From c664b4415baf1b237a8d74f5e880179e69ee764c Mon Sep 17 00:00:00 2001 From: Nate Prewitt Date: Wed, 25 Sep 2024 08:03:20 -0700 Subject: [PATCH] Only use hostname to do netrc lookup instead of netloc CVE: CVE-2024-47081 Upstream-Status: Backport [https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef] Signed-off-by: Jiaying Song --- requests/utils.py | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/requests/utils.py b/requests/utils.py index 153776c7..eae72959 100644 --- a/requests/utils.py +++ b/requests/utils.py @@ -208,13 +208,7 @@ def get_netrc_auth(url, raise_errors=False): return ri = urlparse(url) - - # Strip port numbers from netloc. This weird `if...encode`` dance is - # used for Python 3.2, which doesn't support unicode literals. - splitstr = b':' - if isinstance(url, str): - splitstr = splitstr.decode('ascii') - host = ri.netloc.split(splitstr)[0] + host = ri.hostname try: _netrc = netrc(netrc_path).authenticators(host) -- 2.34.1