Message237096
| Author |
vstinner |
| Recipients |
benjamin.peterson, martin.panter, orsenthil, pitrou, python-dev, soilandreyes, vstinner, yaaboukir |
| Date |
2015年03月03日.00:11:47 |
| SpamBayes Score |
-1.0 |
| Marked as misclassified |
Yes |
| Message-id |
<1425341507.11.0.406157106116.issue23505@psf.upfronthosting.co.za> |
| In-reply-to |
| Content |
>>> urlparse("//evil.com")
ParseResult(scheme='', netloc='evil.com', path='', params='', query='', fragment='')
I see evil.com in the netloc field, ok. But Firefox doesn't use Python to parse and url, and typing //evil.com in the address bar converts the address to file:////evil.com. Not a website, but a local file.
So I don't understand the redirection part. Could you maybe write a vulnerable CGI script to demonstrate the bug?
I wrote the following HTML file to try to understand the bug, but I was only able to show the content of my local file /etc/issue:
<head>
<META http-equiv="refresh" content="5;URL=////etc/issue">
</head>
<p><a href="////etc/issue">issue</a></p> |
|