Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Incorrect authorization check in urllib.request #90912

Closed
serhiy-storchaka opened this issue Feb 15, 2022 · 12 comments
Closed

Incorrect authorization check in urllib.request #90912

serhiy-storchaka opened this issue Feb 15, 2022 · 12 comments
Labels
3.7 (EOL) end of life 3.8 only security fixes 3.9 only security fixes 3.10 only security fixes 3.11 only security fixes stdlib Python modules in the Lib dir type-security A security issue

Comments

@serhiy-storchaka
Copy link
Member

BPO 46756
Nosy @orsenthil, @ned-deily, @ambv, @vadmium, @serhiy-storchaka, @pablogsal, @miss-islington
PRs
  • bpo-46756: Fix authorization check in urllib.request #31353
  • [3.10] bpo-46756: Fix authorization check in urllib.request (GH-31353) #31570
  • [3.9] bpo-46756: Fix authorization check in urllib.request (GH-31353) #31571
  • [3.8] bpo-46756: Fix authorization check in urllib.request (GH-31353) #31572
  • [3.7] bpo-46756: Fix authorization check in urllib.request (GH-31353) #31573
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = <Date 2022-03-02.13:54:11.554>
created_at = <Date 2022-02-15.09:48:07.699>
labels = ['type-security', '3.8', '3.9', '3.10', '3.11', '3.7', 'library']
title = 'Incorrect authorization check in urllib.request'
updated_at = <Date 2022-03-03.20:14:46.403>
user = 'https://github.com/serhiy-storchaka'

    bugs.python.org fields:

    activity = <Date 2022-03-03.20:14:46.403>
actor = 'orsenthil'
assignee = 'none'
closed = True
closed_date = <Date 2022-03-02.13:54:11.554>
closer = 'pablogsal'
components = ['Library (Lib)']
creation = <Date 2022-02-15.09:48:07.699>
creator = 'serhiy.storchaka'
dependencies = []
files = []
hgrepos = []
issue_num = 46756
keywords = ['patch']
message_count = 12.0
messages = ['413280', '413363', '413976', '413978', '413983', '413985', '414027', '414347', '414350', '414351', '414352', '414465']
nosy_count = 7.0
nosy_names = ['orsenthil', 'ned.deily', 'lukasz.langa', 'martin.panter', 'serhiy.storchaka', 'pablogsal', 'miss-islington']
pr_nums = ['31353', '31570', '31571', '31572', '31573']
priority = None
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue46756'
versions = ['Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10', 'Python 3.11']
    @serhiy-storchaka
    Copy link
    Member Author

    There is an error in determining a sub-URI in the urllib.request module. Due to it, if the user is authorized for example.org/foo, it gets also access to example.org/foobar.

    @serhiy-storchaka serhiy-storchaka added 3.7 (EOL) end of life 3.8 only security fixes 3.9 only security fixes 3.10 only security fixes 3.11 only security fixes stdlib Python modules in the Lib dir type-security A security issue labels Feb 15, 2022
    @serhiy-storchaka serhiy-storchaka changed the title Incorrect Incorrect authorization check in urllib.request Feb 15, 2022
    @serhiy-storchaka serhiy-storchaka changed the title Incorrect Incorrect authorization check in urllib.request Feb 15, 2022
    @vadmium
    Copy link
    Member

    vadmium commented Feb 16, 2022

    Maybe the same as bpo-42766?

    @serhiy-storchaka
    Copy link
    Member Author

    Yes, it is the same. I should search before writing a patch.

    But for some reasons I prefer my solution over the one proposed in bpo-42766: The code is clearer and more strict, tests use public API instead of a private method.

    @serhiy-storchaka
    Copy link
    Member Author

    New changeset e2e7256 by Serhiy Storchaka in branch 'main':
    bpo-46756: Fix authorization check in urllib.request (GH-31353)
    e2e7256

    @miss-islington
    Copy link
    Contributor

    New changeset 4560c7e by Miss Islington (bot) in branch '3.9':
    bpo-46756: Fix authorization check in urllib.request (GH-31353)
    4560c7e

    @miss-islington
    Copy link
    Contributor

    New changeset 2b7e04d by Miss Islington (bot) in branch '3.10':
    bpo-46756: Fix authorization check in urllib.request (GH-31353)
    2b7e04d

    @ned-deily
    Copy link
    Member

    New changeset 31fef7e by Miss Islington (bot) in branch '3.7':
    bpo-46756: Fix authorization check in urllib.request (GH-31353) (GH-31573)
    31fef7e

    @pablogsal
    Copy link
    Member

    This is marked as a release blocker so I am holding the alpha release on this. Is there anything we can do to unblock this issue?

    @pablogsal
    Copy link
    Member

    Is something left here, it seems that most PRs are landed

    @pablogsal
    Copy link
    Member

    New changeset 1c9701a by Miss Islington (bot) in branch '3.8':
    bpo-46756: Fix authorization check in urllib.request (GH-31353) (GH-31572)
    1c9701a

    @pablogsal
    Copy link
    Member

    I'm closing this, please reopen if something is missing.

    @orsenthil
    Copy link
    Member

    Pablo, we are good. The PRs were merged in open branches a while ago, and this was tracking security releases backports.

    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Assignees
    No one assigned
    Labels
    3.7 (EOL) end of life 3.8 only security fixes 3.9 only security fixes 3.10 only security fixes 3.11 only security fixes stdlib Python modules in the Lib dir type-security A security issue
    Projects
    None yet
    Milestone
    No milestone
    Development

    No branches or pull requests
    6 participants
    @orsenthil @vadmium @serhiy-storchaka @ned-deily @pablogsal @miss-islington