GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-67693: Fix urlunparse() and urlunsplit() for URIs with path starting with multiple slashes and no authority by serhiy-storchaka · Pull Request #113563 · python/cpython

Conversation

@serhiy-storchaka

@serhiy-storchaka serhiy-storchaka commented Dec 29, 2023 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

Based on #15297.

Co-authored-by: Ashwin Ramaswami [email protected]

  • Issue: urllib.parse doesn't round-trip file URI's with multiple leading slashes #78457
  • Issue: [CVE-2015-2104] Urlparse insufficient validation leads to open redirect #67693

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
epicfaace and others added 5 commits August 15, 2019 03:15
@epicfaace
fix: always add double slash if scheme is in uses_netloc
ff16c46
@blurb-it
📜🤖 Added by blurb_it.
151e39c
@epicfaace
Update 2019-08-27-01-16-50.bpo-34276.4NIAiy.rst
0e177fd
@serhiy-storchaka
Merge branch 'main' into urls
eea029d
@serhiy-storchaka
Fix urlunparse() and urlunsplit() for URIs with path starting with mu…
cc9067b 
…ltiple slashes and no authority.
@serhiy-storchaka serhiy-storchaka added needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes labels Dec 29, 2023
@bedevere-app bedevere-app Bot added the awaiting core review label Dec 29, 2023
@bedevere-app bedevere-app Bot mentioned this pull request Dec 29, 2023
urllib.parse doesn't round-trip file URI's with multiple leading slashes #78457
Closed
@serhiy-storchaka serhiy-storchaka mentioned this pull request Dec 29, 2023
[CVE-2015-2104] Urlparse insufficient validation leads to open redirect #67693
Closed
@serhiy-storchaka serhiy-storchaka changed the title gh-78457: Fix urlunparse() and urlunsplit() for URIs with path starting with multiple slashes and no authority gh-67693: Fix urlunparse() and urlunsplit() for URIs with path starting with multiple slashes and no authority Dec 29, 2023
@serhiy-storchaka serhiy-storchaka added needs backport to 3.8 labels Dec 29, 2023
@serhiy-storchaka

serhiy-storchaka commented Dec 29, 2023

Copy link
Copy Markdown
Member Author

It fixes also more serious security issue #67693.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
serhiy-storchaka added 2 commits December 29, 2023 16:32
@serhiy-storchaka
Change issue number.
fb03e5f
@serhiy-storchaka
Merge branch 'main' into urls2
26951a7
@serhiy-storchaka
serhiy-storchaka force-pushed the urls2 branch from b54b670 to 26951a7 Compare December 29, 2023 14:33
@serhiy-storchaka serhiy-storchaka added the type-security A security issue label Dec 29, 2023
@vadmium vadmium mentioned this pull request Apr 28, 2024
gh-87389: avoid treating path as URI with netloc #93894
Closed
@serhiy-storchaka serhiy-storchaka added the needs backport to 3.13 only security fixes label May 9, 2024
vadmium
vadmium reviewed May 12, 2024
View reviewed changes

@vadmium vadmium left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The code changes and tests look good to me.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread Misc/NEWS.d/next/Library/2019-08-27-01-16-50.gh-issue-67693.4NIAiy.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.
serhiy-storchaka added 3 commits May 13, 2024 12:00
@serhiy-storchaka
Delete Misc/NEWS.d/next/Library/2023-12-29-16-31-31.gh-issue-67693.qi…
7f495b0 
…Bhko.rst
@serhiy-storchaka
Merge branch 'main' into urls2
f5ab0c1
@serhiy-storchaka
Add few more tests.
62957fe
serhiy-storchaka
serhiy-storchaka commented May 13, 2024
View reviewed changes
Comment thread Lib/test/test_urlparse.py
('//path/to/file',
('', 'path', '/to/file', '', '', ''),
('', 'path', '/to/file', '', '')),
('////path/to/file',

@serhiy-storchaka serhiy-storchaka May 13, 2024

Copy link
Copy Markdown
Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This case was broken.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread Lib/test/test_urlparse.py
('scheme://path/to/file',
('scheme', 'path', '/to/file', '', '', ''),
('scheme', 'path', '/to/file', '', '')),
('scheme:////path/to/file',

@serhiy-storchaka serhiy-storchaka May 13, 2024

Copy link
Copy Markdown
Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This case was broken.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread Lib/test/test_urlparse.py
('file:///tmp/junk.txt',
('file', '', '/tmp/junk.txt', '', '', ''),
('file', '', '/tmp/junk.txt', '', '')),
('file:////tmp/junk.txt',

@serhiy-storchaka serhiy-storchaka May 13, 2024

Copy link
Copy Markdown
Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This case was broken.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread Lib/test/test_urlparse.py
('file:////tmp/junk.txt',
('file', '', '//tmp/junk.txt', '', '', ''),
('file', '', '//tmp/junk.txt', '', '')),
('file://///tmp/junk.txt',

@serhiy-storchaka serhiy-storchaka May 13, 2024

Copy link
Copy Markdown
Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This case was broken.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
sethmlarson
sethmlarson approved these changes May 13, 2024
View reviewed changes

@sethmlarson sethmlarson left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@serhiy-storchaka
serhiy-storchaka merged commit e237b25 into python:main May 14, 2024
@miss-islington-app

miss-islington-app Bot commented May 14, 2024

Copy link
Copy Markdown

Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.8, 3.9, 3.10, 3.11, 3.12, 3.13.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting core review label May 14, 2024
@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label May 14, 2024
@bedevere-app

bedevere-app Bot commented May 14, 2024

Copy link
Copy Markdown

GH-119026 is a backport of this pull request to the 3.10 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.10 label May 14, 2024
serhiy-storchaka added a commit to serhiy-storchaka/cpython that referenced this pull request May 14, 2024
@serhiy-storchaka
[3.10] pythongh-67693: Fix urlunparse() and urlunsplit() for URIs wit…
2b1df88 
…h path starting with multiple slashes and no authority (pythonGH-113563)

(cherry picked from commit e237b25)

Co-authored-by: Serhiy Storchaka <[email protected]>
@bedevere-app

bedevere-app Bot commented May 14, 2024

Copy link
Copy Markdown

GH-119027 is a backport of this pull request to the 3.9 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.9 label May 14, 2024
serhiy-storchaka added a commit to serhiy-storchaka/cpython that referenced this pull request May 14, 2024
@serhiy-storchaka
[3.9] pythongh-67693: Fix urlunparse() and urlunsplit() for URIs with…
ba0a885 
… path starting with multiple slashes and no authority (pythonGH-113563)

(cherry picked from commit e237b25)

Co-authored-by: Serhiy Storchaka <[email protected]>
@bedevere-app

bedevere-app Bot commented May 14, 2024

Copy link
Copy Markdown

GH-119028 is a backport of this pull request to the 3.8 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.8 label May 14, 2024
serhiy-storchaka added a commit to serhiy-storchaka/cpython that referenced this pull request May 14, 2024
@serhiy-storchaka
[3.10] pythongh-67693: Fix urlunparse() and urlunsplit() for URIs wit…
87d7223 
…h path starting with multiple slashes and no authority (pythonGH-113563)

(cherry picked from commit e237b25)

Co-authored-by: Serhiy Storchaka <[email protected]>
serhiy-storchaka added a commit that referenced this pull request May 14, 2024
@miss-islington @serhiy-storchaka
[3.13] gh-67693: Fix urlunparse() and urlunsplit() for URIs with path…
8720006 
… starting with multiple slashes and no authority (GH-113563) (GH-119023)

(cherry picked from commit e237b25)

Co-authored-by: Serhiy Storchaka <[email protected]>
serhiy-storchaka added a commit that referenced this pull request May 14, 2024
@miss-islington @serhiy-storchaka
[3.12] gh-67693: Fix urlunparse() and urlunsplit() for URIs with path…
387ff96 
… starting with multiple slashes and no authority (GH-113563) (GH-119024)

(cherry picked from commit e237b25)

Co-authored-by: Serhiy Storchaka <[email protected]>
@serhiy-storchaka serhiy-storchaka mentioned this pull request May 14, 2024
bpo-34276: round-trip file URI's with multiple leading slashes #15297
Closed
@JelleZijlstra JelleZijlstra mentioned this pull request May 28, 2024
backport a9a74da 3.13 #119642
Closed
@nineteendo nineteendo mentioned this pull request Jun 12, 2024
Add C implementation of os.path.splitroot() #102511
Closed
@matthewhughes934 matthewhughes934 mentioned this pull request Jun 23, 2024
Split up Windows tests relying on urlunparse behaviour pypa/pip#12788
Merged
matthewhughes934 pushed a commit to matthewhughes934/pip that referenced this pull request Jun 24, 2024
user @matthewhughes934
Split up Windows tests relying on urlunparse behaviour
16f0617 
There was a behavioural change to `urllib.parse.urlunparse`[1] that
affects some of our tests on Windows. With the understanding that the
new behaviour is indeed desired, split up some tests relying on this
behaviour depending on the version of Python.

The sample URL used to check this behaviour was taken from a test in the
upstream change (with the new behaviour this URL will round-trip
parsing)

[1] python/cpython#113563
pradyunsg pushed a commit to pypa/pip that referenced this pull request Jun 25, 2024
@matthewhughes934
Split up Windows tests relying on urlunparse behaviour (#12788)
5c389ec 
There was a behavioural change to `urllib.parse.urlunparse`[1] that
affects some of our tests on Windows. With the understanding that the
new behaviour is indeed desired, split up some tests relying on this
behaviour depending on the version of Python.

The sample URL used to check this behaviour was taken from a test in the
upstream change (with the new behaviour this URL will round-trip
parsing)

[1] python/cpython#113563
estyxx pushed a commit to estyxx/cpython that referenced this pull request Jul 17, 2024
@serhiy-storchaka @estyxx
pythongh-67693: Fix urlunparse() and urlunsplit() for URIs with path …
73e7fcf 
…starting with multiple slashes and no authority (pythonGH-113563)
This was referenced Jul 21, 2024
Investigate python3.12 http fs path parsing errors fsspec/universal_pathlib#233
Closed
upath._flavour: fix path parsing for HttpPath on Python3.12 fsspec/universal_pathlib#236
Merged
ambv pushed a commit that referenced this pull request Sep 4, 2024
@serhiy-storchaka
[3.11] gh-67693: Fix urlunparse() and urlunsplit() for URIs with path…
d0e8c10 
… starting with multiple slashes and no authority (GH-113563) (#119025)

(cherry picked from commit e237b25)
ambv pushed a commit that referenced this pull request Sep 4, 2024
@serhiy-storchaka
[3.10] gh-67693: Fix urlunparse() and urlunsplit() for URIs with path…
2fa5d70 
… starting with multiple slashes and no authority (GH-113563) (#119026)

(cherry picked from commit e237b25)
ambv added a commit that referenced this pull request Sep 4, 2024
@serhiy-storchaka @ambv
[3.8] gh-67693: Fix urlunparse() and urlunsplit() for URIs with path …
0a87812 
…starting with multiple slashes and no authority (GH-113563) (#119028)

(cherry picked from commit e237b25)

Co-authored-by: Łukasz Langa <[email protected]>
ambv added a commit that referenced this pull request Sep 5, 2024
@serhiy-storchaka @ambv
[3.9] gh-67693: Fix urlunparse() and urlunsplit() for URIs with path …
a5798d0 
…starting with multiple slashes and no authority (GH-113563) (#119027)

(cherry picked from commit e237b25)

Co-authored-by: Serhiy Storchaka <[email protected]>
Co-authored-by: Łukasz Langa <[email protected]>
@serhiy-storchaka serhiy-storchaka removed their assignment Jul 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vadmium vadmium vadmium left review comments
@sethmlarson sethmlarson sethmlarson approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@serhiy-storchaka @vadmium @sethmlarson @epicfaace
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.