delta/cpython-git.git/Lib/urllib, branch enum-private-310 github.com: python/cpython.git Update URLs in comments and metadata to use HTTPS (GH-27458) (GH-27478) 2021-07-30T14:25:28+00:00 Miss Islington (bot) 31488909+miss-islington@users.noreply.github.com 2021-07-30T14:25:28+00:00 f7f1c26423b1208ef22cbe0f60f36e26a51cebf6 (cherry picked from commit be42c06bb01206209430f3ac08b72643dc7cad1c) Co-authored-by: Noah Kantrowitz <noah@coderanger.net> 
(cherry picked from commit be42c06bb01206209430f3ac08b72643dc7cad1c)

Co-authored-by: Noah Kantrowitz <noah@coderanger.net>
 bpo-43882 Remove the newline, and tab early. From query and fragments. (GH-25936) 2021-05-05T23:04:38+00:00 Miss Islington (bot) 31488909+miss-islington@users.noreply.github.com 2021-05-05T23:04:38+00:00 24f1d1a8a2c4aa58a606b4b6d5fa4305a3b91705 (cherry picked from commit 985ac016373403e8ad41f8d563c4355ffa8d49ff) 
(cherry picked from commit 985ac016373403e8ad41f8d563c4355ffa8d49ff)
 bpo-43979: Remove unnecessary operation from urllib.parse.parse_qsl (GH-25756) 2021-04-30T19:01:55+00:00 Dong-hee Na donghee.na@python.org 2021-04-30T19:01:55+00:00 6143fcdf8bfe54c24e3081bcee423f4d51f35c4e Automerge-Triggered-By: GH:gpshead 
Automerge-Triggered-By: GH:gpshead
 bpo-43882 - urllib.parse should sanitize urls containing ASCII newline and tabs. (GH-25595) 2021-04-29T17:16:50+00:00 Senthil Kumaran senthil@uthcode.com 2021-04-29T17:16:50+00:00 76cd81d60310d65d01f9d7b48a8985d8ab89c8b4 * issue43882 - urllib.parse should sanitize urls containing ASCII newline and tabs. Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> 
* issue43882 - urllib.parse should sanitize urls containing ASCII newline and tabs.

Co-authored-by: Gregory P. Smith <greg@krypto.org>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
 bpo-42967: coerce bytes separator to string in urllib.parse_qs(l) (#24818) 2021-04-11T13:26:09+00:00 Ken Jin 28750310+Fidget-Spinner@users.noreply.github.com 2021-04-11T13:26:09+00:00 b38601d49675d90e1ee6faa47f7adaeca992d02d * coerce bytes separator to string * Add news * Update Misc/NEWS.d/next/Library/2021-03-11-00-31-41.bpo-42967.2PeQRw.rst 
* coerce bytes separator to string

* Add news

* Update Misc/NEWS.d/next/Library/2021-03-11-00-31-41.bpo-42967.2PeQRw.rst
 bpo-43075: Fix ReDoS in urllib AbstractBasicAuthHandler (GH-24391) 2021-04-07T11:27:41+00:00 Yeting Li liyt@ios.ac.cn 2021-04-07T11:27:41+00:00 7215d1ae25525c92b026166f9d5cac85fb1defe1 Fix Regular Expression Denial of Service (ReDoS) vulnerability in urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable regex has quadratic worst-case complexity and it allows cause a denial of service when identifying crafted invalid RFCs. This ReDoS issue is on the client side and needs remote attackers to control the HTTP server. 
Fix Regular Expression Denial of Service (ReDoS) vulnerability in
urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable regex
has quadratic worst-case complexity and it allows cause a denial of
service when identifying crafted invalid RFCs. This ReDoS issue is on
the client side and needs remote attackers to control the HTTP server.
 bpo-42967: Fix urllib.parse docs and make logic clearer (GH-24536) 2021-02-15T17:00:20+00:00 Ken Jin 28750310+Fidget-Spinner@users.noreply.github.com 2021-02-15T17:00:20+00:00 a2f0654b0a5b4c4f726155620002cc1f5f2d206a 






bpo-42967: only use '&' as a query string separator (#24297)
2021-02-14T22:41:57+00:00

Adam Goldschmidt
adamgold7@gmail.com

2021-02-14T22:41:57+00:00

fcbe0cb04d35189401c0c880ebfb4311e952d776

bpo-42967: [security] Address a web cache-poisoning issue reported in urllib.parse.parse_qsl().

urllib.parse will only us "&" as query string separator by default instead of both ";" and "&" as allowed in earlier versions. An optional argument seperator with default value "&" is added to specify the separator.


Co-authored-by: Éric Araujo <merwok@netwok.org>
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Éric Araujo <merwok@netwok.org>




bpo-42967: [security] Address a web cache-poisoning issue reported in urllib.parse.parse_qsl().

urllib.parse will only us "&" as query string separator by default instead of both ";" and "&" as allowed in earlier versions. An optional argument seperator with default value "&" is added to specify the separator.


Co-authored-by: Éric Araujo <merwok@netwok.org>
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Éric Araujo <merwok@netwok.org>






Allow / character in username,password fields in _PROXY envvars. (#23973)
2020-12-29T12:18:42+00:00

Senthil Kumaran
senthil@uthcode.com

2020-12-29T12:18:42+00:00

030a713183084594659aefd77b76fe30178e23c8












bpo-40968: Send http/1.1 ALPN extension (#20959)
2020-11-13T15:37:52+00:00

Christian Heimes
christian@python.org

2020-11-13T15:37:52+00:00

f97406be4c0a02c1501c7ab8bc8ef3850eddb962

Signed-off-by: Christian Heimes <christian@python.org>




Signed-off-by: Christian Heimes <christian@python.org>