-
-
Notifications
You must be signed in to change notification settings - Fork 32.3k
[3.9] bpo-42967: only use '&' as a query string separator (GH-24297) #24528
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
bpo-42967: [security] Address a web cache-poisoning issue reported in urllib.parse.parse_qsl(). urllib.parse will only us "&" as query string separator by default instead of both ";" and "&" as allowed in earlier versions. An optional argument seperator with default value "&" is added to specify the separator. Co-authored-by: Éric Araujo <merwok@netwok.org> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com> Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com> Co-authored-by: Éric Araujo <merwok@netwok.org> (cherry picked from commit fcbe0cb)
bpo-42967: [security] Address a web cache-poisoning issue reported in urllib.parse.parse_qsl(). urllib.parse will only us "&" as query string separator by default instead of both ";" and "&" as allowed in earlier versions. An optional argument seperator with default value "&" is added to specify the separator. Co-authored-by: Éric Araujo <merwok@netwok.org> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com> Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com> Co-authored-by: Éric Araujo <merwok@netwok.org>. (cherry picked from commit fcbe0cb) Co-authored-by: Adam Goldschmidt <adamgold7@gmail.com>
Doc/library/urllib.parse.rst
Outdated
@@ -235,6 +243,10 @@ or on combining URL components into a URL string. | |||
.. versionchanged:: 3.8 | |||
Added *max_num_fields* parameter. | |||
|
|||
.. versionchanged:: 3.10 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
3.9.2
@AdamGold / @Fidget-Spinner - I'd like to request your reviews on these backport PRs. This one, #24529, #24531 and #24532 . Hopefully, I took care of having right version mentioned in each respective branches. Python 3.6.x was a little special because some methods in CGI had different signature, so you could verify if backport was proper. |
@orsenthil thank you for taking the time to create the manual backports! Looking through this, the code looks fine, though I noticed some errors in the docs that we missed in the original PR and in the backports too :(. I can make a PR to fix the docs on 3.10 branch another time (it's way easier compared to the maintenance branches anyways). Edit: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Mostly a bunch of doc fixes, which need to be applied to the other backports and main branch too (I'll handle the last one).
In the meantime, I'll go investigate the 3.6 incompatibilities.
After the doc problems are addressed, LGTM :).
My bad on the docs. Code looks good to me, were there any conflicts? |
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
@Fidget-Spinner - Thank you for these changes. BTW, if you like to directly push to 3.8, 3.7, and 3.6 branches to my fork, I invited you as collaborator. That will be easier. (cherry-pick from master will result in manual updates too). @AdamGold - Not many changes were required. The patches very comprehensive. Since we are making across multiple versions, trying to make sure that version string is accurate when users read the docs. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
Senthil:
I received the invite, thank you!
Adam:
No worries about the docs :), I should've caught them earlier.
Thanks! Found an issue in #24532, other than that everything looks good. |
@orsenthil: Please replace |
[3.9] bpo-42967: only use '&' as a query string separator (GH-24297)
Backport of fcbe0cb to 3.9
https://bugs.python.org/issue42967