diff options
| author | Guido van Rossum <guido@python.org> | 2011-03-29 12:53:55 -0700 |
|---|---|---|
| committer | Guido van Rossum <guido@python.org> | 2011-03-29 12:53:55 -0700 |
| commit | 07ef62c47c14ea80e9fd0923e1693d222df506ff (patch) | |
| tree | 8958a5f93c705f737f0a0932d8ad2512a7e24aa7 /Lib/urllib2.py | |
| parent | 3c599bdbd1d7fd3436fff47d1338593dff3e58a2 (diff) | |
| parent | 079381d236f6e62db3a48cbffb14978124d94d14 (diff) | |
| download | cpython-git-07ef62c47c14ea80e9fd0923e1693d222df506ff.tar.gz | |
Merge issue 11662 from 2.6.
Diffstat (limited to 'Lib/urllib2.py')
| -rw-r--r-- | Lib/urllib2.py | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/Lib/urllib2.py b/Lib/urllib2.py index da030f74fd..3be7c8b228 100644 --- a/Lib/urllib2.py +++ b/Lib/urllib2.py @@ -578,6 +578,17 @@ class HTTPRedirectHandler(BaseHandler): newurl = urlparse.urljoin(req.get_full_url(), newurl) + # For security reasons we do not allow redirects to protocols + # other than HTTP, HTTPS or FTP. + newurl_lower = newurl.lower() + if not (newurl_lower.startswith('http://') or + newurl_lower.startswith('https://') or + newurl_lower.startswith('ftp://')): + raise HTTPError(newurl, code, + msg + " - Redirection to url '%s' is not allowed" % + newurl, + headers, fp) + # XXX Probably want to forget about the state of the current # request, although that might interact poorly with other # handlers that also use handler-specific request attributes |