bpo-27657: Fix urlparse() with numeric paths by timgraham · Pull Request #661 · python/cpython

timgraham · 2017-03-13T17:39:31Z

Revert parsing decision from bpo-754016 in favor of the documented
consensus in bpo-16932 of how to treat strings without a // to
designate the netloc.

https://bugs.python.org/issue27657
https://bugs.python.org/issue754016
https://bugs.python.org/issue16932

https://bugs.python.org/issue27657

mention-bot · 2017-03-13T17:39:33Z

@timgraham, thanks for your PR! By analyzing the history of the files in this pull request, we identified @orsenthil, @ncoghlan, @Yhg1s, @serhiy-storchaka and @facundobatista to be potential reviewers.

alex · 2017-03-18T19:30:13Z

(Fixed the conflicts, which was impressively pleasant!)

Revert parsing decision from bpo-754016 in favor of the documented consensus in bpo-16932 of how to treat strings without a // to designate the netloc.

auvipy

nice clean ups

orsenthil · 2019-05-31T16:29:55Z

This needs a core-dev review and approval. Introducing simple parsing changes can sometimes bring surprises, so we have to cognizant of that, and make sure our intended behavior is preserved.

orsenthil · 2019-10-18T13:05:48Z

Let's go with this. This simplifies the parsing logic in favor of all valid URLS. As noted in https://bugs.python.org/issue27657, all the previous attempts were to handle special cases and it was not helpful.

bedevere-bot · 2019-10-18T13:07:24Z

@orsenthil: Please replace # with GH- in the commit message next time. Thanks!

miss-islington · 2019-10-18T13:07:24Z

Thanks @timgraham for the PR, and @orsenthil for merging it 🌮🎉.. I'm working now to backport this PR to: 2.7, 3.7, 3.8.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

miss-islington · 2019-10-18T13:07:24Z

I'm having trouble backporting to 3.8. Reason: 'Error 110 while writing to socket. Connection timed out.'. Please retry by removing and re-adding the needs backport to 3.8 label.

bedevere-bot · 2019-10-18T13:07:38Z

GH-16837 is a backport of this pull request to the 3.7 branch.

miss-islington · 2019-10-18T13:07:39Z

Sorry, @timgraham and @orsenthil, I could not cleanly backport this to 2.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 5a88d50ff013a64fbdb25b877c87644a9034c969 2.7

* bpo-27657: Fix urlparse() with numeric paths Revert parsing decision from bpo-754016 in favor of the documented consensus in bpo-16932 of how to treat strings without a // to designate the netloc. * bpo-22891: Remove urlsplit() optimization for 'http' prefixed inputs. (cherry picked from commit 5a88d50) Co-authored-by: Tim Graham <timograham@gmail.com>

miss-islington · 2019-10-18T13:11:04Z

Thanks @timgraham for the PR, and @orsenthil for merging it 🌮🎉.. I'm working now to backport this PR to: 3.8.
🐍🍒⛏🤖

miss-islington · 2019-10-18T13:11:06Z

Sorry @timgraham and @orsenthil, I had trouble checking out the 3.8 backport branch.
Please backport using cherry_picker on command line.
cherry_picker 5a88d50ff013a64fbdb25b877c87644a9034c969 3.8

* bpo-27657: Fix urlparse() with numeric paths Revert parsing decision from bpo-754016 in favor of the documented consensus in bpo-16932 of how to treat strings without a // to designate the netloc. * bpo-22891: Remove urlsplit() optimization for 'http' prefixed inputs. (cherry picked from commit 5a88d50) Co-authored-by: Tim Graham <timograham@gmail.com>

bedevere-bot · 2019-10-18T13:51:50Z

GH-16839 is a backport of this pull request to the 3.8 branch.

* bpo-27657: Fix urlparse() with numeric paths Revert parsing decision from bpo-754016 in favor of the documented consensus in bpo-16932 of how to treat strings without a // to designate the netloc. * bpo-22891: Remove urlsplit() optimization for 'http' prefixed inputs. (cherry picked from commit 5a88d50) Co-authored-by: Tim Graham <timograham@gmail.com>

* bpo-27657: Fix urlparse() with numeric paths Revert parsing decision from bpo-754016 in favor of the documented consensus in bpo-16932 of how to treat strings without a // to designate the netloc. * bpo-22891: Remove urlsplit() optimization for 'http' prefixed inputs.

…16839)" This reverts commit 0f3187c.

@ned-deily

This reverts commit 82b5f6b. The change broke the backwards compatibility of parsing behavior in a patch release of Python (3.7.6). A decision was taken to revert this patch in 3.7.7. In https://bugs.python.org/issue27657 it was decided that the previous behavior like >>> urlparse('localhost:8080') ParseResult(scheme='', netloc='', path='localhost:8080', params='', query='', fragment='') >>> urlparse('undefined:8080') ParseResult(scheme='', netloc='', path='undefined:8080', params='', query='', fragment='') needs to be preserved in patch releases as number of users rely upon it. Explicitly mention the releases involved with the revert in NEWS. Adopt the wording suggested by @ned-deily.

the-knights-who-say-ni added the CLA signed label Mar 13, 2017

timgraham force-pushed the 27657 branch from 3bf09c5 to ea81263 Compare March 14, 2017 01:19

orsenthil assigned orsenthil and unassigned orsenthil Mar 18, 2017

timgraham force-pushed the 27657 branch from cc04534 to f0b7bdd Compare March 22, 2017 13:20

Mariatta added needs rebase and removed needs rebase labels Oct 9, 2017

timgraham force-pushed the 27657 branch from f0b7bdd to baf7dbd Compare December 26, 2017 19:33

brettcannon added the awaiting review label Feb 21, 2018

timgraham force-pushed the 27657 branch from baf7dbd to a4eb4d7 Compare October 25, 2018 19:01

timgraham added 2 commits March 7, 2019 19:17

bpo-27657: Fix urlparse() with numeric paths

c11fff5

Revert parsing decision from bpo-754016 in favor of the documented consensus in bpo-16932 of how to treat strings without a // to designate the netloc.

bpo-22891: Remove urlsplit() optimization for 'http' prefixed inputs.

3bb28d4

timgraham force-pushed the 27657 branch from a4eb4d7 to 3bb28d4 Compare March 8, 2019 00:21

auvipy approved these changes May 31, 2019

View reviewed changes

bedevere-bot added awaiting core review and removed awaiting review labels May 31, 2019

orsenthil added needs backport to 2.7 labels Oct 18, 2019

orsenthil merged commit 5a88d50 into python:master Oct 18, 2019

bedevere-bot removed awaiting core review needs backport to 3.7 labels Oct 18, 2019

miss-islington assigned orsenthil Oct 18, 2019

orsenthil added needs backport to 3.8 and removed needs backport to 3.8 labels Oct 18, 2019

bedevere-bot removed the needs backport to 3.8 label Oct 18, 2019

Reisen mentioned this pull request Feb 11, 2020

URI parser cannot parse URNs hyperium/http#379

Open

orsenthil added a commit that referenced this pull request Feb 16, 2020

Revert "[3.8] bpo-27657: Fix urlparse() with numeric paths (GH-661) (#…

bb9ff25

…16839)" This reverts commit 0f3187c.

This was referenced Feb 16, 2020

[3.8] bpo-27657: Revert "Fix urlparse() with numeric paths (GH-661) #18525

Merged

[3.7] bpo-27657: Revert - Fix urlparse() with numeric paths (GH-661)" #18526

Merged

tanj mentioned this pull request Dec 28, 2020

Potential open redirect vulnerablity in utils.helpers.redirect_or_next flaskbb/flaskbb#571

Closed

clokep mentioned this pull request Mar 11, 2021

allow specifying https:// proxy matrix-org/synapse#9119

Closed

4 tasks

timgraham deleted the 27657 branch May 19, 2021 01:39

gpshead mentioned this pull request Mar 9, 2023

urllib.parse space handling CVE-2023-24329 appears unfixed #102153

Closed

Uh oh!

Conversation

timgraham commented Mar 13, 2017 • edited by bedevere-bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mention-bot commented Mar 13, 2017

Uh oh!

alex commented Mar 18, 2017

Uh oh!

auvipy left a comment

Choose a reason for hiding this comment

Uh oh!

orsenthil commented May 31, 2019

Uh oh!

orsenthil commented Oct 18, 2019

Uh oh!

bedevere-bot commented Oct 18, 2019

Uh oh!

miss-islington commented Oct 18, 2019

Uh oh!

miss-islington commented Oct 18, 2019

Uh oh!

bedevere-bot commented Oct 18, 2019

Uh oh!

miss-islington commented Oct 18, 2019

Uh oh!

miss-islington commented Oct 18, 2019

Uh oh!

miss-islington commented Oct 18, 2019

Uh oh!

bedevere-bot commented Oct 18, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

timgraham commented Mar 13, 2017 •

edited by bedevere-bot

Loading