File tree Expand file tree Collapse file tree 1 file changed +14
-0
lines changed Expand file tree Collapse file tree 1 file changed +14
-0
lines changed Original file line number Diff line number Diff line change @@ -1560,3 +1560,17 @@ IPv4 address sent from the remote server when setting up a passive data
1560
1560
channel. We reuse the ftp server IP address instead. For unusual code
1561
1561
requiring the old behavior, set a ``trust_server_pasv_ipv4_address ``
1562
1562
attribute on your FTP instance to ``True ``. (See :issue: `43285 `)
1563
+
1564
+ Notable changes in Python 3.9.5
1565
+ ===============================
1566
+
1567
+ urllib.parse
1568
+ ------------
1569
+
1570
+ The presence of newline or tab characters in parts of a URL allows for some
1571
+ forms of attacks. Following the WHATWG specification that updates :rfc: `3986 `,
1572
+ ASCII newline ``\n ``, ``\r `` and tab ``\t `` characters are stripped from the
1573
+ URL by the parser in :mod: `urllib.parse ` preventing such attacks. The removal
1574
+ characters are controlled by a new module level variable
1575
+ ``urllib.parse._UNSAFE_URL_BYTES_TO_REMOVE ``. (See :issue: `43882 `)
1576
+
You can’t perform that action at this time.
0 commit comments