wok view python/stuff/CVE-2011-1521.patch @ rev 10950
get-virtualbox: only /opt/VirtualBox is supported now...
| author | Pascal Bellard <pascal.bellard@slitaz.org> |
|---|---|
| date | Fri Sep 02 14:26:45 2011 +0200 (2011-09-02) |
| parents | |
| children |
line source
1 diff -Naur Python-2.7.1.ori/Lib/test/test_urllib2.py Python-2.7.1/Lib/test/test_urllib2.py
2 --- Python-2.7.1.ori/Lib/test/test_urllib2.py 2010-11-21 21:04:33.000000000 -0800
3 +++ Python-2.7.1/Lib/test/test_urllib2.py 2011-04-15 05:02:13.278853672 -0700
4 @@ -969,6 +969,27 @@
5 self.assertEqual(count,
6 urllib2.HTTPRedirectHandler.max_redirections)
8 + def test_invalid_redirect(self):
9 + from_url = "http://example.com/a.html"
10 + valid_schemes = ['http', 'https', 'ftp']
11 + invalid_schemes = ['file', 'imap', 'ldap']
12 + schemeless_url = "example.com/b.html"
13 + h = urllib2.HTTPRedirectHandler()
14 + o = h.parent = MockOpener()
15 + req = Request(from_url)
16 +
17 + for scheme in invalid_schemes:
18 + invalid_url = scheme + '://' + schemeless_url
19 + self.assertRaises(urllib2.HTTPError, h.http_error_302,
20 + req, MockFile(), 302, "Security Loophole",
21 + MockHeaders({"location": invalid_url}))
22 +
23 + for scheme in valid_schemes:
24 + valid_url = scheme + '://' + schemeless_url
25 + h.http_error_302(req, MockFile(), 302, "That's fine",
26 + MockHeaders({"location": valid_url}))
27 + self.assertEqual(o.req.get_full_url(), valid_url)
28 +
29 def test_cookie_redirect(self):
30 # cookies shouldn't leak into redirected requests
31 from cookielib import CookieJar
32 diff -Naur Python-2.7.1.ori/Lib/test/test_urllib.py Python-2.7.1/Lib/test/test_urllib.py
33 --- Python-2.7.1.ori/Lib/test/test_urllib.py 2010-11-21 05:34:58.000000000 -0800
34 +++ Python-2.7.1/Lib/test/test_urllib.py 2011-04-15 05:02:13.278853672 -0700
35 @@ -161,6 +161,20 @@
36 finally:
37 self.unfakehttp()
39 + def test_invalid_redirect(self):
40 + # urlopen() should raise IOError for many error codes.
41 + self.fakehttp("""HTTP/1.1 302 Found
42 +Date: Wed, 02 Jan 2008 03:03:54 GMT
43 +Server: Apache/1.3.33 (Debian GNU/Linux) mod_ssl/2.8.22 OpenSSL/0.9.7e
44 +Location: file:README
45 +Connection: close
46 +Content-Type: text/html; charset=iso-8859-1
47 +""")
48 + try:
49 + self.assertRaises(IOError, urllib.urlopen, "http://python.org/")
50 + finally:
51 + self.unfakehttp()
52 +
53 def test_empty_socket(self):
54 # urlopen() raises IOError if the underlying socket does not send any
55 # data. (#1680230)
56 diff -Naur Python-2.7.1.ori/Lib/urllib2.py Python-2.7.1/Lib/urllib2.py
57 --- Python-2.7.1.ori/Lib/urllib2.py 2010-11-20 03:24:08.000000000 -0800
58 +++ Python-2.7.1/Lib/urllib2.py 2011-04-15 05:02:13.278853672 -0700
59 @@ -579,6 +579,17 @@
61 newurl = urlparse.urljoin(req.get_full_url(), newurl)
63 + # For security reasons we do not allow redirects to protocols
64 + # other than HTTP, HTTPS or FTP.
65 + newurl_lower = newurl.lower()
66 + if not (newurl_lower.startswith('http://') or
67 + newurl_lower.startswith('https://') or
68 + newurl_lower.startswith('ftp://')):
69 + raise HTTPError(newurl, code,
70 + msg + " - Redirection to url '%s' is not allowed" %
71 + newurl,
72 + headers, fp)
73 +
74 # XXX Probably want to forget about the state of the current
75 # request, although that might interact poorly with other
76 # handlers that also use handler-specific request attributes
77 diff -Naur Python-2.7.1.ori/Lib/urllib.py Python-2.7.1/Lib/urllib.py
78 --- Python-2.7.1.ori/Lib/urllib.py 2010-11-21 21:04:33.000000000 -0800
79 +++ Python-2.7.1/Lib/urllib.py 2011-04-15 05:02:13.278853672 -0700
80 @@ -644,6 +644,18 @@
81 fp.close()
82 # In case the server sent a relative URL, join with original:
83 newurl = basejoin(self.type + ":" + url, newurl)
84 +
85 + # For security reasons we do not allow redirects to protocols
86 + # other than HTTP, HTTPS or FTP.
87 + newurl_lower = newurl.lower()
88 + if not (newurl_lower.startswith('http://') or
89 + newurl_lower.startswith('https://') or
90 + newurl_lower.startswith('ftp://')):
91 + raise IOError('redirect error', errcode,
92 + errmsg + " - Redirection to url '%s' is not allowed" %
93 + newurl,
94 + headers)
95 +
96 return self.open(newurl)
98 def http_error_301(self, url, fp, errcode, errmsg, headers, data=None):