`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching

Bug report

(Copied from the private security issue)

Bug description:

Summary

urllib.request.HTTPPasswordMgr ignores http:// and https:// when matching
saved passwords. A password saved for an HTTPS URL can be sent over unencrypted HTTP.

Details

HTTPPasswordMgr.reduce_uri(self, uri, default_port=True) in Lib/urllib/request.py drops the scheme, and the password manager calls it with both default_port=True and default_port=False. With default_port=False, https://example.com and http://example.com are reduced to the same name/path, so there's an incorrect match.

This conflicts with RFC 9110 section 11.5, which defines a "protection space" using the origin and the realm. The origin includes the scheme.

RFC 7617 section 2.2 also gives HTTP and HTTPS URLs as examples of different Basic authentication
scopes.

PoC

This script saves a password for an HTTPS URL, then shows that the handler adds it to a matching HTTP request.

from base64 import b64decode
from urllib.request import HTTPBasicAuthHandler, HTTPPasswordMgrWithPriorAuth, Request

passwords = HTTPPasswordMgrWithPriorAuth()
passwords.add_password(
    None, "https://example.com/", "alice", "secret", is_authenticated=True
)
request = Request("http://example.com/")
HTTPBasicAuthHandler(passwords).http_request(request)

header = request.get_header("Authorization")
if header:
    print("Vulnerable:", b64decode(header.split()[1]).decode())
else:
    print("Not vulnerable")

is_authenticated=True makes the handler add the password before contacting a server, so the PoC does not need a running web server.

Current output:

Vulnerable: alice:secret

Needs to be fixed in: main, 3.15, 3.14, 3.13, 3.12, 3.11, and 3.10

CPython versions tested on:

3.10, 3.11, 3.12, 3.13, 3.14, 3.15, CPython main branch

Operating systems tested on:

macOS

Linked PRs

• gh-155696
• gh-155968
• gh-155969
• gh-155970
• gh-155971
• gh-155972
• gh-155973

Bắt đầu trong Lib/urllib/request.py với HTTPPasswordMgr.reduce_uri và luồng đối sánh mật khẩu HTTP. Chạy proof of concept HTTPPasswordMgrWithPriorAuth được cung cấp, sau đó xác minh hành vi trên các phiên bản Python được liệt kê và các bài kiểm thử liên quan. Công việc được xem là hoàn tất khi thông tin xác thực HTTPS không được thêm vào request HTTP phù hợp và hành vi xác thực hiện có được giữ nguyên.