This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author xtreak
Recipients cstratak, gregory.p.smith, larry, martin.panter, miss-islington, orange, serhiy.storchaka, vstinner, ware, xiang.zhang, xtreak
Date 2019-07-04.15:31:37
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <>
Okay, the url variable against which the regex check is made is not the full url but the path. The HTTPConnection class sets [0] in the constructor which is used to send the Host header. Perhaps the regex check could be done for the host too given the path check is already done in the previous commit. With that the reported host also throws a http.client.InvalidURL exception.

> A second problem comes into the game. Some C libraries like glibc strip the end of the hostname (strip at the first newline character) and so HTTP Header injection is still possible is this case:

The bug link raises permission error. Does fixing the host part fix this issue too since there won't be any socket connection made? Is it possible to have a Python reproducer of this issue?

Date User Action Args
2019-07-04 15:31:37xtreaksetrecipients: + xtreak, gregory.p.smith, vstinner, larry, martin.panter, serhiy.storchaka, xiang.zhang, cstratak, orange, miss-islington, ware
2019-07-04 15:31:37xtreaksetmessageid: <>
2019-07-04 15:31:37xtreaklinkissue30458 messages
2019-07-04 15:31:37xtreakcreate