wok-stable annotate python/stuff/CVE-2011-1521.patch @ rev 9612

Forgot patch for python.
author Christopher Rogers <slaxemulator@gmail.com>
date Sun Apr 17 09:38:03 2011 +0000 (2011-04-17)
parents
children
rev   line source
slaxemulator@9612 1 diff -Naur Python-2.7.1.ori/Lib/test/test_urllib2.py Python-2.7.1/Lib/test/test_urllib2.py
slaxemulator@9612 2 --- Python-2.7.1.ori/Lib/test/test_urllib2.py 2010-11-21 21:04:33.000000000 -0800
slaxemulator@9612 3 +++ Python-2.7.1/Lib/test/test_urllib2.py 2011-04-15 05:02:13.278853672 -0700
slaxemulator@9612 4 @@ -969,6 +969,27 @@
slaxemulator@9612 5 self.assertEqual(count,
slaxemulator@9612 6 urllib2.HTTPRedirectHandler.max_redirections)
slaxemulator@9612 7
slaxemulator@9612 8 + def test_invalid_redirect(self):
slaxemulator@9612 9 + from_url = "http://example.com/a.html"
slaxemulator@9612 10 + valid_schemes = ['http', 'https', 'ftp']
slaxemulator@9612 11 + invalid_schemes = ['file', 'imap', 'ldap']
slaxemulator@9612 12 + schemeless_url = "example.com/b.html"
slaxemulator@9612 13 + h = urllib2.HTTPRedirectHandler()
slaxemulator@9612 14 + o = h.parent = MockOpener()
slaxemulator@9612 15 + req = Request(from_url)
slaxemulator@9612 16 +
slaxemulator@9612 17 + for scheme in invalid_schemes:
slaxemulator@9612 18 + invalid_url = scheme + '://' + schemeless_url
slaxemulator@9612 19 + self.assertRaises(urllib2.HTTPError, h.http_error_302,
slaxemulator@9612 20 + req, MockFile(), 302, "Security Loophole",
slaxemulator@9612 21 + MockHeaders({"location": invalid_url}))
slaxemulator@9612 22 +
slaxemulator@9612 23 + for scheme in valid_schemes:
slaxemulator@9612 24 + valid_url = scheme + '://' + schemeless_url
slaxemulator@9612 25 + h.http_error_302(req, MockFile(), 302, "That's fine",
slaxemulator@9612 26 + MockHeaders({"location": valid_url}))
slaxemulator@9612 27 + self.assertEqual(o.req.get_full_url(), valid_url)
slaxemulator@9612 28 +
slaxemulator@9612 29 def test_cookie_redirect(self):
slaxemulator@9612 30 # cookies shouldn't leak into redirected requests
slaxemulator@9612 31 from cookielib import CookieJar
slaxemulator@9612 32 diff -Naur Python-2.7.1.ori/Lib/test/test_urllib.py Python-2.7.1/Lib/test/test_urllib.py
slaxemulator@9612 33 --- Python-2.7.1.ori/Lib/test/test_urllib.py 2010-11-21 05:34:58.000000000 -0800
slaxemulator@9612 34 +++ Python-2.7.1/Lib/test/test_urllib.py 2011-04-15 05:02:13.278853672 -0700
slaxemulator@9612 35 @@ -161,6 +161,20 @@
slaxemulator@9612 36 finally:
slaxemulator@9612 37 self.unfakehttp()
slaxemulator@9612 38
slaxemulator@9612 39 + def test_invalid_redirect(self):
slaxemulator@9612 40 + # urlopen() should raise IOError for many error codes.
slaxemulator@9612 41 + self.fakehttp("""HTTP/1.1 302 Found
slaxemulator@9612 42 +Date: Wed, 02 Jan 2008 03:03:54 GMT
slaxemulator@9612 43 +Server: Apache/1.3.33 (Debian GNU/Linux) mod_ssl/2.8.22 OpenSSL/0.9.7e
slaxemulator@9612 44 +Location: file:README
slaxemulator@9612 45 +Connection: close
slaxemulator@9612 46 +Content-Type: text/html; charset=iso-8859-1
slaxemulator@9612 47 +""")
slaxemulator@9612 48 + try:
slaxemulator@9612 49 + self.assertRaises(IOError, urllib.urlopen, "http://python.org/")
slaxemulator@9612 50 + finally:
slaxemulator@9612 51 + self.unfakehttp()
slaxemulator@9612 52 +
slaxemulator@9612 53 def test_empty_socket(self):
slaxemulator@9612 54 # urlopen() raises IOError if the underlying socket does not send any
slaxemulator@9612 55 # data. (#1680230)
slaxemulator@9612 56 diff -Naur Python-2.7.1.ori/Lib/urllib2.py Python-2.7.1/Lib/urllib2.py
slaxemulator@9612 57 --- Python-2.7.1.ori/Lib/urllib2.py 2010-11-20 03:24:08.000000000 -0800
slaxemulator@9612 58 +++ Python-2.7.1/Lib/urllib2.py 2011-04-15 05:02:13.278853672 -0700
slaxemulator@9612 59 @@ -579,6 +579,17 @@
slaxemulator@9612 60
slaxemulator@9612 61 newurl = urlparse.urljoin(req.get_full_url(), newurl)
slaxemulator@9612 62
slaxemulator@9612 63 + # For security reasons we do not allow redirects to protocols
slaxemulator@9612 64 + # other than HTTP, HTTPS or FTP.
slaxemulator@9612 65 + newurl_lower = newurl.lower()
slaxemulator@9612 66 + if not (newurl_lower.startswith('http://') or
slaxemulator@9612 67 + newurl_lower.startswith('https://') or
slaxemulator@9612 68 + newurl_lower.startswith('ftp://')):
slaxemulator@9612 69 + raise HTTPError(newurl, code,
slaxemulator@9612 70 + msg + " - Redirection to url '%s' is not allowed" %
slaxemulator@9612 71 + newurl,
slaxemulator@9612 72 + headers, fp)
slaxemulator@9612 73 +
slaxemulator@9612 74 # XXX Probably want to forget about the state of the current
slaxemulator@9612 75 # request, although that might interact poorly with other
slaxemulator@9612 76 # handlers that also use handler-specific request attributes
slaxemulator@9612 77 diff -Naur Python-2.7.1.ori/Lib/urllib.py Python-2.7.1/Lib/urllib.py
slaxemulator@9612 78 --- Python-2.7.1.ori/Lib/urllib.py 2010-11-21 21:04:33.000000000 -0800
slaxemulator@9612 79 +++ Python-2.7.1/Lib/urllib.py 2011-04-15 05:02:13.278853672 -0700
slaxemulator@9612 80 @@ -644,6 +644,18 @@
slaxemulator@9612 81 fp.close()
slaxemulator@9612 82 # In case the server sent a relative URL, join with original:
slaxemulator@9612 83 newurl = basejoin(self.type + ":" + url, newurl)
slaxemulator@9612 84 +
slaxemulator@9612 85 + # For security reasons we do not allow redirects to protocols
slaxemulator@9612 86 + # other than HTTP, HTTPS or FTP.
slaxemulator@9612 87 + newurl_lower = newurl.lower()
slaxemulator@9612 88 + if not (newurl_lower.startswith('http://') or
slaxemulator@9612 89 + newurl_lower.startswith('https://') or
slaxemulator@9612 90 + newurl_lower.startswith('ftp://')):
slaxemulator@9612 91 + raise IOError('redirect error', errcode,
slaxemulator@9612 92 + errmsg + " - Redirection to url '%s' is not allowed" %
slaxemulator@9612 93 + newurl,
slaxemulator@9612 94 + headers)
slaxemulator@9612 95 +
slaxemulator@9612 96 return self.open(newurl)
slaxemulator@9612 97
slaxemulator@9612 98 def http_error_301(self, url, fp, errcode, errmsg, headers, data=None):