gh-142412: Add warning about urlsplit's netloc parsing and open redirects #144448
Conversation
… redirects Add a warning to the URL parsing security section explaining that urlsplit/urlparse only parse the netloc when preceded by //. This behavior can lead to open redirect vulnerabilities if applications rely solely on checking the netloc to validate redirect URLs. Co-Authored-By: Claude Opus 4.5 <[email protected]>
picnixz
left a comment
picnixz
left a comment
There was a problem hiding this comment.
The placing of this note is incorrect and likely auto-generated. In addition, the warning is useless as we're already in a "beware of [...]" section. I would prefer addressing this after we addressed the fate of urlparse in general (and its placement) as a follow-up of #144148.
So for now, I'm closing it.
| sense? Is that a sensible ``path``? Is there anything strange about that | ||
| ``hostname``? etc. | ||
|
|
||
| .. warning:: |
There was a problem hiding this comment.
It does not make sense to have a warning note here. In addition, its placing interrupts the flow of the current text and is quite off-topic here.
|
A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated. Once you have made the requested changes, please leave a comment on this pull request containing the phrase |
2 participants
Summary
urlsplit/urlparseonly parse thenetlocwhen preceded by/////example.com/pathresult in an emptynetlocand apathof/example.com/pathnetlocto validate redirect URLsTest plan
make checkpassed in Doc/ directory🤖 Generated with Claude Code
netlocnot being suitable for open redirect checking #142412📚 Documentation preview 📚: https://cpython-previews--144448.org.readthedocs.build/