[Python-checkins] r88820 - in python/branches/release25-maint: Lib/urllib.py Lib/urllib2.py Misc/NEWS

Sun Apr 17 22:43:48 CEST 2011

Author: martin.v.loewis
Date: Sun Apr 17 22:43:47 2011
New Revision: 88820
Log:
hg ca3b117c40f3 by guido at google.com
Add FTP to the allowed url schemes. Add Misc/NEWS.
Modified:
 python/branches/release25-maint/Lib/urllib.py
 python/branches/release25-maint/Lib/urllib2.py
 python/branches/release25-maint/Misc/NEWS
Modified: python/branches/release25-maint/Lib/urllib.py
==============================================================================

--- python/branches/release25-maint/Lib/urllib.py	(original)
+++ python/branches/release25-maint/Lib/urllib.py	Sun Apr 17 22:43:47 2011
@@ -643,10 +643,11 @@
 newurl = basejoin(self.type + ":" + url, newurl)
 
 # For security reasons we do not allow redirects to protocols
- # other than HTTP or HTTPS.
+ # other than HTTP, HTTPS or FTP.
 newurl_lower = newurl.lower()
 if not (newurl_lower.startswith('http://') or
- newurl_lower.startswith('https://')):
+ newurl_lower.startswith('https://') or
+ newurl_lower.startswith('ftp://')):
 return
 
 void = fp.read()
Modified: python/branches/release25-maint/Lib/urllib2.py
==============================================================================
--- python/branches/release25-maint/Lib/urllib2.py	(original)
+++ python/branches/release25-maint/Lib/urllib2.py	Sun Apr 17 22:43:47 2011
@@ -556,10 +556,11 @@
 newurl = urlparse.urljoin(req.get_full_url(), newurl)
 
 # For security reasons we do not allow redirects to protocols
- # other than HTTP or HTTPS.
+ # other than HTTP, HTTPS or FTP.
 newurl_lower = newurl.lower()
 if not (newurl_lower.startswith('http://') or
- newurl_lower.startswith('https://')):
+ newurl_lower.startswith('https://') or
+ newurl_lower.startswith('ftp://')):
 return
 
 # XXX Probably want to forget about the state of the current
Modified: python/branches/release25-maint/Misc/NEWS
==============================================================================
--- python/branches/release25-maint/Misc/NEWS	(original)
+++ python/branches/release25-maint/Misc/NEWS	Sun Apr 17 22:43:47 2011
@@ -12,6 +12,9 @@
 Library
 -------
 
+- Issue #11662: Make urllib and urllib2 ignore redirections if the
+ scheme is not HTTP, HTTPS or FTP. This fixes a security hole.
+
 - Issue #8674: Fixed a number of incorrect or undefined-behaviour-inducing
 overflow checks in the audioop module (CVE-2010-1634).
 
