4 ms·

I tried Python requests and Common Lisp drakma, and neither of them can handle "file://" URL schema. Which HTTP client libraries are actually vulnerable to this

by Grue3 10y ago

I tried Python requests and Common Lisp drakma, and neither of them can handle "file://" URL schema. Which HTTP client libraries are actually vulnerable to this?

simscitizen 10y ago
The most popular HTTP library is libcurl, and it supports file URLs by default.
jwilk 10y ago
Python's urllib(2), Perl's LWP
mapleoin 10y ago
urllib/urllib2's urlopen for example. I would assume it would be a bug for the requests library to allow file:///
konceptz 10y ago
Not to nitpick but it's not really a vulnerability. It's including the correct protocols for URIs.