[issue36216] urlsplit does not handle NFKC normalization

Steve Dower added the comment: Hah, I typo'd the commit message and marked it as 3.7 instead of 2.7. Oh well. -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker

[issue36216] urlsplit does not handle NFKC normalization

Steve Dower added the comment: New changeset 507bd8cde60ced74d13a1ffa883bb9b0e73c38be by Steve Dower in branch '2.7': [3.7] bpo-36216: Only print test messages when verbose (GH-12291) https://github.com/python/cpython/commit/507bd8cde60ced74d13a1ffa883bb9b0e73c38be --

[issue36216] urlsplit does not handle NFKC normalization

Steve Dower added the comment: If it's fixed by not printing to the console, then it must be a refleak in print. Or perhaps in the test failure/repeat. That PR is going to be merged as soon as AppVeyor finishes, so nothing to worry about here. --

[issue36216] urlsplit does not handle NFKC normalization

STINNER Victor added the comment: Commit e37ef41289b77e0f0bb9a6aedb0360664c55bdd5 introduced a regression on AMD64 Windows8.1 Refleaks 2.7: test_urlparse leaked [114, 114, 114] references, sum=342 https://buildbot.python.org/all/#/builders/33/builds/532 It is fixed by PR 12291. You can

[issue36216] urlsplit does not handle NFKC normalization

Steve Dower added the comment: Thanks. Just posted a PR that puts the print behind a verbose flag (on Python 3 it uses subtest so that we see which character caused the failure). If that doesn't work for whatever reason, I'll just leave it out and hope that we never have to debug it on

[issue36216] urlsplit does not handle NFKC normalization

Change by Steve Dower : -- pull_requests: +12272 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue36216] urlsplit does not handle NFKC normalization

Karthikeyan Singaravelan added the comment: Sample buildbot log of print statement in testcase causing rerun of test : https://buildbot.python.org/all/#/builders/101/builds/364/steps/4/logs/stdio -- ___ Python tracker

[issue36216] urlsplit does not handle NFKC normalization

Ned Deily added the comment: New changeset 23fc0416454c4ad5b9b23d520fbe6d89be3efc24 by Ned Deily (Steve Dower) in branch '3.6': [3.6] bpo-36216: Add check for characters in netloc that normalize to separators (GH-12201) (GH-12215)

[issue36216] urlsplit does not handle NFKC normalization

Jeremy Kloth added the comment: > > How does that cause tests to fail? Is it going to stderr? Or just causing > an error. > It is causing an "unexpected output error". When the test is re-run at the end, it is run in verbose mode so the extra output is ignored and thus passes at that point.

[issue36216] urlsplit does not handle NFKC normalization

Steve Dower added the comment: > A missed print statement in the 2.7 patch is causing the tests to fail. How does that cause tests to fail? Is it going to stderr? Or just causing an error. -- ___ Python tracker

[issue36216] urlsplit does not handle NFKC normalization

Larry Hastings added the comment: New changeset c0d95113b070799679bcb9dc49d4960d82e8bb08 by larryhastings (Steve Dower) in branch '3.5': bpo-36216: Add check for characters in netloc that normalize to separators (GH-12201) (#12223)

[issue36216] urlsplit does not handle NFKC normalization

Larry Hastings added the comment: New changeset 62d36547f97210a26cc6051da78714fd078e158c by larryhastings (Steve Dower) in branch '3.4': bpo-36216: Add check for characters in netloc that normalize to separators (GH-12201) (#12224)

[issue36216] urlsplit does not handle NFKC normalization

Jeremy Kloth added the comment: A missed print statement in the 2.7 patch is causing the tests to fail. Line 647 of Lib/test/test_urlparse.py -- nosy: +jkloth ___ Python tracker

[issue36216] urlsplit does not handle NFKC normalization

Steve Dower added the comment: This issue is now assigned CVE-2019-9636 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9636 -- ___ Python tracker ___

[issue36216] urlsplit does not handle NFKC normalization

Change by Steve Dower : -- pull_requests: +12214 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue36216] urlsplit does not handle NFKC normalization

Change by Steve Dower : -- pull_requests: +12213 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue36216] urlsplit does not handle NFKC normalization

Steve Dower added the comment: New changeset e37ef41289b77e0f0bb9a6aedb0360664c55bdd5 by Steve Dower in branch '2.7': bpo-36216: Add check for characters in netloc that normalize to separators (GH-12201) https://github.com/python/cpython/commit/e37ef41289b77e0f0bb9a6aedb0360664c55bdd5

[issue36216] urlsplit does not handle NFKC normalization

Steve Dower added the comment: New changeset daad2c482c91de32d8305abbccc76a5de8b3a8be by Steve Dower in branch '3.7': bpo-36216: Add check for characters in netloc that normalize to separators (GH-12201) https://github.com/python/cpython/commit/daad2c482c91de32d8305abbccc76a5de8b3a8be

[issue36216] urlsplit does not handle NFKC normalization

Change by Steve Dower : -- pull_requests: +12207 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue36216] urlsplit does not handle NFKC normalization

Change by Steve Dower : -- pull_requests: +12205 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue36216] urlsplit does not handle NFKC normalization

Change by Steve Dower : -- pull_requests: +12203 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue36216] urlsplit does not handle NFKC normalization

Steve Dower added the comment: New changeset 16e6f7dee7f02bb81aa6b385b982dcdda5b99286 by Steve Dower in branch 'master': bpo-36216: Add check for characters in netloc that normalize to separators (GH-12201) https://github.com/python/cpython/commit/16e6f7dee7f02bb81aa6b385b982dcdda5b99286

[issue36216] urlsplit does not handle NFKC normalization

STINNER Victor added the comment: FYI I added this vulnerability to: https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html -- ___ Python tracker ___

[issue36216] urlsplit does not handle NFKC normalization

Change by Karthikeyan Singaravelan : -- nosy: +martin.panter, xtreak ___ Python tracker ___ ___ Python-bugs-list mailing list

[issue36216] urlsplit does not handle NFKC normalization

Change by Steve Dower : -- keywords: +patch pull_requests: +12196 stage: needs patch -> patch review ___ Python tracker ___ ___

[issue36216] urlsplit does not handle NFKC normalization

New submission from Steve Dower : URLs encoded with Punycode/IDNA use NFKC normalization to decompose characters [1]. This can result in some characters introducing new segments into a URL. For example, \uFF03 is not equal to '#' under direct comparison, but normalizes to '#' which changes