From 374bf2ea399cd1f2abbc0890fe796d570416adea Mon Sep 17 00:00:00 2001

From: Ryan Petrello <rpetrell@redhat.com>

Date: Tue, 30 Apr 2019 12:36:48 -0400

Subject: [PATCH 1/2] prevent CVE-2019-9740 in 1.24.x

adapted from https://github.com/python/cpython/pull/12755

---

 test/test_util.py   | 5 +++++

 urllib3/util/url.py | 8 ++++++++

 2 files changed, 13 insertions(+)

diff --git a/test/test_util.py b/test/test_util.py

index c850d91..5fa49bb 100644

--- a/test/test_util.py

+++ b/test/test_util.py

@@ -142,6 +142,11 @@ class TestUtil(unittest.TestCase):

     def test_parse_url_invalid_IPv6(self):

         self.assertRaises(ValueError, parse_url, '[::1')

+    def test_parse_url_contains_control_characters(self):

+        # see CVE-2019-9740

+        with self.assertRaises(LocationParseError):

+            parse_url('http://localhost:8000/ HTTP/1.1\r\nHEADER: INJECTED\r\nIgnore:')

+

     def test_Url_str(self):

         U = Url('http', host='google.com')

         self.assertEqual(str(U), U.url)

diff --git a/urllib3/util/url.py b/urllib3/util/url.py

index b2ec834..7878892 100644

--- a/urllib3/util/url.py

+++ b/urllib3/util/url.py

@@ -1,10 +1,13 @@

 from collections import namedtuple

+import re

 from ..exceptions import LocationParseError

 url_attrs = ['scheme', 'auth', 'host', 'port', 'path', 'query', 'fragment']

+_contains_disallowed_url_pchar_re = re.compile('[\x00-\x20\x7f]')

+

 class Url(namedtuple('Url', url_attrs)):

     """

@@ -142,6 +145,11 @@ def parse_url(url):

         # Empty

         return Url()

+    # Prevent CVE-2019-9740.

+    # adapted from https://github.com/python/cpython/pull/12755

+    if _contains_disallowed_url_pchar_re.search(url):

+        raise LocationParseError("URL can't contain control characters. {!r}".format(url))

+

     scheme = None

     auth = None

     host = None

From 5661da387242337e09a939120a1e154e7335d18b Mon Sep 17 00:00:00 2001

From: Ryan Petrello <lists@ryanpetrello.com>

Date: Wed, 1 May 2019 16:46:44 -0400

Subject: [PATCH 2/2] avoid CVE-2019-9740 by percent-encoding invalid path

 characters

this is to avoid breaking changes in downstream libraries like requests

---

 test/test_util.py   | 4 ++--

 urllib3/util/url.py | 4 ++--

 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/test/test_util.py b/test/test_util.py

index 5fa49bb..122e00b 100644

--- a/test/test_util.py

+++ b/test/test_util.py

@@ -144,8 +144,8 @@ class TestUtil(unittest.TestCase):

     def test_parse_url_contains_control_characters(self):

         # see CVE-2019-9740

-        with self.assertRaises(LocationParseError):

-            parse_url('http://localhost:8000/ HTTP/1.1\r\nHEADER: INJECTED\r\nIgnore:')

+        url = parse_url('http://localhost:8000/ HTTP/1.1\r\nHEADER: INJECTED\r\nIgnore:')

+        self.assertEqual(url.path, '/%20HTTP/1.1%0D%0AHEADER:%20INJECTED%0D%0AIgnore:')

     def test_Url_str(self):

         U = Url('http', host='google.com')

diff --git a/urllib3/util/url.py b/urllib3/util/url.py

index 7878892..cc15b6b 100644

--- a/urllib3/util/url.py

+++ b/urllib3/util/url.py

@@ -2,6 +2,7 @@ from collections import namedtuple

 import re

 from ..exceptions import LocationParseError

+from six.moves.urllib.parse import quote

 url_attrs = ['scheme', 'auth', 'host', 'port', 'path', 'query', 'fragment']

@@ -147,8 +148,7 @@ def parse_url(url):

     # Prevent CVE-2019-9740.

     # adapted from https://github.com/python/cpython/pull/12755

-    if _contains_disallowed_url_pchar_re.search(url):

-        raise LocationParseError("URL can't contain control characters. {!r}".format(url))

+    url = _contains_disallowed_url_pchar_re.sub(lambda match: quote(match.group()), url)

     scheme = None

     auth = None