python / python/cpython

urlparse library detecting wrong hostname leads to open redirect vulnerability

Open
#79,929 10 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

3.7 (EOL) 3.8 (EOL) stdlib type-security
Dominant language
Python
Stars
77.2k
Forks
36k
Avg merge
1d 9h
Merged PRs (30d)
558

Description

BPO 35748
Nosy @orsenthil, @tiran, @stevendaprano, @vadmium, @tirkarthi, @nsonaniya2010
Files
  • Screenshot from 2019-01-16 12-47-22.png
  • Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
    closed_at = None
    created_at = <Date 2019-01-16.07:45:25.247>
    labels = ['type-security', '3.8', '3.7', 'library']
    title = 'urlparse library detecting wrong hostname leads to open redirect vulnerability'
    updated_at = <Date 2019-08-18.06:57:48.636>
    user = 'https://github.com/nsonaniya2010'
    

    bugs.python.org fields:

    activity = <Date 2019-08-18.06:57:48.636>
    actor = 'Ilya Konstantinov'
    assignee = 'none'
    closed = False
    closed_date = None
    closer = None
    components = ['Library (Lib)']
    creation = <Date 2019-01-16.07:45:25.247>
    creator = 'nsonaniya2010'
    dependencies = []
    files = ['48058']
    hgrepos = []
    issue_num = 35748
    keywords = []
    message_count = 10.0
    messages = ['333750', '333755', '333756', '333757', '333758', '333766', '334032', '334043', '334049', '349917']
    nosy_count = 7.0
    nosy_names = ['orsenthil', 'christian.heimes', 'steven.daprano', 'martin.panter', 'xtreak', 'nsonaniya2010', 'Ilya Konstantinov']
    pr_nums = []
    priority = 'normal'
    resolution = None
    stage = None
    status = 'open'
    superseder = None
    type = 'security'
    url = 'https://bugs.python.org/issue35748'
    versions = ['Python 3.6', 'Python 3.7', 'Python 3.8']
    

    Contributor guide

    Open the contributing guide

    First steps

    1. Read the whole issue, then the project's contributing guide.
    2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
    3. Fork the repository and make your change on a branch.
    4. Open a pull request that references the issue number.

    Research direction

    Start with the Python standard-library URL parsing code under Lib and review the linked BPO issue 35748 and its screenshot. Reproduce the hostname-detection case described in the issue, then verify the behavior no longer permits the reported open redirect vulnerability.

    Written by the indexing model from the issue text.

    Assessment

    Tech stack
    python
    Domain
    security
    Issue type
    Bug
    Difficulty
    4/5
    Estimated time
    3-5 days
    Activity status
    Stale
    Clarity
    Needs clarification
    Newbie friendliness
    25/100

    Get new issues in your inbox

    A short digest of beginner-friendly GitHub issues.