Skip to content

Commit 0593ae8

Browse files
authored
[3.9] bpo-43882 - Mention urllib.parse changes in Whats new section. (GH-26276)
* [3.9] bpo-43882 - Mention urllib.parse changes in Whats new section. * Add the missing section.
1 parent b9258b0 commit 0593ae8

File tree

1 file changed

+14
-0
lines changed

1 file changed

+14
-0
lines changed

Doc/whatsnew/3.9.rst

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1560,3 +1560,17 @@ IPv4 address sent from the remote server when setting up a passive data
15601560
channel. We reuse the ftp server IP address instead. For unusual code
15611561
requiring the old behavior, set a ``trust_server_pasv_ipv4_address``
15621562
attribute on your FTP instance to ``True``. (See :issue:`43285`)
1563+
1564+
Notable changes in Python 3.9.5
1565+
===============================
1566+
1567+
urllib.parse
1568+
------------
1569+
1570+
The presence of newline or tab characters in parts of a URL allows for some
1571+
forms of attacks. Following the WHATWG specification that updates :rfc:`3986`,
1572+
ASCII newline ``\n``, ``\r`` and tab ``\t`` characters are stripped from the
1573+
URL by the parser in :mod:`urllib.parse` preventing such attacks. The removal
1574+
characters are controlled by a new module level variable
1575+
``urllib.parse._UNSAFE_URL_BYTES_TO_REMOVE``. (See :issue:`43882`)
1576+

0 commit comments

Comments
 (0)