summaryrefslogtreecommitdiffstats
path: root/recipes-devtools/python/python3-botocore/0001-Fix-rejecting-URLs-with-unsafe-characters-in-is_vali.patch
diff options
context:
space:
mode:
Diffstat (limited to 'recipes-devtools/python/python3-botocore/0001-Fix-rejecting-URLs-with-unsafe-characters-in-is_vali.patch')
-rw-r--r--recipes-devtools/python/python3-botocore/0001-Fix-rejecting-URLs-with-unsafe-characters-in-is_vali.patch61
1 files changed, 0 insertions, 61 deletions
diff --git a/recipes-devtools/python/python3-botocore/0001-Fix-rejecting-URLs-with-unsafe-characters-in-is_vali.patch b/recipes-devtools/python/python3-botocore/0001-Fix-rejecting-URLs-with-unsafe-characters-in-is_vali.patch
deleted file mode 100644
index 95b30a08..00000000
--- a/recipes-devtools/python/python3-botocore/0001-Fix-rejecting-URLs-with-unsafe-characters-in-is_vali.patch
+++ /dev/null
@@ -1,61 +0,0 @@
1From 370cdf7d708c92bf21a42f15392f7be330cf8f80 Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?Micha=C5=82=20G=C3=B3rny?= <mgorny@gentoo.org>
3Date: Fri, 7 May 2021 19:54:16 +0200
4Subject: [PATCH] Fix rejecting URLs with unsafe characters in
5 is_valid_endpoint_url() (#2381)
6
7Detect unsafe characters in is_valid_endpoint_url()
8and is_valid_ipv6_endpoint_url() early, in order to fix rejecting
9invalid URLs with Python 3.9.5+ and other versions carrying bpo-43882
10fix. In these versions, urlsplit() silently strips LF, CR and HT
11characters while splitting the URL, effectively disarming the validator
12in botocore.
13
14The solution is based on a similar fix in Django.
15
16Fixes #2377
17
18Upstream-Status: Backport
19
20---
21 botocore/utils.py | 10 ++++++++++
22 1 file changed, 10 insertions(+)
23
24diff --git a/botocore/utils.py b/botocore/utils.py
25index 378972248..d35dd64bb 100644
26--- a/botocore/utils.py
27+++ b/botocore/utils.py
28@@ -173,6 +173,10 @@ ZONE_ID_PAT = "(?:%25|%)(?:[" + UNRESERVED_PAT + "]|%[a-fA-F0-9]{2})+"
29 IPV6_ADDRZ_PAT = r"\[" + IPV6_PAT + r"(?:" + ZONE_ID_PAT + r")?\]"
30 IPV6_ADDRZ_RE = re.compile("^" + IPV6_ADDRZ_PAT + "$")
31
32+# These are the characters that are stripped by post-bpo-43882 urlparse().
33+UNSAFE_URL_CHARS = frozenset('\t\r\n')
34+
35+
36 def ensure_boolean(val):
37 """Ensures a boolean value if a string or boolean is provided
38
39@@ -977,6 +981,8 @@ class ArgumentGenerator(object):
40
41
42 def is_valid_ipv6_endpoint_url(endpoint_url):
43+ if UNSAFE_URL_CHARS.intersection(endpoint_url):
44+ return False
45 netloc = urlparse(endpoint_url).netloc
46 return IPV6_ADDRZ_RE.match(netloc) is not None
47
48@@ -990,6 +996,10 @@ def is_valid_endpoint_url(endpoint_url):
49 :return: True if the endpoint url is valid. False otherwise.
50
51 """
52+ # post-bpo-43882 urlsplit() strips unsafe characters from URL, causing
53+ # it to pass hostname validation below. Detect them early to fix that.
54+ if UNSAFE_URL_CHARS.intersection(endpoint_url):
55+ return False
56 parts = urlsplit(endpoint_url)
57 hostname = parts.hostname
58 if hostname is None:
59--
602.25.1
61