You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
90 lines
3.8 KiB
90 lines
3.8 KiB
From 82224a0b35a9b381708cd6dee990aa9c4b4db7cd Mon Sep 17 00:00:00 2001 |
|
From: Lumir Balhar <lbalhar@redhat.com> |
|
Date: Thu, 16 Jan 2020 10:08:55 +0100 |
|
Subject: [PATCH] Fix for CVE-2018-18074 |
|
|
|
This patch contains the fix for CVE-2018-18074 and |
|
a subsequent regression fix combined in one. |
|
--- |
|
sessions.py | 36 +++++++++++++++++++++++++++++------- |
|
utils.py | 1 + |
|
2 files changed, 30 insertions(+), 7 deletions(-) |
|
|
|
diff --git a/sessions.py b/sessions.py |
|
index bcbcc88..c65c908 100644 |
|
--- a/sessions.py |
|
+++ b/sessions.py |
|
@@ -17,7 +17,7 @@ from .cookies import ( |
|
cookiejar_from_dict, extract_cookies_to_jar, RequestsCookieJar, merge_cookies) |
|
from .models import Request, PreparedRequest, DEFAULT_REDIRECT_LIMIT |
|
from .hooks import default_hooks, dispatch_hook |
|
-from .utils import to_key_val_list, default_headers, to_native_string |
|
+from .utils import to_key_val_list, default_headers, to_native_string, DEFAULT_PORTS |
|
from .exceptions import ( |
|
TooManyRedirects, InvalidSchema, ChunkedEncodingError, ContentDecodingError) |
|
from .packages.urllib3._collections import RecentlyUsedContainer |
|
@@ -85,6 +85,32 @@ def merge_hooks(request_hooks, session_hooks, dict_class=OrderedDict): |
|
|
|
|
|
class SessionRedirectMixin(object): |
|
+ |
|
+ def should_strip_auth(self, old_url, new_url): |
|
+ """Decide whether Authorization header should be removed when redirecting""" |
|
+ old_parsed = urlparse(old_url) |
|
+ new_parsed = urlparse(new_url) |
|
+ if old_parsed.hostname != new_parsed.hostname: |
|
+ return True |
|
+ # Special case: allow http -> https redirect when using the standard |
|
+ # ports. This isn't specified by RFC 7235, but is kept to avoid |
|
+ # breaking backwards compatibility with older versions of requests |
|
+ # that allowed any redirects on the same host. |
|
+ if (old_parsed.scheme == 'http' and old_parsed.port in (80, None) |
|
+ and new_parsed.scheme == 'https' and new_parsed.port in (443, None)): |
|
+ return False |
|
+ |
|
+ # Handle default port usage corresponding to scheme. |
|
+ changed_port = old_parsed.port != new_parsed.port |
|
+ changed_scheme = old_parsed.scheme != new_parsed.scheme |
|
+ default_port = (DEFAULT_PORTS.get(old_parsed.scheme, None), None) |
|
+ if (not changed_scheme and old_parsed.port in default_port |
|
+ and new_parsed.port in default_port): |
|
+ return False |
|
+ |
|
+ # Standard case: root URI must match |
|
+ return changed_port or changed_scheme |
|
+ |
|
def resolve_redirects(self, resp, req, stream=False, timeout=None, |
|
verify=True, cert=None, proxies=None, **adapter_kwargs): |
|
"""Receives a Response. Returns a generator of Responses.""" |
|
@@ -190,14 +216,10 @@ class SessionRedirectMixin(object): |
|
headers = prepared_request.headers |
|
url = prepared_request.url |
|
|
|
- if 'Authorization' in headers: |
|
+ if 'Authorization' in headers and self.should_strip_auth(response.request.url, url): |
|
# If we get redirected to a new host, we should strip out any |
|
# authentication headers. |
|
- original_parsed = urlparse(response.request.url) |
|
- redirect_parsed = urlparse(url) |
|
- |
|
- if (original_parsed.hostname != redirect_parsed.hostname): |
|
- del headers['Authorization'] |
|
+ del headers['Authorization'] |
|
|
|
# .netrc might have more auth for us on our new host. |
|
new_auth = get_netrc_auth(url) if self.trust_env else None |
|
diff --git a/utils.py b/utils.py |
|
index 30a03ca..9080923 100644 |
|
--- a/utils.py |
|
+++ b/utils.py |
|
@@ -34,6 +34,7 @@ NETRC_FILES = ('.netrc', '_netrc') |
|
|
|
DEFAULT_CA_BUNDLE_PATH = certs.where() |
|
|
|
+DEFAULT_PORTS = {'http': 80, 'https': 443} |
|
|
|
def dict_to_sequence(d): |
|
"""Returns an internal sequence dictionary update.""" |
|
-- |
|
2.24.1 |
|
|
|
|