Comments (2)
gruns
commented on August 30, 2024
Awesome find.
Fixed in furl v0.4.95, where a ValueError is raised if the host is egregiously
invalid.
>>> import furl
>>> furl.__version__
'0.4.95'
>>> from furl import furl
>>> f = furl('https://user:[email protected]/path/goes/here')
>>> f.host = 'evil:[email protected]'
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/usr/local/lib/python2.7/dist-packages/furl/furl.py", line 1291, in __setattr__
object.__setattr__(self, attr, value)
File "/usr/local/lib/python2.7/dist-packages/furl/furl.py", line 930, in host
raise ValueError(errmsg % host)
ValueError: Invalid host 'evil:[email protected]'. Host strings must only contain [\.\-a-zA-Z0-9] and can't have adjacent periods.Upgrade with pip install furl -U.
Thank you for the thorough, detailed Issue and bringing this bug to my
attention, Vincent. Don't hesitate to let me know if there's anything else I can
do for you.
from furl.
nvie
commented on August 30, 2024
Thanks for the fix!
from furl.
Related Issues (20)
- furl doesn't type-hint itself as Text HOT 3
- url parsing still accepts semicolon as separator HOT 5
- Add typing support HOT 6
- Hi, if the URL is like '127.0.0.1:8080/a/b', the result is '8080/a/b', which seems incorrect HOT 2
- How handle javascript:void(0) HOT 2
- Feature: Addition of `is_domain` flag
- Maximum recursion depth exceeded error for url with large list HOT 3
- Adding README to PyPi HOT 2
- '127.0.0.1:8329' parsed wrong in Python 3.9+ HOT 3
- Add SECURITY.md HOT 3
- Feature request: Convert to unescaped string HOT 2
- .join() and .path.normalize() incorrectly interpret base paths ending /. or /..
- furl.path object is NOT of type: pathlib.Path HOT 1
- Feature requests: get url relative to another url
- Setting multiple query params for the same key and resultant url format
- Seems to be a bug when paring multiple '@'s ?
- Use the `ipaddress` module to detect valid IPV6 HOT 1
- a method to set an individual query parameter without removing the rest or keeping the original value
- Removes "git@" from git remote URL HOT 1
- URL fragment percent-encoding
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from furl.