[ python-Bugs-900898 ] urllib2 AuthHandlers can pass a bad host to HTTPPasswordMgr

[SourceForge.net]

Bugs item #900898, was opened at 2004-02-20 01:51
Message generated for change (Comment added) made by jk7
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=900898&group_id=5470

Category: Python Library
Group: Python 2.3
Status: Open
Resolution: None
Priority: 5
Submitted By: James Kruth (jk7)
Assigned to: Nobody/Anonymous (nobody)
Summary: urllib2 AuthHandlers can pass a bad host to HTTPPasswordMgr

Initial Comment:
If the Request object being used returns a URI with a
port included (e.g. http://www.mysite.com:7777/index.html)

If Request.get_full_url() or Request.get_host() returns
a URI or host with a port included (e.g.
http://www.mysite.com:7777/index.html or
www.mysite.com:7777, respectively), and authentication
(proxy or http, basic only) is required, then the
respective AuthHandlers (HTTPBasicAuthHandler,
ProxyBasicAuthHandler) end up calling
http_error_auth_reqed with a host looking like
"www.mysite.com:7777".  http_error_auth_reqed then
precedes to call retry_http_basic_auth with the same
host parameter, which in turn calls
HTTPPasswordMgr.find_user_password.  The problem is
that find_user_password appears to expect a full URI,
and attempts to reduce it to just a host, by calling
reduce_uri.  If a bare host with a port is passed (like
"www.mysite.com:7777"), then reduce_uri returns just
the port number in the netloc position - which
find_user_password then attempts to compare against the
correct host name you've stored in your HTTPPasswordMgr
object along with your user name and password.  I
believe either find_user_password should not reduce the
host, or the  Auth Handler objects should pass full
hostnames to find_user_password.

----------------------------------------------------------------------

>Comment By: James Kruth (jk7)
Date: 2004-02-20 16:25

Message:
Logged In: YES 
user_id=979977

Here's a sample of the problem...

----------------------------------------------------------------------

Comment By: James Kruth (jk7)
Date: 2004-02-20 09:39

Message:
Logged In: YES 
user_id=979977

I've made up a file with some source code and comments that
will hopefully clarify what I posted.  I will post an
example of the problem a bit later today.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=900898&group_id=5470