GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — bpo-38576: Disallow control characters in hostnames in http.client by epicfaace · Pull Request #18995 · python/cpython

Conversation

@epicfaace

@epicfaace epicfaace commented Mar 14, 2020 •
edited by bedevere-bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Extends #12755 to apply to hostnames.

https://bugs.python.org/issue38576

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@epicfaace
add host validation for control characters
e3ad9a9
@the-knights-who-say-ni the-knights-who-say-ni added the CLA signed label Mar 14, 2020
@bedevere-bot bedevere-bot added the awaiting review label Mar 14, 2020
@blurb-it
📜🤖 Added by blurb_it.
54df435
@gpshead gpshead self-assigned this Mar 14, 2020
gpshead
gpshead approved these changes Mar 14, 2020
View reviewed changes
@bedevere-bot bedevere-bot added awaiting merge and removed awaiting review labels Mar 14, 2020
@gpshead gpshead added needs backport to 3.6 type-bug An unexpected behavior, bug, or error type-security A security issue labels Mar 14, 2020
@gpshead

gpshead commented Mar 14, 2020

Copy link
Copy Markdown
Member

Thanks!

While reviewing I also looked over the _get_hostport(host, port) call that happens before _validate_host(host). I do not believe that will cause any problems, the validation is still doing the right thing even if that transformed host to extract a port number.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@gpshead
gpshead merged commit 9165add into python:master Mar 14, 2020
@miss-islington

miss-islington commented Mar 14, 2020

Copy link
Copy Markdown
Contributor

Thanks @epicfaace for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.6, 3.7, 3.8.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot removed the awaiting merge label Mar 14, 2020
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Mar 14, 2020
@epicfaace @miss-islington
bpo-38576: Disallow control characters in hostnames in http.client (p…
f8213f0 
…ythonGH-18995)

Add host validation for control characters for more CVE-2019-18348 protection.
(cherry picked from commit 9165add)

Co-authored-by: Ashwin Ramaswami <[email protected]>
@bedevere-bot

bedevere-bot commented Mar 14, 2020

Copy link
Copy Markdown

GH-19000 is a backport of this pull request to the 3.8 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot removed the needs backport to 3.8 label Mar 14, 2020
@bedevere-bot

bedevere-bot commented Mar 14, 2020

Copy link
Copy Markdown

GH-19001 is a backport of this pull request to the 3.7 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot removed the needs backport to 3.7 label Mar 14, 2020
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Mar 14, 2020
@epicfaace @miss-islington
bpo-38576: Disallow control characters in hostnames in http.client (p…
1e24df6 
…ythonGH-18995)

Add host validation for control characters for more CVE-2019-18348 protection.
(cherry picked from commit 9165add)

Co-authored-by: Ashwin Ramaswami <[email protected]>
@bedevere-bot bedevere-bot removed the needs backport to 3.6 label Mar 14, 2020
@bedevere-bot

bedevere-bot commented Mar 14, 2020

Copy link
Copy Markdown

GH-19002 is a backport of this pull request to the 3.6 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Mar 14, 2020
@epicfaace @miss-islington
bpo-38576: Disallow control characters in hostnames in http.client (p…
66627ba 
…ythonGH-18995)

Add host validation for control characters for more CVE-2019-18348 protection.
(cherry picked from commit 9165add)

Co-authored-by: Ashwin Ramaswami <[email protected]>
miss-islington added a commit that referenced this pull request Mar 14, 2020
@miss-islington @epicfaace
bpo-38576: Disallow control characters in hostnames in http.client (G…
34f85af 
…H-18995)

Add host validation for control characters for more CVE-2019-18348 protection.
(cherry picked from commit 9165add)

Co-authored-by: Ashwin Ramaswami <[email protected]>
miss-islington added a commit that referenced this pull request Mar 14, 2020
@miss-islington @epicfaace
bpo-38576: Disallow control characters in hostnames in http.client (G…
ff69c9d 
…H-18995)

Add host validation for control characters for more CVE-2019-18348 protection.
(cherry picked from commit 9165add)

Co-authored-by: Ashwin Ramaswami <[email protected]>
@epicfaace
epicfaace deleted the url branch March 14, 2020 20:09
ned-deily pushed a commit that referenced this pull request Mar 14, 2020
@miss-islington @epicfaace
bpo-38576: Disallow control characters in hostnames in http.client (G…
83fc701 
…H-18995) (GH-19002)

Add host validation for control characters for more CVE-2019-18348 protection.
(cherry picked from commit 9165add)

Co-authored-by: Ashwin Ramaswami <[email protected]>
@tapakund

tapakund commented Mar 31, 2020

Copy link
Copy Markdown

#19231 is a back port of this PR to 3.5 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@tim-one tim-one mentioned this pull request Feb 28, 2022
Non-uniform random floats (_randommodule.c) #31606
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@gpshead gpshead

Labels

type-bug An unexpected behavior, bug, or error type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

6 participants

@epicfaace @gpshead @miss-islington @bedevere-bot @tapakund @the-knights-who-say-ni
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.