This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author yaaboukir
Recipients benjamin.peterson, martin.panter, orsenthil, pitrou, python-dev, soilandreyes, vstinner, yaaboukir
Date 2015-03-03.00:04:30
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <>
Yes, exploiting this bug an attacker may redirect a specific vitim to a malicious website, in our case

>>> x = urlparse("////")

/// will be parsed as relative-path URL which is the correct expected behaviour

>>> print x
>>> ParseResult(scheme='', netloc='', path='//', params='', query='', fragment='')

As you see two slashes are removed and it is marked as a relative-path URL but when we reconstruct the URL using urlunparse() function, the URL is treated as an absolute URL to which you will be redirected.

>>> x = urlunparse(urlparse("////"))
>>> urlparse(x)
ParseResult(scheme='', netloc='', path='', params='', query='', fragment='')
Date User Action Args
2015-03-03 00:04:30yaaboukirsetrecipients: + yaaboukir, orsenthil, pitrou, vstinner, benjamin.peterson, python-dev, martin.panter, soilandreyes
2015-03-03 00:04:30yaaboukirsetmessageid: <>
2015-03-03 00:04:30yaaboukirlinkissue23505 messages
2015-03-03 00:04:30yaaboukircreate