Merge issue 11662 from 2.5.

diff --cc Lib/test/test_urllib.py
index 402309ce3e712101217ae6d28c3eec294c896b22,72db1ef29c14b6c7f799b50c9f90ec8a4d3abc0c..84b6f253ab74abaf7004227ace9091bf7ad4b88e
--- 1/Lib/test/test_urllib.py
--- 2/Lib/test/test_urllib.py
+++ b/Lib/test/test_urllib.py
@@@ -162,9 -122,23 +162,23 @@@ Content-Type: text/html; charset=iso-88
          finally:
              self.unfakehttp()
  
+     def test_invalid_redirect(self):
+         # urlopen() should raise IOError for many error codes.
+         self.fakehttp("""HTTP/1.1 302 Found
+ Date: Wed, 02 Jan 2008 03:03:54 GMT
+ Server: Apache/1.3.33 (Debian GNU/Linux) mod_ssl/2.8.22 OpenSSL/0.9.7e
+ Location: file:README
+ Connection: close
+ Content-Type: text/html; charset=iso-8859-1
+ """)
+         try:
+             self.assertRaises(IOError, urllib.urlopen, "http://python.org/")
+         finally:
+             self.unfakehttp()
+ 
      def test_empty_socket(self):
 -        """urlopen() raises IOError if the underlying socket does not send any
 -        data. (#1680230) """
 +        # urlopen() raises IOError if the underlying socket does not send any
 +        # data. (#1680230)
          self.fakehttp('')
          try:
              self.assertRaises(IOError, urllib.urlopen, 'http://something')

diff --cc Lib/test/test_urllib2.py
Simple merge

diff --cc Lib/urllib.py
Simple merge

diff --cc Lib/urllib2.py
index ca74c9f22d386dba513ec6201035a435a1f31a9c,a537d3630e7900276b996858de69c5ab12e2e254..2c1c0c5afc25855d5cff301a28a00ee74a7decad
--- 1/Lib/urllib2.py
--- 2/Lib/urllib2.py
+++ b/Lib/urllib2.py
@@@ -568,16 -553,19 +568,27 @@@ class HTTPRedirectHandler(BaseHandler)
              newurl = headers.getheaders('uri')[0]
          else:
              return
 +
 +        # fix a possible malformed URL
 +        urlparts = urlparse.urlparse(newurl)
 +        if not urlparts.path:
 +            urlparts = list(urlparts)
 +            urlparts[2] = "/"
 +        newurl = urlparse.urlunparse(urlparts)
 +
          newurl = urlparse.urljoin(req.get_full_url(), newurl)
  
+         # For security reasons we do not allow redirects to protocols
+         # other than HTTP, HTTPS or FTP.
+         newurl_lower = newurl.lower()
+         if not (newurl_lower.startswith('http://') or
+                 newurl_lower.startswith('https://') or
+                 newurl_lower.startswith('ftp://')):
+             raise HTTPError(newurl, code,
+                             msg + " - Redirection to url '%s' is not allowed" %
+                             newurl,
+                             headers, fp)
+ 
          # XXX Probably want to forget about the state of the current
          # request, although that might interact poorly with other
          # handlers that also use handler-specific request attributes

diff --cc Misc/NEWS
index 449348ef6f6120f32f68243cad7f0c9d6643e127,551ecb73abf2b7402c4498e1bf7418efacb0e51a..19dc5e443c531de1d3d7327a6b99709486d24a93
--- 1/Misc/NEWS
--- 2/Misc/NEWS
+++ b/Misc/NEWS
@@@ -19,39 -12,26 +19,28 @@@ Core and Builtin
  Library
  -------
  
- - Issue #9129: smtpd.py is vulnerable to DoS attacks deriving from missing
-   error handling when accepting a new connection.
- 
- What's New in Python 2.6.6?
- ===========================
- 
- *Release date: 2010-08-24*
- 
- Core and Builtins
- -----------------
- 
- Library
- -------
+ - Issue #11662: Make urllib and urllib2 ignore redirections if the
+   scheme is not HTTP, HTTPS or FTP (CVE-2011-1521).
  
 -- Issue #8674: Fixed a number of incorrect or undefined-behaviour-inducing
 -  overflow checks in the audioop module (CVE-2010-1634).
  
 -- Issue #7673: Fix security vulnerability (CVE-2010-2089) in the audioop
 -  module, ensure that the input string length is a multiple of the frame size.
 +What's New in Python 2.6.6 rc 2?
 +================================
  
 +*Release date: 2010-08-16*
  
 -What's New in Python 2.5.5?
 -===========================
 +Library
 +-------
  
 -*Release date: 31-Jan-2010*
 +- Issue #9600: Don't use relative import for _multiprocessing on Windows.
  
 +- Issue #8688: Revert regression introduced in 2.6.6rc1 (making Distutils
 +  recalculate MANIFEST every time).
  
 -What's New in Python 2.5.5c2?
 -=============================
 +- Issue #5798: Handle select.poll flag oddities properly on OS X.
 +  This fixes test_asynchat and test_smtplib failures on OS X.
  
 -*Release date: 24-Jan-2010*
 +- Issue #9543: Fix regression in socket.py introduced in Python 2.6.6 rc 1
 +  in r83624.
  
  Extension Modules
  -----------------