This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: Improper Input Validation in urlparse
Type: security Stage:
Components: Versions: Python 3.9
process
Status: open Resolution:
Dependencies: Superseder:
Assigned To: Nosy List: P0cas, karanchaudhary, orsenthil
Priority: normal Keywords:

Created on 2022-02-27 01:12 by P0cas, last changed 2022-04-11 14:59 by admin.

Messages (4)
msg414132 - (view) Author: Pocas (P0cas) Date: 2022-02-27 01:12
If http:@localhost url is entered as an argument value of the urlpasre() function, the parser cannot parse it properly. Since http:@localhost is a valid URL, the character after the @ character must be parsed as a hostname.

Python 3.9.10 (main, Jan 15 2022, 11:48:04)
[Clang 13.0.0 (clang-1300.0.29.3)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> from urllib.parse import urlparse
>>> print(urlparse('http:@localhost'))
ParseResult(scheme='http', netloc='', path='@localhost', params='', query='', fragment='')
>>>
msg414133 - (view) Author: Pocas (P0cas) Date: 2022-02-27 01:17
>>> print(urlparse('https:\\google.com'))
ParseResult(scheme='https', netloc='', path='\\google.com', params='', query='', fragment='')
>>> print(urlparse('https://google.com@localhost'))
ParseResult(scheme='https', netloc='google.com@localhost', path='', params='', query='', fragment='')
>>>

Perhaps this parser is not able to parse the URL normally.
msg414171 - (view) Author: Karan (karanchaudhary) * Date: 2022-02-28 02:02
Here are the results from other languages. Go parses incorrectly at the same time rust does it correctly.

Go- https://go.dev/play/p/nNMhyznuGpn
&url.URL{Scheme:"http", Opaque:"@localhost", User:(*url.Userinfo)(nil), Host:"", Path:"", RawPath:"", ForceQuery:false, RawQuery:"", Fragment:"", RawFragment:""}


Rust- https://play.rust-lang.org/?version=stable&mode=debug&edition=2021&gist=92681b56f7cbd62b7735c962a2f5321e
Url { scheme: "http", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("localhost")), port: None, path: "/", query: None, fragment: None }
msg414345 - (view) Author: Pocas (P0cas) Date: 2022-03-02 13:38
Nice Check. So what do you think about this issue? I want to hear your opinions.
History
Date User Action Args
2022-04-11 14:59:56adminsetgithub: 91026
2022-03-02 13:38:56P0cassetmessages: + msg414345
2022-03-01 21:55:34ned.deilysetnosy: + orsenthil
2022-02-28 02:02:25karanchaudharysetnosy: + karanchaudhary
messages: + msg414171
2022-02-27 01:17:24P0cassetmessages: + msg414133
2022-02-27 01:12:54P0cassettype: performance -> security
2022-02-27 01:12:03P0cascreate