[3.5] bpo-35907, CVE-2019-9948: urllib rejects local_file:// scheme (GH-13474) (GH-13505) by vstinner · Pull Request #13510

…) (GH-13505)

CVE-2019-9948: Avoid file reading by disallowing local-file:// and
local_file:// URL schemes in URLopener().open() and
URLopener().retrieve() of urllib.request.

Co-Authored-By: SH <push0ebp@gmail.com>
(cherry picked from commit 0c2b6a3)
(cherry picked from commit 34bab21)

larryhastings merged commit 4fe82a8 into python:3.5

Jul 14, 2019

5 checks passed

bedevere/issue-number Issue number 35907 found

Details

bedevere/maintenance-branch-pr Valid maintenance branch PR title.

bedevere/news News entry found in Misc/NEWS.d

continuous-integration/appveyor/pr AppVeyor build succeeded

Details

continuous-integration/travis-ci/pr The Travis CI build passed

Details

vstinner deleted the vstinner:local_file35 branch

Jul 14, 2019

[3.5] bpo-35907, CVE-2019-9948: urllib rejects local_file:// scheme (GH-13474) (GH-13505) by vstinner · Pull Request #13510 · python/cpython