[Python-checkins] bpo-30458: Use InvalidURL instead of ValueError. (GH-13044)

Wed May 1 16:39:27 EDT 2019

https://github.com/python/cpython/commit/b7378d77289c911ca6a0c0afaf513879002df7d5
commit: b7378d77289c911ca6a0c0afaf513879002df7d5
branch: master
author: Gregory P. Smith <greg at krypto.org>
committer: GitHub <noreply at github.com>
date: 2019年05月01日T16:39:21-04:00
summary:
bpo-30458: Use InvalidURL instead of ValueError. (GH-13044)
Use http.client.InvalidURL instead of ValueError as the new error case's exception.
files:
A Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst
D Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-36276.51E-DA.rst
M Lib/http/client.py
M Lib/test/test_urllib.py

diff --git a/Lib/http/client.py b/Lib/http/client.py
index 99d6a68cf428..f71a062d2b57 100644
--- a/Lib/http/client.py
+++ b/Lib/http/client.py
@@ -1091,7 +1091,7 @@ def putrequest(self, method, url, skip_host=False,
 url = '/'
 # Prevent CVE-2019-9740.
 if match := _contains_disallowed_url_pchar_re.search(url):
- raise ValueError(f"URL can't contain control characters. {url!r} "
+ raise InvalidURL(f"URL can't contain control characters. {url!r} "
 f"(found at least {match.group()!r})")
 request = '%s %s %s' % (method, url, self._http_vsn_str)
 
diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py
index c5b23f935b27..7214492eca9d 100644
--- a/Lib/test/test_urllib.py
+++ b/Lib/test/test_urllib.py
@@ -343,11 +343,12 @@ def test_url_with_control_char_rejected(self):
 # calls urllib.parse.quote() on the URL which makes all of the
 # above attempts at injection within the url _path_ safe.
 escaped_char_repr = repr(char).replace('\\', r'\\')
+ InvalidURL = http.client.InvalidURL
 with self.assertRaisesRegex(
- ValueError, f"contain control.*{escaped_char_repr}"):
+ InvalidURL, f"contain control.*{escaped_char_repr}"):
 urllib.request.urlopen(f"http:{schemeless_url}")
 with self.assertRaisesRegex(
- ValueError, f"contain control.*{escaped_char_repr}"):
+ InvalidURL, f"contain control.*{escaped_char_repr}"):
 urllib.request.urlopen(f"https:{schemeless_url}")
 # This code path quotes the URL so there is no injection.
 resp = urlopen(f"http:{schemeless_url}")
@@ -367,10 +368,11 @@ def test_url_with_newline_header_injection_rejected(self):
 # urlopen uses FancyURLOpener which goes via a codepath that
 # calls urllib.parse.quote() on the URL which makes all of the
 # above attempts at injection within the url _path_ safe.
+ InvalidURL = http.client.InvalidURL
 with self.assertRaisesRegex(
- ValueError, r"contain control.*\\r.*(found at least . .)"):
+ InvalidURL, r"contain control.*\\r.*(found at least . .)"):
 urllib.request.urlopen(f"http:{schemeless_url}")
- with self.assertRaisesRegex(ValueError, r"contain control.*\\n"):
+ with self.assertRaisesRegex(InvalidURL, r"contain control.*\\n"):
 urllib.request.urlopen(f"https:{schemeless_url}")
 # This code path quotes the URL so there is no injection.
 resp = urlopen(f"http:{schemeless_url}")
diff --git a/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-36276.51E-DA.rst b/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst
similarity index 75%
rename from Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-36276.51E-DA.rst
rename to Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst
index 4fed4d545040..ed8027fb4d64 100644
--- a/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-36276.51E-DA.rst
+++ b/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst
@@ -1 +1 @@
-Address CVE-2019-9740 by disallowing URL paths with embedded whitespace or control characters through into the underlying http client request. Such potentially malicious header injection URLs now cause a ValueError to be raised.
\ No newline at end of file
+Address CVE-2019-9740 by disallowing URL paths with embedded whitespace or control characters through into the underlying http client request. Such potentially malicious header injection URLs now cause an http.client.InvalidURL exception to be raised.
