[3.9] bpo-42967: only use '&' as a query string separator (GH-24297) #24528

orsenthil · 2021-02-15T01:38:56Z

[3.9] bpo-42967: only use '&' as a query string separator (GH-24297)

Backport of fcbe0cb to 3.9

https://bugs.python.org/issue42967

bpo-42967: [security] Address a web cache-poisoning issue reported in urllib.parse.parse_qsl(). urllib.parse will only us "&" as query string separator by default instead of both ";" and "&" as allowed in earlier versions. An optional argument seperator with default value "&" is added to specify the separator. Co-authored-by: Éric Araujo <merwok@netwok.org> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com> Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com> Co-authored-by: Éric Araujo <merwok@netwok.org> (cherry picked from commit fcbe0cb)

bpo-42967: [security] Address a web cache-poisoning issue reported in urllib.parse.parse_qsl(). urllib.parse will only us "&" as query string separator by default instead of both ";" and "&" as allowed in earlier versions. An optional argument seperator with default value "&" is added to specify the separator. Co-authored-by: Éric Araujo <merwok@netwok.org> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com> Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com> Co-authored-by: Éric Araujo <merwok@netwok.org>. (cherry picked from commit fcbe0cb) Co-authored-by: Adam Goldschmidt <adamgold7@gmail.com>

Doc/library/cgi.rst

Doc/library/urllib.parse.rst

orsenthil · 2021-02-15T07:34:23Z

Doc/library/urllib.parse.rst

@@ -235,6 +243,10 @@ or on combining URL components into a URL string.
   .. versionchanged:: 3.8
      Added *max_num_fields* parameter.

+   .. versionchanged:: 3.10


Doc/library/urllib.parse.rst

orsenthil · 2021-02-15T13:21:55Z

@AdamGold / @Fidget-Spinner - I'd like to request your reviews on these backport PRs. This one, #24529, #24531 and #24532 .

Hopefully, I took care of having right version mentioned in each respective branches. Python 3.6.x was a little special because some methods in CGI had different signature, so you could verify if backport was proper.

Fidget-Spinner · 2021-02-15T14:46:21Z

@orsenthil thank you for taking the time to create the manual backports! Looking through this, the code looks fine, though I noticed some errors in the docs that we missed in the original PR and in the backports too :(. I can make a PR to fix the docs on 3.10 branch another time (it's way easier compared to the maintenance branches anyways).

Edit:
Sorry, could you add me as collaborator to your cpython fork please? That way I can just push all the changes to your branches to save your time. Though I don't mind submitting PRs towards your forks too.

Fidget-Spinner

Mostly a bunch of doc fixes, which need to be applied to the other backports and main branch too (I'll handle the last one).

In the meantime, I'll go investigate the 3.6 incompatibilities.

After the doc problems are addressed, LGTM :).

Doc/library/urllib.parse.rst

Doc/whatsnew/3.6.rst

Doc/whatsnew/3.8.rst

Doc/whatsnew/3.9.rst

Lib/urllib/parse.py

AdamGold · 2021-02-15T16:03:13Z

My bad on the docs. Code looks good to me, were there any conflicts?

Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>

orsenthil · 2021-02-15T16:21:41Z

@Fidget-Spinner - Thank you for these changes. BTW, if you like to directly push to 3.8, 3.7, and 3.6 branches to my fork, I invited you as collaborator. That will be easier. (cherry-pick from master will result in manual updates too).

@AdamGold - Not many changes were required. The patches very comprehensive. Since we are making across multiple versions, trying to make sure that version string is accurate when users read the docs.

Fidget-Spinner

LGTM!

Senthil:
I received the invite, thank you!

Adam:
No worries about the docs :), I should've caught them earlier.

AdamGold · 2021-02-15T16:35:21Z

Thanks! Found an issue in #24532, other than that everything looks good.

bedevere-bot · 2021-02-15T18:03:34Z

@orsenthil: Please replace # with GH- in the commit message next time. Thanks!

AdamGold and others added 2 commits February 14, 2021 17:35

orsenthil requested a review from ethanfurman as a code owner February 15, 2021 01:38

the-knights-who-say-ni added the CLA signed label Feb 15, 2021

bedevere-bot mentioned this pull request Feb 15, 2021

bpo-42967: only use '&' as a query string separator #24297

Merged

bedevere-bot added the awaiting core review label Feb 15, 2021

orsenthil commented Feb 15, 2021

View reviewed changes

Doc/library/cgi.rst Outdated Show resolved Hide resolved

orsenthil commented Feb 15, 2021

View reviewed changes

Doc/library/urllib.parse.rst Outdated Show resolved Hide resolved

orsenthil commented Feb 15, 2021

View reviewed changes

Doc/library/urllib.parse.rst Outdated Show resolved Hide resolved

orsenthil commented Feb 15, 2021

View reviewed changes

Doc/library/urllib.parse.rst Outdated Show resolved Hide resolved

Update version information.

daef72b

Fidget-Spinner reviewed Feb 15, 2021

View reviewed changes

Lib/urllib/parse.py Outdated Show resolved Hide resolved

Fidget-Spinner mentioned this pull request Feb 15, 2021

[3.6] bpo-42967: only use '&' as a query string separator (GH-24297) #24532

Merged

orsenthil and others added 8 commits February 15, 2021 08:05

Update Doc/library/urllib.parse.rst

95c9ce7

Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>

Update Doc/library/urllib.parse.rst

81ce22d

Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>

Update Doc/library/urllib.parse.rst

8d08c60

Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>

Update Doc/library/urllib.parse.rst

6b53c44

Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>

Update Doc/whatsnew/3.6.rst

10e4828

Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>

Update Doc/whatsnew/3.8.rst

21a2822

Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>

Update Doc/whatsnew/3.9.rst

23792f6

Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>

Update Lib/urllib/parse.py

eb39e45

Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>

Fidget-Spinner mentioned this pull request Feb 15, 2021

bpo-42967: Fix urllib.parse docs and make logic clearer #24536

Merged

Fidget-Spinner approved these changes Feb 15, 2021

View reviewed changes

orsenthil merged commit c9f0781 into python:3.9 Feb 15, 2021

bedevere-bot removed the awaiting core review label Feb 15, 2021

Uh oh!

[3.9] bpo-42967: only use '&' as a query string separator (GH-24297) #24528

[3.9] bpo-42967: only use '&' as a query string separator (GH-24297) #24528

Uh oh!

Conversation

orsenthil commented Feb 15, 2021 • edited by bedevere-bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

[3.9] bpo-42967: only use '&' as a query string separator (GH-24297)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

orsenthil Feb 15, 2021

Choose a reason for hiding this comment

Uh oh!

Uh oh!

orsenthil commented Feb 15, 2021

Uh oh!

Fidget-Spinner commented Feb 15, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Fidget-Spinner left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

AdamGold commented Feb 15, 2021

Uh oh!

orsenthil commented Feb 15, 2021

Uh oh!

Fidget-Spinner left a comment

Choose a reason for hiding this comment

Uh oh!

AdamGold commented Feb 15, 2021

Uh oh!

bedevere-bot commented Feb 15, 2021

Uh oh!

Uh oh!

orsenthil commented Feb 15, 2021 •

edited by bedevere-bot

Loading

Fidget-Spinner commented Feb 15, 2021 •

edited

Loading