50 lines
2.0 KiB
Diff
50 lines
2.0 KiB
Diff
|
diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py
|
||
|
|
index 649a5b8..0061a52 100644
|
||
|
|
--- a/Lib/test/test_urllib.py
|
||
|
|
+++ b/Lib/test/test_urllib.py
|
||
|
|
@@ -16,6 +16,7 @@ except ImportError:
|
||
|
|
ssl = None
|
||
|
|
import sys
|
||
|
|
import tempfile
|
||
|
|
+import warnings
|
||
|
|
from nturl2path import url2pathname, pathname2url
|
||
|
|
|
||
|
|
from base64 import b64encode
|
||
|
|
@@ -1463,6 +1464,23 @@ class URLopener_Tests(unittest.TestCase):
|
||
|
|
"spam://c:|windows%/:=&?~#+!$,;'@()*[]|/path/"),
|
||
|
|
"//c:|windows%/:=&?~#+!$,;'@()*[]|/path/")
|
||
|
|
|
||
|
|
+ def test_local_file_open(self):
|
||
|
|
+ # bpo-35907, CVE-2019-9948: urllib must reject local_file:// scheme
|
||
|
|
+ class DummyURLopener(urllib.request.URLopener):
|
||
|
|
+ def open_local_file(self, url):
|
||
|
|
+ return url
|
||
|
|
+
|
||
|
|
+ with warnings.catch_warnings(record=True):
|
||
|
|
+ warnings.simplefilter("ignore", DeprecationWarning)
|
||
|
|
+
|
||
|
|
+ for url in ('local_file://example', 'local-file://example'):
|
||
|
|
+ self.assertRaises(OSError, urllib.request.urlopen, url)
|
||
|
|
+ self.assertRaises(OSError, urllib.request.URLopener().open, url)
|
||
|
|
+ self.assertRaises(OSError, urllib.request.URLopener().retrieve, url)
|
||
|
|
+ self.assertRaises(OSError, DummyURLopener().open, url)
|
||
|
|
+ self.assertRaises(OSError, DummyURLopener().retrieve, url)
|
||
|
|
+
|
||
|
|
+
|
||
|
|
# Just commented them out.
|
||
|
|
# Can't really tell why keep failing in windows and sparc.
|
||
|
|
# Everywhere else they work ok, but on those machines, sometimes
|
||
|
|
diff --git a/Lib/urllib/request.py b/Lib/urllib/request.py
|
||
|
|
index d28f2f8..c9945d9 100644
|
||
|
|
--- a/Lib/urllib/request.py
|
||
|
|
+++ b/Lib/urllib/request.py
|
||
|
|
@@ -1747,7 +1747,7 @@ class URLopener:
|
||
|
|
name = 'open_' + urltype
|
||
|
|
self.type = urltype
|
||
|
|
name = name.replace('-', '_')
|
||
|
|
- if not hasattr(self, name):
|
||
|
|
+ if not hasattr(self, name) or name == 'open_local_file':
|
||
|
|
if proxy:
|
||
|
|
return self.open_unknown_proxy(proxy, fullurl, data)
|
||
|
|
else:
|