diff -r c177faafec51 -r ff71c4416cde Doc/library/urllib.request.rst
--- a/Doc/library/urllib.request.rst	Thu Mar 24 22:27:01 2011 +0800
+++ b/Doc/library/urllib.request.rst	Fri Mar 25 10:43:36 2011 +0800
@@ -650,6 +650,10 @@
    is the case, :exc:`HTTPError` is raised.  See :rfc:`2616` for details of the
    precise meanings of the various redirection codes.
 
+   An :class:`HTTPError` exception raised as a security consideration if the
+   HTTPRedirectHandler is presented with a redirected url which is not a http,
+   https or an ftp url.
+
 
 .. method:: HTTPRedirectHandler.redirect_request(req, fp, code, msg, hdrs, newurl)
 
diff -r c177faafec51 -r ff71c4416cde Lib/test/test_urllib.py
--- a/Lib/test/test_urllib.py	Thu Mar 24 22:27:01 2011 +0800
+++ b/Lib/test/test_urllib.py	Fri Mar 25 10:43:36 2011 +0800
@@ -2,6 +2,7 @@
 
 import urllib.parse
 import urllib.request
+import urllib.error
 import http.client
 import email.message
 import io
@@ -206,6 +207,20 @@
         finally:
             self.unfakehttp()
 
+    def test_invalid_redirect(self):
+        # urlopen() should raise IOError for many error codes.
+        self.fakehttp(b'''HTTP/1.1 302 Found
+Date: Wed, 02 Jan 2008 03:03:54 GMT
+Server: Apache/1.3.33 (Debian GNU/Linux) mod_ssl/2.8.22 OpenSSL/0.9.7e
+Location: file://guidocomputer.athome.com:/python/license
+Connection: close
+Content-Type: text/html; charset=iso-8859-1
+''')
+        try:
+            self.assertRaises(urllib.error.HTTPError, urlopen, "http://python.org/")
+        finally:
+            self.unfakehttp()
+
     def test_empty_socket(self):
         # urlopen() raises IOError if the underlying socket does not send any
         # data. (#1680230)
diff -r c177faafec51 -r ff71c4416cde Lib/test/test_urllib2.py
--- a/Lib/test/test_urllib2.py	Thu Mar 24 22:27:01 2011 +0800
+++ b/Lib/test/test_urllib2.py	Fri Mar 25 10:43:36 2011 +0800
@@ -10,6 +10,7 @@
 # The proxy bypass method imported below has logic specific to the OSX
 # proxy config data structure but is testable on all platforms.
 from urllib.request import Request, OpenerDirector, _proxy_bypass_macosx_sysconf
+import urllib.error
 
 # XXX
 # Request
@@ -1031,6 +1032,29 @@
             self.assertEqual(count,
                              urllib.request.HTTPRedirectHandler.max_redirections)
 
+
+    def test_invalid_redirect(self):
+        from_url = "http://example.com/a.html"
+        valid_schemes = ['http','https','ftp']
+        invalid_schemes = ['file','imap','ldap']
+        schemeless_url = "example.com/b.html"
+        h = urllib.request.HTTPRedirectHandler()
+        o = h.parent = MockOpener()
+        req = Request(from_url)
+        req.timeout = socket._GLOBAL_DEFAULT_TIMEOUT
+
+        for scheme in invalid_schemes:
+            invalid_url = scheme + '://' + schemeless_url
+            self.assertRaises(urllib.error.HTTPError, h.http_error_302,
+                    req, MockFile(), 302, "Security Loophole",
+                    MockHeaders({"location": invalid_url}))
+
+        for scheme in valid_schemes:
+            valid_url = scheme + '://' + schemeless_url
+            h.http_error_302(req, MockFile(), 302, "That's fine",
+                MockHeaders({"location": valid_url}))
+            self.assertEqual(o.req.get_full_url(), valid_url)
+
     def test_cookie_redirect(self):
         # cookies shouldn't leak into redirected requests
         from http.cookiejar import CookieJar
diff -r c177faafec51 -r ff71c4416cde Lib/urllib/request.py
--- a/Lib/urllib/request.py	Thu Mar 24 22:27:01 2011 +0800
+++ b/Lib/urllib/request.py	Fri Mar 25 10:43:36 2011 +0800
@@ -543,8 +543,16 @@
         else:
             return
 
-        # fix a possible malformed URL
         urlparts = urlparse(newurl)
+
+        # For security reasons we don't allow redirection to anything other
+        # than http, https or ftp.
+
+        if not urlparts.scheme in ('http','https','ftp'):
+            raise HTTPError(newurl, code,
+                    msg + " - Redirection to url '%s' is not allowed" % newurl,
+                    headers, fp)
+
         if not urlparts.path:
             urlparts = list(urlparts)
             urlparts[2] = "/"
@@ -1903,8 +1911,23 @@
             return
         void = fp.read()
         fp.close()
+
         # In case the server sent a relative URL, join with original:
         newurl = urljoin(self.type + ":" + url, newurl)
+
+        urlparts = urlparse(newurl)
+
+        # For security reasons, we don't allow redirection to anything other
+        # than http, https and ftp.
+
+        # We are using newer HTTPError with older redirect_internal method
+        # This older method will get deprecated in 3.3
+
+        if not urlparts.scheme in ('http','https','ftp'):
+            raise HTTPError(newurl, errcode,
+                    errmsg + " Redirection to url '%s' is not allowed." % newurl,
+                    headers, fp)
+
         return self.open(newurl)
 
     def http_error_301(self, url, fp, errcode, errmsg, headers, data=None):
diff -r c177faafec51 -r ff71c4416cde Misc/NEWS
--- a/Misc/NEWS	Thu Mar 24 22:27:01 2011 +0800
+++ b/Misc/NEWS	Fri Mar 25 10:43:36 2011 +0800
@@ -84,6 +84,9 @@
 Library
 -------
 
+- Issue #11662: urllib raises an HTTPError exception as security consideration
+  if the 30x redirection is not HTTP, HTTPS or FTP url.
+
 - Issue #6811: Allow importlib to change a code object's co_filename attribute
   to match the path to where the source code currently is, not where the code
   object originally came from.