Skip to content

[3.9] bpo-42967: only use '&' as a query string separator (GH-24297) #24528

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 11 commits into from
Feb 15, 2021
Merged

[3.9] bpo-42967: only use '&' as a query string separator (GH-24297) #24528

merged 11 commits into from
Feb 15, 2021
+176 −46

Conversation

orsenthil
Copy link
Member

@orsenthil orsenthil commented Feb 15, 2021 •
edited by bedevere-bot
Loading

[3.9] bpo-42967: only use '&' as a query string separator (GH-24297)

Backport of fcbe0cb to 3.9

https://bugs.python.org/issue42967

AdamGold and others added 2 commits February 14, 2021 17:35
@AdamGold @orsenthil
bpo-42967: only use '&' as a query string separator (#24297)
273e15f 
bpo-42967: [security] Address a web cache-poisoning issue reported in
urllib.parse.parse_qsl().

urllib.parse will only us "&" as query string separator by default
instead of both ";" and "&" as allowed in earlier versions. An optional
argument seperator with default value "&" is added to specify the
separator.

Co-authored-by: Éric Araujo <merwok@netwok.org>
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Éric Araujo <merwok@netwok.org>

(cherry picked from commit fcbe0cb)
@orsenthil @AdamGold
[3.9] bpo-42967: only use '&' as a query string separator (GH-24297)
c920ee5 
bpo-42967: [security] Address a web cache-poisoning issue reported in urllib.parse.parse_qsl().

urllib.parse will only us "&" as query string separator by default instead of both ";" and "&" as allowed in earlier versions. An optional argument seperator with default value "&" is added to specify the separator.

Co-authored-by: Éric Araujo <merwok@netwok.org>
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Éric Araujo <merwok@netwok.org>.
(cherry picked from commit fcbe0cb)

Co-authored-by: Adam Goldschmidt <adamgold7@gmail.com>
@bedevere-bot bedevere-bot mentioned this pull request Feb 15, 2021
Merged
orsenthil
orsenthil commented Feb 15, 2021
View reviewed changes
orsenthil
orsenthil commented Feb 15, 2021
View reviewed changes
orsenthil
orsenthil commented Feb 15, 2021
View reviewed changes
orsenthil
orsenthil commented Feb 15, 2021
View reviewed changes
Doc/library/urllib.parse.rst Outdated
@@ -235,6 +243,10 @@ or on combining URL components into a URL string.
.. versionchanged:: 3.8
Added *max_num_fields* parameter.

.. versionchanged:: 3.10
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

3.9.2

orsenthil
orsenthil commented Feb 15, 2021
View reviewed changes
@orsenthil
Copy link
Member Author

@AdamGold / @Fidget-Spinner - I'd like to request your reviews on these backport PRs. This one, #24529, #24531 and #24532 .

Hopefully, I took care of having right version mentioned in each respective branches. Python 3.6.x was a little special because some methods in CGI had different signature, so you could verify if backport was proper.

@Fidget-Spinner
Copy link
Member

Fidget-Spinner commented Feb 15, 2021 •
edited
Loading

@orsenthil thank you for taking the time to create the manual backports! Looking through this, the code looks fine, though I noticed some errors in the docs that we missed in the original PR and in the backports too :(. I can make a PR to fix the docs on 3.10 branch another time (it's way easier compared to the maintenance branches anyways).

Edit:
Sorry, could you add me as collaborator to your cpython fork please? That way I can just push all the changes to your branches to save your time. Though I don't mind submitting PRs towards your forks too.

Fidget-Spinner
Fidget-Spinner reviewed Feb 15, 2021
View reviewed changes
Copy link
Member

@Fidget-Spinner Fidget-Spinner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mostly a bunch of doc fixes, which need to be applied to the other backports and main branch too (I'll handle the last one).

In the meantime, I'll go investigate the 3.6 incompatibilities.

After the doc problems are addressed, LGTM :).

Fidget-Spinner
Fidget-Spinner reviewed Feb 15, 2021
View reviewed changes
@Fidget-Spinner Fidget-Spinner mentioned this pull request Feb 15, 2021
Merged
@AdamGold
Copy link
Contributor

My bad on the docs. Code looks good to me, were there any conflicts?

orsenthil and others added 8 commits February 15, 2021 08:05
@orsenthil @Fidget-Spinner
Update Doc/library/urllib.parse.rst
95c9ce7 
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
@orsenthil @Fidget-Spinner
Update Doc/library/urllib.parse.rst
81ce22d 
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
@orsenthil @Fidget-Spinner
Update Doc/library/urllib.parse.rst
8d08c60 
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
@orsenthil @Fidget-Spinner
Update Doc/library/urllib.parse.rst
6b53c44 
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
@orsenthil @Fidget-Spinner
Update Doc/whatsnew/3.6.rst
10e4828 
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
@orsenthil @Fidget-Spinner
Update Doc/whatsnew/3.8.rst
21a2822 
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
@orsenthil @Fidget-Spinner
Update Doc/whatsnew/3.9.rst
23792f6 
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
@orsenthil @Fidget-Spinner
Update Lib/urllib/parse.py
eb39e45 
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
@Fidget-Spinner Fidget-Spinner mentioned this pull request Feb 15, 2021
Merged
@orsenthil
Copy link
Member Author

@Fidget-Spinner - Thank you for these changes. BTW, if you like to directly push to 3.8, 3.7, and 3.6 branches to my fork, I invited you as collaborator. That will be easier. (cherry-pick from master will result in manual updates too).

@AdamGold - Not many changes were required. The patches very comprehensive. Since we are making across multiple versions, trying to make sure that version string is accurate when users read the docs.

Fidget-Spinner
Fidget-Spinner approved these changes Feb 15, 2021
View reviewed changes
Copy link
Member

@Fidget-Spinner Fidget-Spinner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

Senthil:
I received the invite, thank you!

Adam:
No worries about the docs :), I should've caught them earlier.

@AdamGold
Copy link
Contributor

Thanks! Found an issue in #24532, other than that everything looks good.

@orsenthil orsenthil merged commit c9f0781 into python:3.9 Feb 15, 2021
@bedevere-bot
Copy link

@orsenthil: Please replace # with GH- in the commit message next time. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Fidget-Spinner Fidget-Spinner Fidget-Spinner approved these changes

@ethanfurman ethanfurman Awaiting requested review from ethanfurman ethanfurman is a code owner

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@orsenthil @Fidget-Spinner @AdamGold @bedevere-bot @the-knights-who-say-ni