Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
home:olh:SLE_11
python.6852
python-2.7-httpoxy.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File python-2.7-httpoxy.patch of Package python.6852
Index: Python-2.6.9/Doc/howto/urllib2.rst =================================================================== --- Python-2.6.9.orig/Doc/howto/urllib2.rst +++ Python-2.6.9/Doc/howto/urllib2.rst @@ -521,6 +521,11 @@ is done using similar steps to setting u through a proxy. However, this can be enabled by extending urllib2 as shown in the recipe [#]_. +.. note:: + + ``HTTP_PROXY`` will be ignored if a variable ``REQUEST_METHOD`` is set; see + the documentation on :func:`~urllib.getproxies`. + Sockets and Layers ================== Index: Python-2.6.9/Doc/library/urllib.rst =================================================================== --- Python-2.6.9.orig/Doc/library/urllib.rst +++ Python-2.6.9/Doc/library/urllib.rst @@ -94,6 +94,15 @@ High-level interface In a Windows environment, if no proxy environment variables are set, proxy settings are obtained from the registry's Internet Settings section. + .. note:: + + If the environment variable ``REQUEST_METHOD`` is set, which usually + indicates your script is running in a CGI environment, the environment + variable ``HTTP_PROXY`` (uppercase) will be ignored. This is because that + variable can be injected by a client using the "Proxy:" HTTP header. If you + need to use an HTTP proxy in a CGI environment, either use ``ProxyHandler`` + explicitly, or make sure the variable name is in lowercase (``http_proxy``). + .. index:: single: Internet Config In a Mac OS X environment, :func:`urlopen` will retrieve proxy information Index: Python-2.6.9/Doc/library/urllib2.rst =================================================================== --- Python-2.6.9.orig/Doc/library/urllib2.rst +++ Python-2.6.9/Doc/library/urllib2.rst @@ -199,6 +199,11 @@ The following classes are provided: To disable autodetected proxy pass an empty dictionary. +.. note:: + + ``HTTP_PROXY`` will be ignored if a variable ``REQUEST_METHOD`` is set; see + the documentation on :func:`~urllib.getproxies`. + .. class:: HTTPPasswordMgr() Index: Python-2.6.9/Lib/test/test_urllib.py =================================================================== --- Python-2.6.9.orig/Lib/test/test_urllib.py +++ Python-2.6.9/Lib/test/test_urllib.py @@ -115,6 +115,19 @@ class ProxyTests(unittest.TestCase): # getproxies_environment use lowered case truncated (no '_proxy') keys self.assertEquals('localhost', proxies['no']) + def test_proxy_cgi_ignore(self): + try: + self.env.set('HTTP_PROXY', 'http://somewhere:3128') + proxies = urllib.getproxies_environment() + self.assertEqual('http://somewhere:3128', proxies['http']) + self.env.set('REQUEST_METHOD', 'GET') + proxies = urllib.getproxies_environment() + self.assertFalse('http' in proxies) + finally: + self.env.unset('REQUEST_METHOD') + self.env.unset('HTTP_PROXY') + + class urlopen_HttpTests(unittest.TestCase): """Test urlopen() opening a fake http connection.""" Index: Python-2.6.9/Lib/urllib.py =================================================================== --- Python-2.6.9.orig/Lib/urllib.py +++ Python-2.6.9/Lib/urllib.py @@ -1316,11 +1316,28 @@ def getproxies_environment(): [Fancy]URLopener constructor. """ + # Get all variables proxies = {} for name, value in os.environ.items(): name = name.lower() if value and name[-6:] == '_proxy': proxies[name[:-6]] = value + + # CVE-2016-1000110 - If we are running as CGI script, forget HTTP_PROXY + # (non-all-lowercase) as it may be set from the web server by a "Proxy:" + # header from the client + # If "proxy" is lowercase, it will still be used thanks to the next block + if 'REQUEST_METHOD' in os.environ: + proxies.pop('http', None) + + # Get lowercase variables + for name, value in os.environ.items(): + if name[-6:] == '_proxy': + name = name.lower() + if value: + proxies[name[:-6]] = value + else: + proxies.pop(name[:-6], None) return proxies def proxy_bypass_environment(host):
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor