python / python/cpython

urlparse library detecting wrong hostname leads to open redirect vulnerability

未关闭
#79,929 10 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

3.7 (EOL) 3.8 (EOL) stdlib type-security
主要语言
Python
星标
77.2k
派生
36k
平均合并
1 天 9 小时
30 天内合并 PR
558

描述

BPO 35748
Nosy @orsenthil, @tiran, @stevendaprano, @vadmium, @tirkarthi, @nsonaniya2010
Files
  • Screenshot from 2019-01-16 12-47-22.png
  • Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
    closed_at = None
    created_at = <Date 2019-01-16.07:45:25.247>
    labels = ['type-security', '3.8', '3.7', 'library']
    title = 'urlparse library detecting wrong hostname leads to open redirect vulnerability'
    updated_at = <Date 2019-08-18.06:57:48.636>
    user = 'https://github.com/nsonaniya2010'
    

    bugs.python.org fields:

    activity = <Date 2019-08-18.06:57:48.636>
    actor = 'Ilya Konstantinov'
    assignee = 'none'
    closed = False
    closed_date = None
    closer = None
    components = ['Library (Lib)']
    creation = <Date 2019-01-16.07:45:25.247>
    creator = 'nsonaniya2010'
    dependencies = []
    files = ['48058']
    hgrepos = []
    issue_num = 35748
    keywords = []
    message_count = 10.0
    messages = ['333750', '333755', '333756', '333757', '333758', '333766', '334032', '334043', '334049', '349917']
    nosy_count = 7.0
    nosy_names = ['orsenthil', 'christian.heimes', 'steven.daprano', 'martin.panter', 'xtreak', 'nsonaniya2010', 'Ilya Konstantinov']
    pr_nums = []
    priority = 'normal'
    resolution = None
    stage = None
    status = 'open'
    superseder = None
    type = 'security'
    url = 'https://bugs.python.org/issue35748'
    versions = ['Python 3.6', 'Python 3.7', 'Python 3.8']
    

    贡献指南

    打开贡献指南

    从这里开始

    1. 先读完整个 Issue,再读项目的贡献指南。
    2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
    3. Fork 仓库,在一个分支上完成修改。
    4. 提交 Pull Request,并在描述里引用这个 Issue 编号。

    调研方向

    从 Lib 下的 Python 标准库 URL 解析代码开始,查看关联的 BPO issue 35748 及其屏幕截图。复现 issue 中描述的主机名检测案例,然后验证当前行为不再允许所报告的 open redirect 漏洞。

    由索引模型根据 Issue 内容生成。

    评估

    技术栈
    python
    领域
    security
    Issue 类型
    缺陷
    难度
    4/5
    预计耗时
    3-5 天
    活跃度
    停滞
    描述清晰度
    需要澄清
    新手友好度
    25/100

    把新 issue 发到你的邮箱

    精选适合新手参与的 GitHub issue 摘要。