From: Guido van Rossum <guido@python.org>
Date: Tue, 29 Mar 2011 19:51:16 +0000 (-0700)
Subject: Merge issue 11662 from 2.5.
X-Git-Tag: v2.6.7~9
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=079381d236f6e62db3a48cbffb14978124d94d14;p=python

Merge issue 11662 from 2.5.
---

079381d236f6e62db3a48cbffb14978124d94d14
diff --cc Lib/test/test_urllib.py
index 402309ce3e,72db1ef29c..84b6f253ab
--- a/Lib/test/test_urllib.py
+++ b/Lib/test/test_urllib.py
@@@ -162,9 -122,23 +162,23 @@@ Content-Type: text/html; charset=iso-88
          finally:
              self.unfakehttp()
  
+     def test_invalid_redirect(self):
+         # urlopen() should raise IOError for many error codes.
+         self.fakehttp("""HTTP/1.1 302 Found
+ Date: Wed, 02 Jan 2008 03:03:54 GMT
+ Server: Apache/1.3.33 (Debian GNU/Linux) mod_ssl/2.8.22 OpenSSL/0.9.7e
+ Location: file:README
+ Connection: close
+ Content-Type: text/html; charset=iso-8859-1
+ """)
+         try:
+             self.assertRaises(IOError, urllib.urlopen, "http://python.org/")
+         finally:
+             self.unfakehttp()
+ 
      def test_empty_socket(self):
 -        """urlopen() raises IOError if the underlying socket does not send any
 -        data. (#1680230) """
 +        # urlopen() raises IOError if the underlying socket does not send any
 +        # data. (#1680230)
          self.fakehttp('')
          try:
              self.assertRaises(IOError, urllib.urlopen, 'http://something')
diff --cc Lib/urllib2.py
index ca74c9f22d,a537d3630e..2c1c0c5afc
--- a/Lib/urllib2.py
+++ b/Lib/urllib2.py
@@@ -568,16 -553,19 +568,27 @@@ class HTTPRedirectHandler(BaseHandler)
              newurl = headers.getheaders('uri')[0]
          else:
              return
 +
 +        # fix a possible malformed URL
 +        urlparts = urlparse.urlparse(newurl)
 +        if not urlparts.path:
 +            urlparts = list(urlparts)
 +            urlparts[2] = "/"
 +        newurl = urlparse.urlunparse(urlparts)
 +
          newurl = urlparse.urljoin(req.get_full_url(), newurl)
  
+         # For security reasons we do not allow redirects to protocols
+         # other than HTTP, HTTPS or FTP.
+         newurl_lower = newurl.lower()
+         if not (newurl_lower.startswith('http://') or
+                 newurl_lower.startswith('https://') or
+                 newurl_lower.startswith('ftp://')):
+             raise HTTPError(newurl, code,
+                             msg + " - Redirection to url '%s' is not allowed" %
+                             newurl,
+                             headers, fp)
+ 
          # XXX Probably want to forget about the state of the current
          # request, although that might interact poorly with other
          # handlers that also use handler-specific request attributes
diff --cc Misc/NEWS
index 449348ef6f,551ecb73ab..19dc5e443c
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@@ -19,39 -12,26 +19,28 @@@ Core and Builtin
  Library
  -------
  
- - Issue #9129: smtpd.py is vulnerable to DoS attacks deriving from missing
-   error handling when accepting a new connection.
- 
- What's New in Python 2.6.6?
- ===========================
- 
- *Release date: 2010-08-24*
- 
- Core and Builtins
- -----------------
- 
- Library
- -------
+ - Issue #11662: Make urllib and urllib2 ignore redirections if the
+   scheme is not HTTP, HTTPS or FTP (CVE-2011-1521).
  
 -- Issue #8674: Fixed a number of incorrect or undefined-behaviour-inducing
 -  overflow checks in the audioop module (CVE-2010-1634).
  
 -- Issue #7673: Fix security vulnerability (CVE-2010-2089) in the audioop
 -  module, ensure that the input string length is a multiple of the frame size.
 +What's New in Python 2.6.6 rc 2?
 +================================
  
 +*Release date: 2010-08-16*
  
 -What's New in Python 2.5.5?
 -===========================
 +Library
 +-------
  
 -*Release date: 31-Jan-2010*
 +- Issue #9600: Don't use relative import for _multiprocessing on Windows.
  
 +- Issue #8688: Revert regression introduced in 2.6.6rc1 (making Distutils
 +  recalculate MANIFEST every time).
  
 -What's New in Python 2.5.5c2?
 -=============================
 +- Issue #5798: Handle select.poll flag oddities properly on OS X.
 +  This fixes test_asynchat and test_smtplib failures on OS X.
  
 -*Release date: 24-Jan-2010*
 +- Issue #9543: Fix regression in socket.py introduced in Python 2.6.6 rc 1
 +  in r83624.
  
  Extension Modules
  -----------------