36 lines
1.5 KiB
Diff
36 lines
1.5 KiB
Diff
From 158c67280914613c4280ada8918bb5cbdbff4eca Mon Sep 17 00:00:00 2001
|
|
From: Lumir Balhar <lbalhar@redhat.com>
|
|
Date: Wed, 3 Jun 2026 11:47:42 +0200
|
|
Subject: [PATCH] CVE-2026-44431: Remove sensitive headers in proxy pools too
|
|
|
|
---
|
|
src/urllib3/connectionpool.py | 12 ++++++++++++
|
|
1 file changed, 12 insertions(+)
|
|
|
|
diff --git a/src/urllib3/connectionpool.py b/src/urllib3/connectionpool.py
|
|
index 402bf67..c28a83c 100644
|
|
--- a/src/urllib3/connectionpool.py
|
|
+++ b/src/urllib3/connectionpool.py
|
|
@@ -852,6 +852,18 @@ class HTTPConnectionPool(ConnectionPool, RequestMethods):
|
|
body = None
|
|
headers = HTTPHeaderDict(headers)._prepare_for_method_change()
|
|
|
|
+ # Strip headers marked as unsafe to forward to the redirected location.
|
|
+ # Check remove_headers_on_redirect to avoid a potential network call within
|
|
+ # self.is_same_host() which may use socket.gethostbyname() in the future.
|
|
+ if retries.remove_headers_on_redirect and not self.is_same_host(
|
|
+ redirect_location
|
|
+ ):
|
|
+ if not isinstance(headers, HTTPHeaderDict):
|
|
+ headers = HTTPHeaderDict(headers or {})
|
|
+ for header in list(six.iterkeys(headers)):
|
|
+ if header.lower() in retries.remove_headers_on_redirect:
|
|
+ headers.pop(header, None)
|
|
+
|
|
try:
|
|
retries = retries.increment(method, url, response=response, _pool=self)
|
|
except MaxRetryError:
|
|
--
|
|
2.54.0
|
|
|