`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching

Bug report

(Copied from the private security issue)

Bug description:

Summary

urllib.request.HTTPPasswordMgr ignores http:// and https:// when matching
saved passwords. A password saved for an HTTPS URL can be sent over unencrypted HTTP.

Details

HTTPPasswordMgr.reduce_uri(self, uri, default_port=True) in Lib/urllib/request.py drops the scheme, and the password manager calls it with both default_port=True and default_port=False. With default_port=False, https://example.com and http://example.com are reduced to the same name/path, so there's an incorrect match.

This conflicts with RFC 9110 section 11.5, which defines a "protection space" using the origin and the realm. The origin includes the scheme.

RFC 7617 section 2.2 also gives HTTP and HTTPS URLs as examples of different Basic authentication
scopes.

PoC

This script saves a password for an HTTPS URL, then shows that the handler adds it to a matching HTTP request.

from base64 import b64decode
from urllib.request import HTTPBasicAuthHandler, HTTPPasswordMgrWithPriorAuth, Request

passwords = HTTPPasswordMgrWithPriorAuth()
passwords.add_password(
    None, "https://example.com/", "alice", "secret", is_authenticated=True
)
request = Request("http://example.com/")
HTTPBasicAuthHandler(passwords).http_request(request)

header = request.get_header("Authorization")
if header:
    print("Vulnerable:", b64decode(header.split()[1]).decode())
else:
    print("Not vulnerable")

is_authenticated=True makes the handler add the password before contacting a server, so the PoC does not need a running web server.

Current output:

Vulnerable: alice:secret

Needs to be fixed in: main, 3.15, 3.14, 3.13, 3.12, 3.11, and 3.10

CPython versions tested on:

3.10, 3.11, 3.12, 3.13, 3.14, 3.15, CPython main branch

Operating systems tested on:

macOS

Linked PRs

• gh-155696
• gh-155968
• gh-155969
• gh-155970
• gh-155971
• gh-155972
• gh-155973

Commencez dans Lib/urllib/request.py avec HTTPPasswordMgr.reduce_uri et le flux de correspondance des mots de passe HTTP. Exécutez la preuve de concept HTTPPasswordMgrWithPriorAuth fournie, puis vérifiez le comportement avec les versions de Python indiquées et les tests pertinents. Le travail est considéré comme terminé lorsque les identifiants HTTPS ne sont pas ajoutés à la requête HTTP correspondante et que le comportement d’authentification existant est préservé.