gh-87389: avoid treating path as URI with netloc by nascheme · Pull Request #93894 · python/cpython · GitHub

github.com

GitHub CopilotWrite better code with AI | MCP RegistryIntegrate external tools | ActionsAutomate any workflow | CodespacesInstant dev environments | IssuesPlan and track work | Code ReviewManage code changes | Code QualityEnforce quality at merge | Why GitHub | Marketplace | View all features | Enterprises | Small and medium teams | Startups | View all use cases | View all industries | View all solutions | AI | Software Development | DevOps | Security | View all topics | Customer stories | Events & webinars | Ebooks & reports | Business insights | Trust center | Partners | View all resources

Tin mới

nascheme:urlunsplit_relative

GitHub CopilotWrite better code with AI

GitHub Copilot appDirect agents from issue to merge

ActionsAutomate any workflow

CodespacesInstant dev environments

IssuesPlan and track work

Code ReviewManage code changes

Code QualityEnforce quality at merge

GitHub Advanced SecurityFind and fix vulnerabilities

Code securitySecure your code as you build

Secret protectionStop leaks before they start

View all use cases

Financial services

View all industries

Software Development

GitHub SponsorsFund open source developers

Copilot for BusinessEnterprise-grade AI features

Premium SupportEnterprise-grade 24/7 support

Pull requests 2.6k

Security and quality 0

wip: alternative fix for

awaiting core review

gh-87389: Fix an open redirection vulnerability in http.server. #93879

Don't strip slashes if not building relative URL.

Add unit test for urlunsplit relative URL case.

View reviewed changes

needs backport to 3.7

needs backport to 3.10

needs backport to 3.11

sanitize paths that can be confused as scheme

Improve name and comment for _get_redirect_url().

Add urllib.parse.pathsplit() function.

awaiting change review

Fix blurb formating, add note about pathsplit().

Improve comments and docs.

Add basic unit test for pathsplit().

Fix markup in blurb.

View reviewed changes

Learn more about hiding disruptive comments

The reason will be displayed to describe this comment to others. Learn more.

Use pathsplit() in translate_path().

Improved unit tests from gps.

Add test for Request-URI containing scheme.

Make _get_redirect_url() into a method.

Futher cleanups, remove urllib.parse.pathsplit().

View reviewed changes

Merge branch 'main' into urlunsplit_relative

[security] CVE-2021-28861: http.server: Open Redirection if the URL path starts with // #87389

Merge branch 'main' into urlunsplit_relative

github-actions Bot commented Apr 11, 2026

This PR is stale because it has been open for 30 days with no activity.

Tin khác