Bug report

Bug description:

This next snippet can be found here.

def _splitnetloc(url, start=0):
    delim = len(url)   # position of end of domain part of url, default is end
    for c in '/?#':    # look for delimiters; the order is NOT important
        wdelim = url.find(c, start)        # find first of this delim
        if wdelim >= 0:                    # if found
            delim = min(delim, wdelim)     # use earliest delim position
    return url[start:delim], url[delim:]   # return (domain, rest)

As the title says, if the username or password part in the url (http://user:pass@domain.com/path) contains any special character (/?#), the path/query/fragment is obtained wrongly, because the function looks only for the first instance. This of course won't work if the searched characters are present in the string before the "@" symbol.

Possible fix ready, will opening a pr soon

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-110869: handle delim chars in user/pw (urllib) #110872