[issue36216] CVE-2019-9636: urlsplit does not handle NFKC normalization

Change by Larry Hastings : -- nosy: -larry ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.pyth

[issue36216] CVE-2019-9636: urlsplit does not handle NFKC normalization

Kubilay Kocak added the comment: Fix meta (not incl 2.7 which is no longer available to select). -- components: +Unicode -FreeBSD versions: +Python 3.7, Python 3.8 ___ Python tracker

[issue36216] CVE-2019-9636: urlsplit does not handle NFKC normalization

Change by dcockcn : -- components: +FreeBSD -Unicode nosy: +koobs ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscri

[issue36216] CVE-2019-9636: urlsplit does not handle NFKC normalization

Change by dcockcn : -- versions: -Python 2.7, Python 3.4, Python 3.5, Python 3.7, Python 3.8 ___ Python tracker ___ ___ Python-bugs

[issue36216] CVE-2019-9636: urlsplit does not handle NFKC normalization

Change by Ned Deily : -- Removed message: https://bugs.python.org/msg342088 ___ Python tracker ___ ___ Python-bugs-list mailing list

[issue36216] CVE-2019-9636: urlsplit does not handle NFKC normalization

Ned Deily added the comment: New changeset 62d36547f97210a26cc6051da78714fd078e158c by larryhastings (Steve Dower) in branch '3.4': bpo-36216: Add check for characters in netloc that normalize to separators (GH-12201) (#12224) https://github.com/python/cpython/commit/62d36547f97210a26cc6051d

[issue36216] CVE-2019-9636: urlsplit does not handle NFKC normalization

Matej Cepl added the comment: You are right. Thank you. -- ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: h

[issue36216] CVE-2019-9636: urlsplit does not handle NFKC normalization

Steve Dower added the comment: You need a "u" prefix on some of your strings or they're probably being immediately decomposed. The result of urlsplit should be unicode on Python 2 for a Unicode input, and yours are not. -- ___ Python tracker

[issue36216] CVE-2019-9636: urlsplit does not handle NFKC normalization

Matej Cepl added the comment: I am trying to investigate the impact of this bug on Python 2.6 (yes, it is for SLE), and I have hard to replicate the steps in the description even on 2.7: ~$ ipython2 Python 2.7.15 (default, May 21 2018, 17:53:03) [GCC] Type "copyright", "credits" or "license"

[issue36216] CVE-2019-9636: urlsplit does not handle NFKC normalization

Change by STINNER Victor : -- title: urlsplit does not handle NFKC normalization -> CVE-2019-9636: urlsplit does not handle NFKC normalization ___ Python tracker ___ _