Skip to content

gh-137146: Validate IPv6 ZoneID characters against RFC 6874 in urllib.parse #137148

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 6 commits into
base: main
Choose a base branch
from
Open

gh-137146: Validate IPv6 ZoneID characters against RFC 6874 in urllib.parse #137148

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
58f0d09
[PATCH] urllib.parse: Restrict IPv6 ZoneID characters to RFC 6874-com…
mauricelambert Jul 27, 2025
e33f050
Add blurb entries for IPv6 ZoneID validation fixes
mauricelambert Jul 27, 2025
0e2684d
gh-137146: Fix unicode characters in IPv6 Zone ID
mauricelambert Jul 28, 2025
be71b37
gh-137146: Add tests on IPv6 Zone ID checks
mauricelambert Jul 28, 2025
41feeee
Fix: reStructuredText language syntax
mauricelambert Jul 28, 2025
b93e903
gh-137146: Fix tests on IPv6 Zone ID checks
mauricelambert Jul 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions Lib/test/test_urlparse.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
import unittest
import urllib.parse
from test import support
from string import ascii_letters, digits

RFC1808_BASE = "http://a/b/c/d;p?q#f"
RFC2396_BASE = "http://a/b/c/d;p?q"
Expand Down Expand Up @@ -1419,6 +1420,15 @@ def test_invalid_bracketed_hosts(self):
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix]v6a.ip[suffix')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix]v6a.ip')
self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip[suffix')
# unreserved = ALPHA / DIGIT / "-" / "." / "_" / "~"
unreserved = ascii_letters + digits + "-" + "." + "_" + "~"
zoneid_authorized_characters = unreserved
removed_characters = "\t\n\r"
for character in range(256):
character = chr(character)
if character in zoneid_authorized_characters or character in removed_characters:
continue
self.assertRaises(ValueError, urllib.parse.urlsplit, f'scheme://[::1%invalid{character}invalid]/')

def test_splitting_bracketed_hosts(self):
p1 = urllib.parse.urlsplit('scheme://user@[v6a.ip]:1234/path?query')
Expand Down
2 changes: 2 additions & 0 deletions Lib/urllib/parse.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -466,6 +466,8 @@ def _check_bracketed_host(hostname):
ip = ipaddress.ip_address(hostname) # Throws Value Error if not IPv6 or IPv4
if isinstance(ip, ipaddress.IPv4Address):
raise ValueError(f"An IPv4 address cannot be in brackets")
if "%" in hostname and not re.match(r"\A(%[a-fA-F0-9]{2}|[\w\.~-])+\z", hostname.split("%", 1)[1], flags=re.ASCII):
raise ValueError(f"IPv6 ZoneID is invalid")

# typed=True avoids BytesWarnings being emitted during cache key
# comparison since this API supports both bytes and str input.
Expand Down
1 change: 1 addition & 0 deletions Misc/NEWS.d/next/Library/2025-07-27-15-23-32.gh-issue-137146.BE_ylT.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Validate IPv6 ZoneID characters in bracketed hostnames to match RFC 6874. :func:`urllib.parse.urlparse` now rejects ZoneIDs containing invalid or unsafe characters.
Loading