[Python-checkins] r88819 - in python/branches/release25-maint/Lib: urllib.py urllib2.py

[martin.v.loewis]

Author: martin.v.loewis
Date: Sun Apr 17 22:38:14 2011
New Revision: 88819

Log:
hg dd852a0f92d6 by guido at google.com
Issue 22663: fix redirect vulnerability in urllib/urllib2.


Modified:
   python/branches/release25-maint/Lib/urllib.py
   python/branches/release25-maint/Lib/urllib2.py

Modified: python/branches/release25-maint/Lib/urllib.py
==============================================================================
--- python/branches/release25-maint/Lib/urllib.py	(original)
+++ python/branches/release25-maint/Lib/urllib.py	Sun Apr 17 22:38:14 2011
@@ -638,10 +638,19 @@
             newurl = headers['uri']
         else:
             return
-        void = fp.read()
-        fp.close()
+
         # In case the server sent a relative URL, join with original:
         newurl = basejoin(self.type + ":" + url, newurl)
+
+        # For security reasons we do not allow redirects to protocols
+        # other than HTTP or HTTPS.
+        newurl_lower = newurl.lower()
+        if not (newurl_lower.startswith('http://') or
+                newurl_lower.startswith('https://')):
+            return
+
+        void = fp.read()
+        fp.close()
         return self.open(newurl)
 
     def http_error_301(self, url, fp, errcode, errmsg, headers, data=None):

Modified: python/branches/release25-maint/Lib/urllib2.py
==============================================================================
--- python/branches/release25-maint/Lib/urllib2.py	(original)
+++ python/branches/release25-maint/Lib/urllib2.py	Sun Apr 17 22:38:14 2011
@@ -555,6 +555,13 @@
             return
         newurl = urlparse.urljoin(req.get_full_url(), newurl)
 
+        # For security reasons we do not allow redirects to protocols
+        # other than HTTP or HTTPS.
+        newurl_lower = newurl.lower()
+        if not (newurl_lower.startswith('http://') or
+                newurl_lower.startswith('https://')):
+            return
+
         # XXX Probably want to forget about the state of the current
         # request, although that might interact poorly with other
         # handlers that also use handler-specific request attributes