[3.9] gh-102153: Start stripping C0 control and space chars in urlsplit (GH-102508) (GH-104575) (GH-104592) by miss-islington · Pull Request #104593 · python/cpython (original) (raw)

gh-102153: Start stripping C0 control and space chars in urlsplit (GH-102508)

urllib.parse.urlsplit has already been respecting the WHATWG spec a bit GH-25595.

This adds more sanitizing to respect the "Remove any leading C0 control or space from input" rule in response to CVE-2023-24329.

I simplified the docs by eliding the state of the world explanatory
paragraph in this security release only backport. (people will see
that in the mainline /3/ docs)

(cherry picked from commit 2f630e1)
(cherry picked from commit 610cc0a)

(cherry picked from commit f48a96a)

Co-authored-by: Miss Islington (bot) 31488909+miss-islington@users.noreply.github.com
Co-authored-by: Illia Volochii illia.volochii@gmail.com
Co-authored-by: Gregory P. Smith [Google] greg@krypto.org