[Python-checkins] [3.6] bpo-43882 - Mention urllib.parse changes in Whats New section for 3.6.14 (GH-26268)
ned-deily
webhook-mailer at python.org
Thu May 20 16:16:20 EDT 2021
https://github.com/python/cpython/commit/6f743e7a4da904f61dfa84cc7d7385e4dcc79ac5
commit: 6f743e7a4da904f61dfa84cc7d7385e4dcc79ac5
branch: 3.6
author: Senthil Kumaran <senthil at python.org>
committer: ned-deily <nad at python.org>
date: 2021-05-20T16:16:15-04:00
summary:
[3.6] bpo-43882 - Mention urllib.parse changes in Whats New section for 3.6.14 (GH-26268)
Co-authored-by: Gregory P. Smith <greg at krypto.org>
files:
M Doc/whatsnew/3.6.rst
diff --git a/Doc/whatsnew/3.6.rst b/Doc/whatsnew/3.6.rst
index 561fb67d6696a6..c14e790935a208 100644
--- a/Doc/whatsnew/3.6.rst
+++ b/Doc/whatsnew/3.6.rst
@@ -2481,3 +2481,10 @@ IPv4 address sent from the remote server when setting up a passive data
channel. We reuse the ftp server IP address instead. For unusual code
requiring the old behavior, set a ``trust_server_pasv_ipv4_address``
attribute on your FTP instance to ``True``. (See :issue:`43285`)
+
+The presence of newline or tab characters in parts of a URL allows for some
+forms of attacks. Following the WHATWG specification that updates RFC 3986,
+ASCII newline ``\n``, ``\r`` and tab ``\t`` characters are stripped from the
+URL by the parser :func:`urllib.parse` preventing such attacks. The removal
+characters are controlled by a new module level variable
+``urllib.parse._UNSAFE_URL_BYTES_TO_REMOVE``. (See :issue:`43882`)
More information about the Python-checkins
mailing list