Projects
Mega:23.09
python-urllib3
_service:tar_scm:backport-CVE-2023-45803-Made-b...
Sign Up
Log In
Username
Password
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File _service:tar_scm:backport-CVE-2023-45803-Made-body-stripped-from-HTTP-requests.patch of Package python-urllib3
From b594c5ceaca38e1ac215f916538fb128e3526a36 Mon Sep 17 00:00:00 2001 From: Illia Volochii <illia.volochii@gmail.com> Date: Tue, 17 Oct 2023 19:35:39 +0300 Subject: [PATCH] Merge pull request from GHSA-g4mx-q9vg-27p4 Conflict:test/with_dummyserver/test_poolmanager.py and test_connectionpool.py has not been modified because it has been deleted in the pre-phase of the spec file Reference:https://github.com/urllib3/urllib3/commit/b594c5ceaca38e1ac215f916538fb128e3526a36 --- dummyserver/handlers.py | 7 +++++++ src/urllib3/_collections.py | 19 +++++++++++++++++++ src/urllib3/connectionpool.py | 5 +++++ src/urllib3/poolmanager.py | 7 +++++-- 4 files changed, 36 insertions(+), 2 deletions(-) diff --git a/dummyserver/handlers.py b/dummyserver/handlers.py index c90c2fc..acd181d 100644 --- a/dummyserver/handlers.py +++ b/dummyserver/handlers.py @@ -186,6 +186,8 @@ class TestingApp(RequestHandler): status = request.params.get("status", "303 See Other") if len(status) == 3: status = "%s Redirect" % status.decode("latin-1") + elif isinstance(status, bytes): + status = status.decode("latin-1") headers = [("Location", target)] return Response(status=status, headers=headers) @@ -264,6 +266,11 @@ class TestingApp(RequestHandler): def headers(self, request): return Response(json.dumps(dict(request.headers))) + def headers_and_params(self, request): + return Response( + json.dumps({"headers": dict(request.headers), "params": request.params}) + ) + def successful_retry(self, request): """Handler which will return an error and then success diff --git a/src/urllib3/_collections.py b/src/urllib3/_collections.py index da9857e..3672e30 100644 --- a/src/urllib3/_collections.py +++ b/src/urllib3/_collections.py @@ -268,6 +268,25 @@ class HTTPHeaderDict(MutableMapping): else: return vals[1:] + def _prepare_for_method_change(self): + """ + Remove content-specific header fields before changing the request + method to GET or HEAD according to RFC 9110, Section 15.4. + """ + + content_specific_headers = [ + "Content-Encoding", + "Content-Language", + "Content-Location", + "Content-Type", + "Content-Length", + "Digest", + "Last-Modified", + ] + for header in content_specific_headers: + self.discard(header) + return self + # Backwards compatibility for httplib getheaders = getlist getallmatchingheaders = getlist diff --git a/src/urllib3/connectionpool.py b/src/urllib3/connectionpool.py index 96844d9..1fe9502 100644 --- a/src/urllib3/connectionpool.py +++ b/src/urllib3/connectionpool.py @@ -9,6 +9,7 @@ import warnings from socket import error as SocketError from socket import timeout as SocketTimeout +from ._collections import HTTPHeaderDict from .connection import ( BaseSSLError, BrokenPipeError, @@ -843,7 +844,11 @@ class HTTPConnectionPool(ConnectionPool, RequestMethods): redirect_location = redirect and response.get_redirect_location() if redirect_location: if response.status == 303: + # Change the method according to RFC 9110, Section 15.4.4. method = "GET" + # And lose the body not to transfer anything sensitive + body = None + headers = HTTPHeaderDict(headers)._prepare_for_method_change() try: retries = retries.increment(method, url, response=response, _pool=self) diff --git a/src/urllib3/poolmanager.py b/src/urllib3/poolmanager.py index 14b10da..d69955a 100644 --- a/src/urllib3/poolmanager.py +++ b/src/urllib3/poolmanager.py @@ -4,7 +4,7 @@ import collections import functools import logging -from ._collections import RecentlyUsedContainer +from ._collections import HTTPHeaderDict, RecentlyUsedContainer from .connectionpool import HTTPConnectionPool, HTTPSConnectionPool, port_by_scheme from .exceptions import ( LocationValueError, @@ -382,9 +382,12 @@ class PoolManager(RequestMethods): # Support relative URLs for redirecting. redirect_location = urljoin(url, redirect_location) - # RFC 7231, Section 6.4.4 if response.status == 303: + # Change the method according ro RFC 9110, Section 15.4.4. method = "GET" + # And lose the body not to transfer anything sensitive. + kw["body"] = None + kw["headers"] = HTTPHeaderDict(kw["headers"])._prepare_for_method_change() retries = kw.get("retries") if not isinstance(retries, Retry): -- 2.23.0
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.
浙ICP备2022010568号-2