3 ms·

A funny commit message in the root cause (as stated in the linked post) commit: > Push code review advice from @sigmavirus24

• dfedbeef 1y ago
  I feel this
• sionisrecur 1y ago
  To be fair, the advice from sigmavirus24 was about dealing with decoding the ':' character: https://github.com/psf/requests/pull/2936/files https://github.com/psf/requests/pull/2936/files The code already had `host = ri.netloc.split(':')[0]` before that. The actual root issue is urlparse doesn't split the host, user, pass and port and trying to do it manually is very error prone: urllib.parse.urlparse('http://example.com:@evil.com:8080/') ParseResult(scheme='http', netloc='example.com:@evil.com:8080', path='/', params='', query='', fragment='') Compare this with php: parse_url ('http://example.com:@evil.com:8080/') [ "scheme" => "http", "host" => "evil.com", "port" => 8080, "user" => "example.com", "pass" => "", "path" => "/", ]
  • kidmin 1y ago
    and it is from the beginning: https://github.com/psf/requests/commit/79bb9ee1417afe2231972c1331308500104e5dc7 https://github.com/psf/requests/commit/79bb9ee1417afe2231972...