From 58c60620689cac234fa8e860412e3d7af354c776 Mon Sep 17 00:00:00 2001
From: Senthil Kumaran <senthil@uthcode.com>
Date: Sat, 21 Jan 2012 11:43:02 +0800
Subject: [PATCH] Fix Issue6631 - Disallow relative files paths in
 urllib*.open()

---
 Lib/test/test_urllib.py     | 3 +++
 Lib/test/test_urllib2net.py | 2 ++
 Lib/urllib.py               | 2 ++
 3 files changed, 7 insertions(+)

diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py
index 085eecf0f6..91aeb2f116 100644
--- a/Lib/test/test_urllib.py
+++ b/Lib/test/test_urllib.py
@@ -134,6 +134,9 @@ class urlopen_FileTests(unittest.TestCase):
         for line in self.returned_obj.__iter__():
             self.assertEqual(line, self.text)
 
+    def test_relativelocalfile(self):
+        self.assertRaises(ValueError,urllib.urlopen,'./' + self.pathname)
+
 class ProxyTests(unittest.TestCase):
 
     def setUp(self):
diff --git a/Lib/test/test_urllib2net.py b/Lib/test/test_urllib2net.py
index bd2c46772e..dcdbfe87c6 100644
--- a/Lib/test/test_urllib2net.py
+++ b/Lib/test/test_urllib2net.py
@@ -126,6 +126,8 @@ class OtherNetworkTests(unittest.TestCase):
         finally:
             os.remove(TESTFN)
 
+        self.assertRaises(ValueError, urllib2.urlopen,'./relative_path/to/file')
+
     # XXX Following test depends on machine configurations that are internal
     # to CNRI.  Need to set up a public server with the right authentication
     # configuration for test purposes.
diff --git a/Lib/urllib.py b/Lib/urllib.py
index c7af8ec4fd..a73c5d7ba5 100644
--- a/Lib/urllib.py
+++ b/Lib/urllib.py
@@ -484,6 +484,8 @@ class URLopener:
             urlfile = file
             if file[:1] == '/':
                 urlfile = 'file://' + file
+            elif file[:2] == './':
+                raise ValueError("local file url may start with / or file:. Unknown url of type: %s" % url)
             return addinfourl(open(localname, 'rb'),
                               headers, urlfile)
         host, port = splitport(host)
-- 
2.40.0