last bit is for me to add some appropriate text to the urllib.parse documentation recommending that people verify that the outputs from the API makes sense before trusting any of them.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

frenzymadness commented May 15, 2023

Copy link

Copy Markdown

Contributor

We have one week to the first beta. Is there anything I can help you with?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.


          Add urlparse and urlsplit security warnings.

a510652

The added section describing the situation is longer than I might want,
but being more brief just leaves open questions.

This is a lighter worded version of my original text proposed in
https://discuss.python.org/t/how-to-word-a-warning-about-security-uses-in-urllib-parse-docs/26399

gpshead added needs backport to 3.11

only security fixes

needs backport to 3.10 labels

May 17, 2023

stratakis pushed a commit to stratakis/cpython that referenced this pull request

Feb 22, 2024


          00399: CVE-2023-24329

421b8bf

pythongh-102153: Start stripping C0 control and space chars in `urlsplit` (pythonGH-102508)

`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit pythonGH-25595.

This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).

Backported from Python 3.12

(cherry picked from commit f48a96a)

Co-authored-by: Illia Volochii <[email protected]>
Co-authored-by: Gregory P. Smith [Google] <[email protected]>

stratakis pushed a commit to stratakis/cpython that referenced this pull request

Feb 27, 2024


          00399: CVE-2023-24329

4c5f976

pythongh-102153: Start stripping C0 control and space chars in `urlsplit` (pythonGH-102508)

`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit pythonGH-25595.

This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).

Backported from Python 3.12

(cherry picked from commit f48a96a)

Co-authored-by: Illia Volochii <[email protected]>
Co-authored-by: Gregory P. Smith [Google] <[email protected]>

hroncok pushed a commit to fedora-python/cpython that referenced this pull request

Mar 7, 2024


          00399: CVE-2023-24329

5e561bb

pythongh-102153: Start stripping C0 control and space chars in `urlsplit` (pythonGH-102508)

`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit pythonGH-25595.

This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).

Backported from Python 3.12

(cherry picked from commit f48a96a)

Co-authored-by: Illia Volochii <[email protected]>
Co-authored-by: Gregory P. Smith [Google] <[email protected]>

stratakis pushed a commit to stratakis/cpython that referenced this pull request

Mar 11, 2024


          00399: CVE-2023-24329

ee0a83c

pythongh-102153: Start stripping C0 control and space chars in `urlsplit` (pythonGH-102508)

`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit pythonGH-25595.

This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).

Backported from Python 3.12

(cherry picked from commit f48a96a)

Co-authored-by: Illia Volochii <[email protected]>
Co-authored-by: Gregory P. Smith [Google] <[email protected]>

stratakis pushed a commit to stratakis/cpython that referenced this pull request

Mar 11, 2024


          00399: CVE-2023-24329

0553a38

pythongh-102153: Start stripping C0 control and space chars in `urlsplit` (pythonGH-102508)

`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit pythonGH-25595.

This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).

Backported from Python 3.12

(cherry picked from commit f48a96a)

Co-authored-by: Illia Volochii <[email protected]>
Co-authored-by: Gregory P. Smith [Google] <[email protected]>

stratakis pushed a commit to stratakis/cpython that referenced this pull request


          00399: CVE-2023-24329

4b56e54

pythongh-102153: Start stripping C0 control and space chars in `urlsplit` (pythonGH-102508)

`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit pythonGH-25595.

This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).

Backported from Python 3.12

(cherry picked from commit f48a96a)

Co-authored-by: Illia Volochii <[email protected]>
Co-authored-by: Gregory P. Smith [Google] <[email protected]>

stratakis pushed a commit to stratakis/cpython that referenced this pull request


          00399: CVE-2023-24329

62c95c7

pythongh-102153: Start stripping C0 control and space chars in `urlsplit` (pythonGH-102508)

`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit pythonGH-25595.

This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).

Backported from Python 3.12

(cherry picked from commit f48a96a)

Co-authored-by: Illia Volochii <[email protected]>
Co-authored-by: Gregory P. Smith [Google] <[email protected]>

stratakis pushed a commit to stratakis/cpython that referenced this pull request


          00399: CVE-2023-24329

4322ca4

pythongh-102153: Start stripping C0 control and space chars in `urlsplit` (pythonGH-102508)

`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit pythonGH-25595.

This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).

Backported from Python 3.12

(cherry picked from commit f48a96a)

Co-authored-by: Illia Volochii <[email protected]>
Co-authored-by: Gregory P. Smith [Google] <[email protected]>

stratakis pushed a commit to stratakis/cpython that referenced this pull request

Space at end of query string is trimmed scrapy/w3lib#223


          00399: CVE-2023-24329

8d38b3b

pythongh-102153: Start stripping C0 control and space chars in `urlsplit` (pythonGH-102508)

`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit pythonGH-25595.

This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).

Backported from Python 3.12

(cherry picked from commit f48a96a)

Co-authored-by: Illia Volochii <[email protected]>
Co-authored-by: Gregory P. Smith [Google] <[email protected]>

stratakis pushed a commit to stratakis/cpython that referenced this pull request

Mar 25, 2024


          00399: CVE-2023-24329

f720eab

pythongh-102153: Start stripping C0 control and space chars in `urlsplit` (pythonGH-102508)

`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit pythonGH-25595.

This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).

Backported from Python 3.12

(cherry picked from commit f48a96a)

Co-authored-by: Illia Volochii <[email protected]>
Co-authored-by: Gregory P. Smith [Google] <[email protected]>

hroncok pushed a commit to fedora-python/cpython that referenced this pull request

Mar 26, 2024


          00399: CVE-2023-24329

f305882

pythongh-102153: Start stripping C0 control and space chars in `urlsplit` (pythonGH-102508)

`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit pythonGH-25595.

This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).

Backported from Python 3.12

(cherry picked from commit f48a96a)

Co-authored-by: Illia Volochii <[email protected]>
Co-authored-by: Gregory P. Smith [Google] <[email protected]>

mcepl pushed a commit to openSUSE-Python/cpython that referenced this pull request

Apr 2, 2024


          00399: CVE-2023-24329

db0789f

pythongh-102153: Start stripping C0 control and space chars in `urlsplit` (pythonGH-102508)

`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit pythonGH-25595.

This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).

Backported from Python 3.12

(cherry picked from commit f48a96a)

Co-authored-by: Illia Volochii <[email protected]>
Co-authored-by: Gregory P. Smith [Google] <[email protected]>

wRAR mentioned this pull request

Jan 31, 2025

Closed

hrnciar pushed a commit to fedora-python/cpython that referenced this pull request

Apr 23, 2025


          00399: CVE-2023-24329

6d0cba9

pythongh-102153: Start stripping C0 control and space chars in `urlsplit` (pythonGH-102508)

`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit pythonGH-25595.

This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).

Backported from Python 3.12

(cherry picked from commit f48a96a)

Co-authored-by: Illia Volochii <[email protected]>
Co-authored-by: Gregory P. Smith [Google] <[email protected]>

hroncok pushed a commit to fedora-python/cpython that referenced this pull request

Jul 4, 2025


          00399: CVE-2023-24329

180a5d1

pythongh-102153: Start stripping C0 control and space chars in `urlsplit` (pythonGH-102508)

`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit pythonGH-25595.

This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).

Backported from Python 3.12

(cherry picked from commit f48a96a)

Co-authored-by: Illia Volochii <[email protected]>
Co-authored-by: Gregory P. Smith [Google] <[email protected]>

frenzymadness pushed a commit to fedora-python/cpython that referenced this pull request

Aug 12, 2025


          00399: CVE-2023-24329

19f1a43

pythongh-102153: Start stripping C0 control and space chars in `urlsplit` (pythonGH-102508)

`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit pythonGH-25595.

This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329).

Backported from Python 3.12

(cherry picked from commit f48a96a)

Co-authored-by: Illia Volochii <[email protected]>
Co-authored-by: Gregory P. Smith [Google] <[email protected]>

benja-M-1 mentioned this pull request

Sep 19, 2025

Update PSF-2023-1 psf/advisory-database#80

Merged

MuhammadAnnaqeeb mentioned this pull request

Oct 7, 2025

The actual minimal python that runs Odoo 19 is 3.10.12 odoo/documentation#14790

Open

xmo-odoo added a commit to odoo-dev/odoo that referenced this pull request


          [FIX] core: inline _WHATWG_C0_CONTROL_OR_SPACE

51a2a51

This is a private variable of the stdlib, it was added in Python
3.12 (python/cpython#102508) and only backported to
3.11.4 (cpython/python#104575) and 3.10.12 (cpython/python#104592) so
is not necessarily available in versions of 3.10 and 3.11 clients
might be running. So embed the content into the file directly to avoid
depending on the stdlib. Not to mention the concept of C0 is not
exactly novel or mutable.

Also inline it in its sole use, there's no reason to have multiple
string literals and a runtime concatenation.

Fixes odoo#230990

xmo-odoo mentioned this pull request

[FIX] core: inline _WHATWG_C0_CONTROL_OR_SPACE odoo/odoo#231371

Closed

robodoo pushed a commit to odoo/odoo that referenced this pull request


          [FIX] core: inline _WHATWG_C0_CONTROL_OR_SPACE

This is a private variable of the stdlib, it was added in Python 3.12 (python/cpython#102508) and only backported to 3.11.4 (python/cpython#104575) and 3.10.12 (python/cpython#104592) so is not necessarily available in versions of 3.10 and 3.11 clients might be running. So embed the content into the file directly to avoid depending on the stdlib. Not to mention the concept of C0 is not exactly novel or mutable.

Also inline it in its sole use, there's no reason to have multiple string literals and a runtime concatenation.

Fixes #230990

closes #231371

Signed-off-by: Xavier Morel (xmo) <[email protected]>

fw-bot pushed a commit to odoo-dev/odoo that referenced this pull request


          [FIX] core: inline _WHATWG_C0_CONTROL_OR_SPACE

f2cf560

This is a private variable of the stdlib, it was added in Python
3.12 (python/cpython#102508) and only backported to
3.11.4 (cpython/python#104575) and 3.10.12 (cpython/python#104592) so
is not necessarily available in versions of 3.10 and 3.11 clients
might be running. So embed the content into the file directly to avoid
depending on the stdlib. Not to mention the concept of C0 is not
exactly novel or mutable.

Also inline it in its sole use, there's no reason to have multiple
string literals and a runtime concatenation.

Fixes odoo#230990

X-original-commit: 0374281

fw-bot mentioned this pull request

[FIX] core: inline _WHATWG_C0_CONTROL_OR_SPACE odoo/odoo#231428

Closed

robodoo pushed a commit to odoo/odoo that referenced this pull request