`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching

Bug report

(Copied from the private security issue)

Bug description:

Summary

urllib.request.HTTPPasswordMgr ignores http:// and https:// when matching
saved passwords. A password saved for an HTTPS URL can be sent over unencrypted HTTP.

Details

HTTPPasswordMgr.reduce_uri(self, uri, default_port=True) in Lib/urllib/request.py drops the scheme, and the password manager calls it with both default_port=True and default_port=False. With default_port=False, https://example.com and http://example.com are reduced to the same name/path, so there's an incorrect match.

This conflicts with RFC 9110 section 11.5, which defines a "protection space" using the origin and the realm. The origin includes the scheme.

RFC 7617 section 2.2 also gives HTTP and HTTPS URLs as examples of different Basic authentication
scopes.

PoC

This script saves a password for an HTTPS URL, then shows that the handler adds it to a matching HTTP request.

from base64 import b64decode
from urllib.request import HTTPBasicAuthHandler, HTTPPasswordMgrWithPriorAuth, Request

passwords = HTTPPasswordMgrWithPriorAuth()
passwords.add_password(
    None, "https://example.com/", "alice", "secret", is_authenticated=True
)
request = Request("http://example.com/")
HTTPBasicAuthHandler(passwords).http_request(request)

header = request.get_header("Authorization")
if header:
    print("Vulnerable:", b64decode(header.split()[1]).decode())
else:
    print("Not vulnerable")

is_authenticated=True makes the handler add the password before contacting a server, so the PoC does not need a running web server.

Current output:

Vulnerable: alice:secret

Needs to be fixed in: main, 3.15, 3.14, 3.13, 3.12, 3.11, and 3.10

CPython versions tested on:

3.10, 3.11, 3.12, 3.13, 3.14, 3.15, CPython main branch

Operating systems tested on:

macOS

Linked PRs

• gh-155696
• gh-155968
• gh-155969
• gh-155970
• gh-155971
• gh-155972
• gh-155973

Beginne in Lib/urllib/request.py mit HTTPPasswordMgr.reduce_uri und dem Ablauf für den Abgleich von HTTP-Passwörtern. Führe den bereitgestellten HTTPPasswordMgrWithPriorAuth-Proof-of-Concept aus und überprüfe anschließend das Verhalten über die aufgeführten Python-Versionen und relevanten Tests hinweg. Als erledigt gilt die Aufgabe, wenn HTTPS-Anmeldedaten nicht zur passenden HTTP-Anfrage hinzugefügt werden und das bestehende Authentifizierungsverhalten erhalten bleibt.