bpo-30458: Use InvalidURL instead of ValueError. #13044

gpshead · 2019-05-01T20:10:44Z

Change the fix to raise InvalidURL for consistency with other http.client APIs instead of ValueError.

https://bugs.python.org/issue30458


        bpo-30458: Use InvaludURL instead of ValueError.


        rename the news file to reference the non-duped issue.


        bpo-30458: Use InvalidURL instead of ValueError. (pythonGH-13044)

Use http.client.InvalidURL instead of ValueError as the new error case's exception.


        bpo-30458: Disallow control chars in http URLs. (pythonGH-12755)

Disallow control chars in http URLs in urllib.urlopen. This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected. Disable https related urllib tests on a build without ssl (pythonGH-13032) These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures. Use http.client.InvalidURL instead of ValueError as the new error case's exception. (pythonGH-13044) Co-Authored-By: Miro Hrončok <miro@hroncok.cz>


        bpo-30458: Disallow control chars in http URLs. (pythonGH-12755)

Disallow control chars in http URLs in urllib.urlopen. This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected. Disable https related urllib tests on a build without ssl (pythonGH-13032) These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures. Use http.client.InvalidURL instead of ValueError as the new error case's exception. (pythonGH-13044) Co-Authored-By: Miro Hrončok <miro@hroncok.cz>


        bpo-30458: Disallow control chars in http URLs. (GH-12755) (GH-13154)

Disallow control chars in http URLs in urllib.urlopen. This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected. Disable https related urllib tests on a build without ssl (GH-13032) These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures. Use http.client.InvalidURL instead of ValueError as the new error case's exception. (GH-13044) Backport Co-Authored-By: Miro Hrončok <miro@hroncok.cz>


        bpo-30458: Disallow control chars in http URLs. (GH-12755) (GH-13155)

Disallow control chars in http URLs in urllib.urlopen. This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected. Disable https related urllib tests on a build without ssl (GH-13032) These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures. Use http.client.InvalidURL instead of ValueError as the new error case's exception. (GH-13044) Co-Authored-By: Miro Hrončok <miro@hroncok.cz>


        bpo-30458: Disallow control chars in http URLs. (pythonGH-12755)

Disallow control chars in http URLs in urllib.urlopen. This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected. Disable https related urllib tests on a build without ssl (pythonGH-13032) These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures. Use http.client.InvalidURL instead of ValueError as the new error case's exception. (pythonGH-13044) Co-Authored-By: Miro Hrončok <miro@hroncok.cz>


        bpo-30458: Disallow control chars in http URLs. (pythonGH-12755) (pyt…

…honGH-13154) Disallow control chars in http URLs in urllib2.urlopen. This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected. Disable https related urllib tests on a build without ssl (pythonGH-13032) These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures. Use httplib.InvalidURL instead of ValueError as the new error case's exception. (pythonGH-13044) Backport Co-Authored-By: Miro Hrončok <miro@hroncok.cz> (cherry picked from commit 7e200e0) Notes on backport to Python 2.7: * test_urllib tests urllib.urlopen() which quotes the URL and so is not vulerable to HTTP Header Injection. * Add tests to test_urllib2 on urllib2.urlopen(). * Reject non-ASCII characters: range 0x80-0xff.


        bpo-30458: Disallow control chars in http URLs (GH-12755) (GH-13154) (G…

…H-13315) Disallow control chars in http URLs in urllib2.urlopen. This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected. Disable https related urllib tests on a build without ssl (GH-13032) These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures. Use httplib.InvalidURL instead of ValueError as the new error case's exception. (GH-13044) Backport Co-Authored-By: Miro Hrončok <miro@hroncok.cz> (cherry picked from commit 7e200e0) Notes on backport to Python 2.7: * test_urllib tests urllib.urlopen() which quotes the URL and so is not vulerable to HTTP Header Injection. * Add tests to test_urllib2 on urllib2.urlopen(). * Reject non-ASCII characters: range 0x80-0xff.


        bpo-30458: Disallow control chars in http URLs. (pythonGH-12755)

Disallow control chars in http URLs in urllib.urlopen. This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected. Disable https related urllib tests on a build without ssl (pythonGH-13032) These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures. Use http.client.InvalidURL instead of ValueError as the new error case's exception. (pythonGH-13044) Co-Authored-By: Miro Hrončok <miro@hroncok.cz> Signed-off-by: Tapas Kundu <tkundu@vmware.com>


        bpo-30458: Disallow control chars in http URLs. (GH-12755) (#13207)

Disallow control chars in http URLs in urllib.urlopen. This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected. Disable https related urllib tests on a build without ssl (GH-13032) These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures. Use http.client.InvalidURL instead of ValueError as the new error case's exception. (GH-13044) Co-Authored-By: Miro Hrončok <miro@hroncok.cz>

hemberger · 2019-07-17T17:58:13Z

After this change, the documentation for the InvalidURL exception is no longer accurate (it only mentions the port case): https://docs.python.org/3/library/http.client.html#http.client.InvalidURL

exception http.client.InvalidURL
A subclass of HTTPException, raised if a port is given and is either non-numeric or empty.

vstinner · 2019-07-29T16:31:19Z

Please open an issue at bugs.python.org to suggest updating InvalidURL documentation.


        bpo-30458: Disallow control chars in http URLs. (pythonGH-12755) (pyt…

…honGH-13154) Disallow control chars in http URLs in urllib.urlopen. This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected. Disable https related urllib tests on a build without ssl (pythonGH-13032) These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures. Use http.client.InvalidURL instead of ValueError as the new error case's exception. (pythonGH-13044) Backport Co-Authored-By: Miro Hrončok <miro@hroncok.cz>

bpo-30458: Use InvaludURL instead of ValueError.

Loading status checks…

bf8cef5

the-knights-who-say-ni added the CLA signed label May 1, 2019

bedevere-bot added the awaiting core review label May 1, 2019

gpshead self-assigned this May 1, 2019

gpshead changed the title ~~bpo-30458: Use InvaludURL instead of ValueError.~~ bpo-30458: Use InvalidURL instead of ValueError. May 1, 2019

rename the news file to reference the non-duped issue.

Loading status checks…

7146fb6

bedevere-bot removed the awaiting core review label May 1, 2019

gpshead deleted the gpshead:use-invalidurl-not-valueerror branch May 1, 2019

gpshead mentioned this pull request May 1, 2019

bpo-30458: Disallow control chars in http URLs. #12755

Merged

arnolddumas added a commit to arnolddumas/cpython that referenced this pull request May 3, 2019

bpo-30458: Use InvalidURL instead of ValueError. (pythonGH-13044)

1c1a63d

Use http.client.InvalidURL instead of ValueError as the new error case's exception.

This was referenced May 7, 2019

[3.7] bpo-30458: Disallow control chars in http URLs. (GH-12755) #13154

Merged

[3.6] bpo-30458: Disallow control chars in http URLs. (GH-12755) #13155

Merged

hroncok mentioned this pull request May 8, 2019

[3.5] bpo-30458: Disallow control chars in http URLs. (GH-12755) #13207

Merged

vstinner mentioned this pull request May 14, 2019

[2.7] bpo-30458: Disallow control chars in http URLs. (GH-12755) (GH-13154) #13315

Merged

mcepl mentioned this pull request May 31, 2019

After the python3 fix for CVE-2019-9740 test_null_bytes fails #1781

Closed

1 of 3 tasks complete

tapakund mentioned this pull request Jun 3, 2019

bpo-30458: Disallow control chars in http URLs. (GH-12755) #13771

Closed

python/cpython

bpo-30458: Use InvalidURL instead of ValueError. #13044

bpo-30458: Use InvalidURL instead of ValueError. #13044

gpshead commented May 1, 2019 •

edited by bedevere-bot

This comment has been minimized.

hemberger commented Jul 17, 2019 •

edited

This comment has been minimized.

vstinner commented Jul 29, 2019

Sponsor python/cpython

python/cpython

Join GitHub today

bpo-30458: Use InvalidURL instead of ValueError. #13044

bpo-30458: Use InvalidURL instead of ValueError. #13044

Conversation

gpshead commented May 1, 2019 • edited by bedevere-bot

This comment has been minimized.

hemberger commented Jul 17, 2019 • edited

This comment has been minimized.

vstinner commented Jul 29, 2019

gpshead commented May 1, 2019 •

edited by bedevere-bot

hemberger commented Jul 17, 2019 •

edited