[3.6] bpo-43075: Fix ReDoS in urllib AbstractBasicAuthHandler (GH-24391)

[miss-islington]

Fix Regular Expression Denial of Service (ReDoS) vulnerability in
urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable regex
has quadratic worst-case complexity and it allows cause a denial of
service when identifying crafted invalid RFCs. This ReDoS issue is on
the client side and needs remote attackers to control the HTTP server.
(cherry picked from commit 7215d1a)

Co-authored-by: Yeting Li [email protected]

https://bugs.python.org/issue43075

[vstinner]

LGTM, good bot.

[miss-islington]

@yetingli and @vstinner: Status check is done, and it's a failure ❌ .

[vstinner]

The Ubuntu job of Azure Pipelines PR failed:

FAIL: test_fontlist_key (idlelib.idle_test.test_configdialog.FontPageTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/vsts/work/1/s/Lib/idlelib/idle_test/test_configdialog.py", line 104, in test_fontlist_key
    self.assertNotEqual(down_font, font)
AssertionError: 'DejaVu Sans' == 'DejaVu Sans'

This issue was fixed in Python 3.7-3.10 by https://bugs.python.org/issue39600 but Python 3.6 didn't get the fix.

@ned-deily: Do you want me to backport the IDLE test fix to 3.6 https://bugs.python.org/issue39600, or can you merge this security fix without fixing the IDLE test?

[ned-deily]

@vstinner Thanks. I'll take care of it.