|
|
afe2ee |
From c734f873270cf9ca414832423f7aad98443c379f Mon Sep 17 00:00:00 2001
|
|
|
afe2ee |
From: Lumir Balhar <lbalhar@redhat.com>
|
|
|
afe2ee |
Date: Thu, 9 Jan 2020 11:26:24 +0100
|
|
|
afe2ee |
Subject: [PATCH] CVE-2018-20060
|
|
|
afe2ee |
|
|
|
afe2ee |
---
|
|
|
afe2ee |
poolmanager.py | 11 ++++++++++-
|
|
|
afe2ee |
util/retry.py | 12 +++++++++++-
|
|
|
afe2ee |
2 files changed, 21 insertions(+), 2 deletions(-)
|
|
|
afe2ee |
|
|
|
afe2ee |
diff --git a/poolmanager.py b/poolmanager.py
|
|
|
afe2ee |
index 4ae9174..bfa5115 100644
|
|
|
afe2ee |
--- a/poolmanager.py
|
|
|
afe2ee |
+++ b/poolmanager.py
|
|
|
afe2ee |
@@ -312,8 +312,9 @@ class PoolManager(RequestMethods):
|
|
|
afe2ee |
|
|
|
afe2ee |
kw['assert_same_host'] = False
|
|
|
afe2ee |
kw['redirect'] = False
|
|
|
afe2ee |
+
|
|
|
afe2ee |
if 'headers' not in kw:
|
|
|
afe2ee |
- kw['headers'] = self.headers
|
|
|
afe2ee |
+ kw['headers'] = self.headers.copy()
|
|
|
afe2ee |
|
|
|
afe2ee |
if self.proxy is not None and u.scheme == "http":
|
|
|
afe2ee |
response = conn.urlopen(method, url, **kw)
|
|
|
afe2ee |
@@ -335,6 +336,14 @@ class PoolManager(RequestMethods):
|
|
|
afe2ee |
if not isinstance(retries, Retry):
|
|
|
afe2ee |
retries = Retry.from_int(retries, redirect=redirect)
|
|
|
afe2ee |
|
|
|
afe2ee |
+ # Strip headers marked as unsafe to forward to the redirected location.
|
|
|
afe2ee |
+ # Check remove_headers_on_redirect to avoid a potential network call within
|
|
|
afe2ee |
+ # conn.is_same_host() which may use socket.gethostbyname() in the future.
|
|
|
afe2ee |
+ if (retries.remove_headers_on_redirect
|
|
|
afe2ee |
+ and not conn.is_same_host(redirect_location)):
|
|
|
afe2ee |
+ for header in retries.remove_headers_on_redirect:
|
|
|
afe2ee |
+ kw['headers'].pop(header, None)
|
|
|
afe2ee |
+
|
|
|
afe2ee |
try:
|
|
|
afe2ee |
retries = retries.increment(method, url, response=response, _pool=conn)
|
|
|
afe2ee |
except MaxRetryError:
|
|
|
afe2ee |
diff --git a/util/retry.py b/util/retry.py
|
|
|
afe2ee |
index c603cb4..0b83963 100644
|
|
|
afe2ee |
--- a/util/retry.py
|
|
|
afe2ee |
+++ b/util/retry.py
|
|
|
afe2ee |
@@ -126,6 +126,11 @@ class Retry(object):
|
|
|
afe2ee |
exhausted, to raise a MaxRetryError, or to return a response with a
|
|
|
afe2ee |
response code in the 3xx range.
|
|
|
afe2ee |
|
|
|
afe2ee |
+ :param iterable remove_headers_on_redirect:
|
|
|
afe2ee |
+ Sequence of headers to remove from the request when a response
|
|
|
afe2ee |
+ indicating a redirect is returned before firing off the redirected
|
|
|
afe2ee |
+ request
|
|
|
afe2ee |
+
|
|
|
afe2ee |
:param bool raise_on_status: Similar meaning to ``raise_on_redirect``:
|
|
|
afe2ee |
whether we should raise an exception, or return a response,
|
|
|
afe2ee |
if status falls in ``status_forcelist`` range and retries have
|
|
|
afe2ee |
@@ -144,6 +149,8 @@ class Retry(object):
|
|
|
afe2ee |
DEFAULT_METHOD_WHITELIST = frozenset([
|
|
|
afe2ee |
'HEAD', 'GET', 'PUT', 'DELETE', 'OPTIONS', 'TRACE'])
|
|
|
afe2ee |
|
|
|
afe2ee |
+ DEFAULT_REDIRECT_HEADERS_BLACKLIST = frozenset(['Authorization'])
|
|
|
afe2ee |
+
|
|
|
afe2ee |
RETRY_AFTER_STATUS_CODES = frozenset([413, 429, 503])
|
|
|
afe2ee |
|
|
|
afe2ee |
#: Maximum backoff time.
|
|
|
afe2ee |
@@ -152,7 +159,8 @@ class Retry(object):
|
|
|
afe2ee |
def __init__(self, total=10, connect=None, read=None, redirect=None, status=None,
|
|
|
afe2ee |
method_whitelist=DEFAULT_METHOD_WHITELIST, status_forcelist=None,
|
|
|
afe2ee |
backoff_factor=0, raise_on_redirect=True, raise_on_status=True,
|
|
|
afe2ee |
- history=None, respect_retry_after_header=True):
|
|
|
afe2ee |
+ history=None, respect_retry_after_header=True,
|
|
|
afe2ee |
+ remove_headers_on_redirect=DEFAULT_REDIRECT_HEADERS_BLACKLIST):
|
|
|
afe2ee |
|
|
|
afe2ee |
self.total = total
|
|
|
afe2ee |
self.connect = connect
|
|
|
afe2ee |
@@ -171,6 +179,7 @@ class Retry(object):
|
|
|
afe2ee |
self.raise_on_status = raise_on_status
|
|
|
afe2ee |
self.history = history or tuple()
|
|
|
afe2ee |
self.respect_retry_after_header = respect_retry_after_header
|
|
|
afe2ee |
+ self.remove_headers_on_redirect = remove_headers_on_redirect
|
|
|
afe2ee |
|
|
|
afe2ee |
def new(self, **kw):
|
|
|
afe2ee |
params = dict(
|
|
|
afe2ee |
@@ -182,6 +191,7 @@ class Retry(object):
|
|
|
afe2ee |
raise_on_redirect=self.raise_on_redirect,
|
|
|
afe2ee |
raise_on_status=self.raise_on_status,
|
|
|
afe2ee |
history=self.history,
|
|
|
afe2ee |
+ remove_headers_on_redirect=self.remove_headers_on_redirect,
|
|
|
afe2ee |
)
|
|
|
afe2ee |
params.update(kw)
|
|
|
afe2ee |
return type(self)(**params)
|
|
|
afe2ee |
--
|
|
|
afe2ee |
2.24.1
|
|
|
afe2ee |
|