From b21a7da142625e3b47d712cd21cbd440eb48f490 Mon Sep 17 00:00:00 2001 From: Aldo Cortesi Date: Sun, 3 Mar 2013 15:12:58 +1300 Subject: [PATCH] parse_url: Handle invalid IPv6 addresses --- netlib/http.py | 5 ++++- test/test_http.py | 7 +++++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/netlib/http.py b/netlib/http.py index 5628dd4d5..2c9e69cb2 100644 --- a/netlib/http.py +++ b/netlib/http.py @@ -21,7 +21,10 @@ def parse_url(url): host is a valid IDNA-encoded hostname with no null-bytes path is valid ASCII """ - scheme, netloc, path, params, query, fragment = urlparse.urlparse(url) + try: + scheme, netloc, path, params, query, fragment = urlparse.urlparse(url) + except ValueError: + return None if not scheme: return None if ':' in netloc: diff --git a/test/test_http.py b/test/test_http.py index 061aeb22b..f7d861fd8 100644 --- a/test/test_http.py +++ b/test/test_http.py @@ -294,11 +294,14 @@ def test_parse_url(): # Invalid IDNA assert not http.parse_url("http://\xfafoo") + # Invalid PATH assert not http.parse_url("http:/\xc6/localhost:56121") + # Null byte in host assert not http.parse_url("http://foo\0") + # Port out of range assert not http.parse_url("http://foo:999999") - - + # Invalid IPv6 URL - see http://www.ietf.org/rfc/rfc2732.txt + assert not http.parse_url('http://lo[calhost') def test_parse_http_basic_auth(): vals = ("basic", "foo", "bar")