diff options
author | Guido van Rossum <guido@python.org> | 2011-03-29 12:51:16 -0700 |
---|---|---|
committer | Guido van Rossum <guido@python.org> | 2011-03-29 12:51:16 -0700 |
commit | 079381d236f6e62db3a48cbffb14978124d94d14 (patch) | |
tree | dd7b0977a1c139ae8be36560b151215944b1f3e2 /Lib/urllib.py | |
parent | af1fee06c96fe24729240498c00ea5fc3d9c5b22 (diff) | |
parent | 92ecb8737b9c708268c6451a01835192c181b721 (diff) | |
download | cpython-git-079381d236f6e62db3a48cbffb14978124d94d14.tar.gz |
Merge issue 11662 from 2.5.
Diffstat (limited to 'Lib/urllib.py')
-rw-r--r-- | Lib/urllib.py | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/Lib/urllib.py b/Lib/urllib.py index b94f550755..3f5b592e40 100644 --- a/Lib/urllib.py +++ b/Lib/urllib.py @@ -652,6 +652,18 @@ class FancyURLopener(URLopener): fp.close() # In case the server sent a relative URL, join with original: newurl = basejoin(self.type + ":" + url, newurl) + + # For security reasons we do not allow redirects to protocols + # other than HTTP, HTTPS or FTP. + newurl_lower = newurl.lower() + if not (newurl_lower.startswith('http://') or + newurl_lower.startswith('https://') or + newurl_lower.startswith('ftp://')): + raise IOError('redirect error', errcode, + errmsg + " - Redirection to url '%s' is not allowed" % + newurl, + headers) + return self.open(newurl) def http_error_301(self, url, fp, errcode, errmsg, headers, data=None): |