Skip to content

/ cpython

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bpo-30458: Disable https related urllib tests on a build without ssl #13032

Merged
merged 1 commit into from May 1, 2019
Merged

bpo-30458: Disable https related urllib tests on a build without ssl #13032

merged 1 commit into from May 1, 2019
+2 −0

Conversation

@tirkarthi
Copy link
Member

tirkarthi commented May 1, 2019 •
edited by bedevere-bot

These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures.

https://bugs.python.org/issue30458
@tirkarthi
Disable https related urllib tests on a build without ssl
Loading status checks…
9f64bcb
@auvipy
auvipy approved these changes May 1, 2019
View changes
@gpshead gpshead self-assigned this May 1, 2019
@gpshead
gpshead approved these changes May 1, 2019
View changes
Copy link
Member

gpshead left a comment

thanks!
@miss-islington

This comment has been minimized.

Sign in to view
Copy link

miss-islington commented May 1, 2019

@tirkarthi: Status check is done, and it's a success ✅ .
@miss-islington miss-islington merged commit 2fc936e into python:master May 1, 2019
5 checks passed
5 checks passed
Azure Pipelines PR #20190501.7 succeeded
Details
bedevere/issue-number Issue number 30458 found
Details
bedevere/news "skip news" label found
continuous-integration/appveyor/pr AppVeyor build succeeded
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details
arnolddumas added a commit to arnolddumas/cpython that referenced this pull request May 3, 2019
@tirkarthi @arnolddumas
bpo-30458: Disable https related urllib tests on a build without ssl (p…
39d505e 
…ythonGH-13032)

These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures.


https://bugs.python.org/issue30458
hroncok added a commit to hroncok/cpython that referenced this pull request May 7, 2019
@gpshead @hroncok
bpo-30458: Disallow control chars in http URLs. (pythonGH-12755)
233e321 
Disallow control chars in http URLs in urllib.urlopen.  This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected.

Disable https related urllib tests on a build without ssl (pythonGH-13032)
These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures.

Use http.client.InvalidURL instead of ValueError as the new error case's exception. (pythonGH-13044)

Co-Authored-By: Miro Hrončok <miro@hroncok.cz>
This was referenced May 7, 2019
Merged
Merged
hroncok added a commit to hroncok/cpython that referenced this pull request May 7, 2019
@gpshead @hroncok
bpo-30458: Disallow control chars in http URLs. (pythonGH-12755)
50fe2a1 
Disallow control chars in http URLs in urllib.urlopen.  This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected.

Disable https related urllib tests on a build without ssl (pythonGH-13032)
These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures.

Use http.client.InvalidURL instead of ValueError as the new error case's exception. (pythonGH-13044)

Co-Authored-By: Miro Hrončok <miro@hroncok.cz>
gpshead added a commit that referenced this pull request May 7, 2019
@hroncok @gpshead
bpo-30458: Disallow control chars in http URLs. (GH-12755) (GH-13154)
Loading status checks…
7e200e0 
Disallow control chars in http URLs in urllib.urlopen.  This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected.

Disable https related urllib tests on a build without ssl (GH-13032)
These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures.

Use http.client.InvalidURL instead of ValueError as the new error case's exception. (GH-13044)

Backport Co-Authored-By: Miro Hrončok <miro@hroncok.cz>
ned-deily added a commit that referenced this pull request May 8, 2019
@hroncok @ned-deily
bpo-30458: Disallow control chars in http URLs. (GH-12755) (GH-13155)
Loading status checks…
c50d437 
Disallow control chars in http URLs in urllib.urlopen.  This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected.

Disable https related urllib tests on a build without ssl (GH-13032)
These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures.

Use http.client.InvalidURL instead of ValueError as the new error case's exception. (GH-13044)

Co-Authored-By: Miro Hrončok <miro@hroncok.cz>
hroncok added a commit to hroncok/cpython that referenced this pull request May 8, 2019
@gpshead @hroncok
bpo-30458: Disallow control chars in http URLs. (pythonGH-12755)
d46584b 
Disallow control chars in http URLs in urllib.urlopen.  This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected.

Disable https related urllib tests on a build without ssl (pythonGH-13032)
These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures.

Use http.client.InvalidURL instead of ValueError as the new error case's exception. (pythonGH-13044)

Co-Authored-By: Miro Hrončok <miro@hroncok.cz>
@hroncok hroncok mentioned this pull request May 8, 2019
Merged
vstinner added a commit to vstinner/cpython that referenced this pull request May 14, 2019
@hroncok @vstinner
bpo-30458: Disallow control chars in http URLs. (pythonGH-12755) (pyt…
8af9afd 
…honGH-13154)

Disallow control chars in http URLs in urllib2.urlopen.  This
addresses a potential security problem for applications that do not
sanity check their URLs where http request headers could be injected.

Disable https related urllib tests on a build without ssl (pythonGH-13032)
These tests require an SSL enabled build. Skip these tests when
python is built without SSL to fix test failures.

Use httplib.InvalidURL instead of ValueError as the new error case's
exception. (pythonGH-13044)

Backport Co-Authored-By: Miro Hrončok <miro@hroncok.cz>

(cherry picked from commit 7e200e0)

Notes on backport to Python 2.7:

* test_urllib tests urllib.urlopen() which quotes the URL and so is
  not vulerable to HTTP Header Injection.
* Add tests to test_urllib2 on urllib2.urlopen().
* Reject non-ASCII characters: range 0x80-0xff.
@vstinner vstinner mentioned this pull request May 14, 2019
Merged
vstinner added a commit that referenced this pull request May 21, 2019
@vstinner
bpo-30458: Disallow control chars in http URLs (GH-12755) (GH-13154) (G…
Verified
This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
Loading status checks…
bb8071a 
…H-13315)

Disallow control chars in http URLs in urllib2.urlopen.  This
addresses a potential security problem for applications that do not
sanity check their URLs where http request headers could be injected.

Disable https related urllib tests on a build without ssl (GH-13032)
These tests require an SSL enabled build. Skip these tests when
python is built without SSL to fix test failures.

Use httplib.InvalidURL instead of ValueError as the new error case's
exception. (GH-13044)

Backport Co-Authored-By: Miro Hrončok <miro@hroncok.cz>

(cherry picked from commit 7e200e0)

Notes on backport to Python 2.7:

* test_urllib tests urllib.urlopen() which quotes the URL and so is
  not vulerable to HTTP Header Injection.
* Add tests to test_urllib2 on urllib2.urlopen().
* Reject non-ASCII characters: range 0x80-0xff.
tapakund added a commit to tapakund/cpython that referenced this pull request Jun 3, 2019
@tapakund
bpo-30458: Disallow control chars in http URLs. (pythonGH-12755)
5cd3bca 
Disallow control chars in http URLs in urllib.urlopen.  This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected.

Disable https related urllib tests on a build without ssl (pythonGH-13032)
These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures.

Use http.client.InvalidURL instead of ValueError as the new error case's exception. (pythonGH-13044)

Co-Authored-By: Miro Hrončok <miro@hroncok.cz>

Signed-off-by: Tapas Kundu <tkundu@vmware.com>
@tapakund tapakund mentioned this pull request Jun 3, 2019
Closed
larryhastings added a commit that referenced this pull request Jul 14, 2019
@hroncok @larryhastings
bpo-30458: Disallow control chars in http URLs. (GH-12755) (#13207)
Loading status checks…
afe3a49 
Disallow control chars in http URLs in urllib.urlopen.  This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected.

Disable https related urllib tests on a build without ssl (GH-13032)
These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures.

Use http.client.InvalidURL instead of ValueError as the new error case's exception. (GH-13044)

Co-Authored-By: Miro Hrončok <miro@hroncok.cz>
mingwandroid added a commit to mingwandroid/cpython that referenced this pull request Aug 9, 2019
@hroncok @mingwandroid
bpo-30458: Disallow control chars in http URLs. (pythonGH-12755) (pyt…
b528811 
…honGH-13154)

Disallow control chars in http URLs in urllib.urlopen.  This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected.

Disable https related urllib tests on a build without ssl (pythonGH-13032)
These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures.

Use http.client.InvalidURL instead of ValueError as the new error case's exception. (pythonGH-13044)

Backport Co-Authored-By: Miro Hrončok <miro@hroncok.cz>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@gpshead gpshead

@auvipy auvipy

Assignees

@gpshead gpshead

Labels
🤖 automerge CLA signed skip news type-tests
Projects
None yet
Milestone
No milestone
6 participants
@tirkarthi @miss-islington @gpshead @auvipy @the-knights-who-say-ni @bedevere-bot
You can’t perform that action at this time.