blob: 1d465cc59417dfc82b347266a8a980d4dd09bf17 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
|
From c664b4415baf1b237a8d74f5e880179e69ee764c Mon Sep 17 00:00:00 2001
From: Nate Prewitt <nate.prewitt@gmail.com>
Date: Wed, 25 Sep 2024 08:03:20 -0700
Subject: [PATCH] Only use hostname to do netrc lookup instead of netloc
CVE: CVE-2024-47081
Upstream-Status: Backport
[https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef]
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
---
requests/utils.py | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/requests/utils.py b/requests/utils.py
index 153776c7..eae72959 100644
--- a/requests/utils.py
+++ b/requests/utils.py
@@ -208,13 +208,7 @@ def get_netrc_auth(url, raise_errors=False):
return
ri = urlparse(url)
-
- # Strip port numbers from netloc. This weird `if...encode`` dance is
- # used for Python 3.2, which doesn't support unicode literals.
- splitstr = b':'
- if isinstance(url, str):
- splitstr = splitstr.decode('ascii')
- host = ri.netloc.split(splitstr)[0]
+ host = ri.hostname
try:
_netrc = netrc(netrc_path).authenticators(host)
--
2.34.1
|
