➜

This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author orsenthil
Recipients alex, christian.heimes, dstufft, orsenthil, pitrou
Date 2014-09-19.07:53:09
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <1411113190.48.0.396840225305.issue22440@psf.upfronthosting.co.za>
In-reply-to
Content 
While working on issue22366, I found a tricky bit of code in:

https://hg.python.org/cpython/file/ca0aa0d89273/Lib/http/client.py#l1295
https://hg.python.org/cpython/rev/1a945fb875bf/

The statement is

 if not self._context.check_hostname and self._check_hostname:

The context object's check_hostname (created by ssl._create_stdlib_context() -
note private ) is False by default and the statement holds good and acts only on
self._check_hostname

But if the context is constructed manually and the context object's
check_hostname is set to True (with correct intentions), that statement will
lead to skipping of matching hostname!

Is my analysis right here?
History
Date User Action Args
2014-09-19 07:53:10orsenthilsetrecipients: + orsenthil, pitrou, christian.heimes, alex, dstufft
2014-09-19 07:53:10orsenthilsetmessageid: <1411113190.48.0.396840225305.issue22440@psf.upfronthosting.co.za>
2014-09-19 07:53:10orsenthillinkissue22440 messages
2014-09-19 07:53:09orsenthilcreate