aio-libs / aio-libs/yarl

Non-ASCII hostnames are not validated and so allow "@" and other reserved gen-delims characters

未关闭
#955 4 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
bug
主要语言
Python
星标
1.5k
派生
215
平均合并
1 天 2 分钟
30 天内合并 PR
13

描述

### Describe the bug

For #880 we fixed handling of _ASCII_ hostnames, rejecting hostnames that contain characters or sequences that are explicitly excluded (see [RFC3986, section 3.2.2, the `reg-name` grammar rule](https://www.rfc-editor.org/rfc/rfc3986#section-3.2.2).

When implementing the PR for this I had tested `idna.encode(host, uts46=True)` and verified that it correctly rejects hostnames that use ASCII characters outside of the `reg-name` rule, not realising that `_idna_encode()` catches the exception raised for this and then falls back to `host.encode('idna')`, which doesn't reject such hostnames.

The exception handling is there to allow for IDNA 2003 / 2008 compatibility (see #152). I suspect that we need to use `idna.encode(host)` instead of `host.encode('idna')` here to ensure that invalid characters are still rejected.

Because there is no validation it is trivial to create invalid URLs, e.g. by passing in a non-ascii authority value to `host` plus a user or password value.

### To Reproduce

```
>>> import yarl
>>> yarl.URL.build(scheme="http", host="user:pass@историк.рф", user="therealusername")
URL('http://therealusername@xn--user:pass@-rtia0a8c4aor.xn--p1ai')
```

### Expected behavior

The `user:pass@историк.рф` host value contains invalid characters, `:` and `@` and so a `ValueError` should have been raised.

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。