Skip to content

[3.9] bpo-42967: only use '&' as a query string separator (GH-24297) #24528

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 11 commits into from
Feb 15, 2021
Merged

[3.9] bpo-42967: only use '&' as a query string separator (GH-24297) #24528

merged 11 commits into from
Feb 15, 2021

Conversation

orsenthil
Copy link
Member

@orsenthil orsenthil commented Feb 15, 2021

[3.9] bpo-42967: only use '&' as a query string separator (GH-24297)

Backport of fcbe0cb to 3.9

https://bugs.python.org/issue42967

AdamGold and others added 2 commits February 14, 2021 17:35
bpo-42967: [security] Address a web cache-poisoning issue reported in
urllib.parse.parse_qsl().

urllib.parse will only us "&" as query string separator by default
instead of both ";" and "&" as allowed in earlier versions. An optional
argument seperator with default value "&" is added to specify the
separator.

Co-authored-by: Éric Araujo <merwok@netwok.org>
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Éric Araujo <merwok@netwok.org>

(cherry picked from commit fcbe0cb)
bpo-42967: [security] Address a web cache-poisoning issue reported in urllib.parse.parse_qsl().

urllib.parse will only us "&" as query string separator by default instead of both ";" and "&" as allowed in earlier versions. An optional argument seperator with default value "&" is added to specify the separator.

Co-authored-by: Éric Araujo <merwok@netwok.org>
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Éric Araujo <merwok@netwok.org>.
(cherry picked from commit fcbe0cb)

Co-authored-by: Adam Goldschmidt <adamgold7@gmail.com>
@@ -235,6 +243,10 @@ or on combining URL components into a URL string.
.. versionchanged:: 3.8
Added *max_num_fields* parameter.

.. versionchanged:: 3.10
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

3.9.2

@orsenthil
Copy link
Member Author

@AdamGold / @Fidget-Spinner - I'd like to request your reviews on these backport PRs. This one, #24529, #24531 and #24532 .

Hopefully, I took care of having right version mentioned in each respective branches. Python 3.6.x was a little special because some methods in CGI had different signature, so you could verify if backport was proper.

@Fidget-Spinner
Copy link
Member

Fidget-Spinner commented Feb 15, 2021

@orsenthil thank you for taking the time to create the manual backports! Looking through this, the code looks fine, though I noticed some errors in the docs that we missed in the original PR and in the backports too :(. I can make a PR to fix the docs on 3.10 branch another time (it's way easier compared to the maintenance branches anyways).

Edit:
Sorry, could you add me as collaborator to your cpython fork please? That way I can just push all the changes to your branches to save your time. Though I don't mind submitting PRs towards your forks too.

Copy link
Member

@Fidget-Spinner Fidget-Spinner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mostly a bunch of doc fixes, which need to be applied to the other backports and main branch too (I'll handle the last one).

In the meantime, I'll go investigate the 3.6 incompatibilities.

After the doc problems are addressed, LGTM :).

@AdamGold
Copy link
Contributor

My bad on the docs. Code looks good to me, were there any conflicts?

orsenthil and others added 8 commits February 15, 2021 08:05
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
@orsenthil
Copy link
Member Author

@Fidget-Spinner - Thank you for these changes. BTW, if you like to directly push to 3.8, 3.7, and 3.6 branches to my fork, I invited you as collaborator. That will be easier. (cherry-pick from master will result in manual updates too).

@AdamGold - Not many changes were required. The patches very comprehensive. Since we are making across multiple versions, trying to make sure that version string is accurate when users read the docs.

Copy link
Member

@Fidget-Spinner Fidget-Spinner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

Senthil:
I received the invite, thank you!

Adam:
No worries about the docs :), I should've caught them earlier.

@AdamGold
Copy link
Contributor

Thanks! Found an issue in #24532, other than that everything looks good.

@orsenthil orsenthil merged commit c9f0781 into python:3.9 Feb 15, 2021
@bedevere-bot
Copy link

@orsenthil: Please replace # with GH- in the commit message next time. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants