[New-bugs-announce] [issue36338] urlparse of urllib returns wrong hostname

[Xianbo Wang]

New submission from Xianbo Wang <sanebow at gmail.com>:

The urlparse function in Python urllib returns the wrong hostname when parsing URL crafted by the malicious user. This may be caused by incorrect handling of IPv6 addresses. The bug could lead to open redirect in web applications which rely on urlparse to extract and validate the domain of redirection URL.

The test case is as follows:

>>> from urllib.parse import urlparse
>>> urlparse(urlparse('http://benign.com\[attacker.com]').hostname
>>> 'attacker.com'

The correct behavior should be raising an invalid URL exception.

----------
components: Library (Lib)
messages: 338171
nosy: Xianbo Wang
priority: normal
severity: normal
status: open
title: urlparse of urllib returns wrong hostname
type: security
versions: Python 3.7

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue36338>
_______________________________________