Skip to content

[3.8] bpo-46756: Fix authorization check in urllib.request (GH-31353) #31572

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Mar 2, 2022

Conversation

miss-islington
Copy link
Contributor

@miss-islington miss-islington commented Feb 25, 2022

Fix a bug in urllib.request.HTTPPasswordMgr.find_user_password() and
urllib.request.HTTPPasswordMgrWithPriorAuth.is_authenticated() which
allowed to bypass authorization. For example, access to URI "example.org/foobar"
was allowed if the user was authorized for URI "example.org/foo".
(cherry picked from commit e2e7256)

Co-authored-by: Serhiy Storchaka [email protected]

https://bugs.python.org/issue46756

Fix a bug in urllib.request.HTTPPasswordMgr.find_user_password() and
urllib.request.HTTPPasswordMgrWithPriorAuth.is_authenticated() which
allowed to bypass authorization. For example, access to URI "example.org/foobar"
was allowed if the user was authorized for URI "example.org/foo".
(cherry picked from commit e2e7256)

Co-authored-by: Serhiy Storchaka <[email protected]>
@miss-islington
Copy link
Contributor Author

@serhiy-storchaka: Status check is done, and it's a success ✅ .

@bedevere-bot bedevere-bot added type-bug An unexpected behavior, bug, or error type-security A security issue labels Feb 25, 2022
@miss-islington
Copy link
Contributor Author

@serhiy-storchaka: Status check is done, and it's a success ✅ .

@miss-islington
Copy link
Contributor Author

Sorry, I can't merge this PR. Reason: You're not authorized to push to this branch. Visit https://docs.github.com/articles/about-protected-branches/ for more information..

@pablogsal pablogsal merged commit 1c9701a into python:3.8 Mar 2, 2022
@miss-islington miss-islington deleted the backport-e2e7256-3.8 branch March 2, 2022 13:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type-bug An unexpected behavior, bug, or error type-security A security issue
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants