diff options
| author | Senthil Kumaran <senthil@uthcode.com> | 2016-07-30 23:24:16 -0700 |
|---|---|---|
| committer | Senthil Kumaran <senthil@uthcode.com> | 2016-07-30 23:24:16 -0700 |
| commit | 50f0a6b5e0a3aeb689946abe200ab8547fa06118 (patch) | |
| tree | d55b8a9d508d58a7a9ef91d5faa41bab3a3eaf75 /Lib/urllib | |
| parent | a00b96119106d61ec529902b499ec6bdba204335 (diff) | |
| download | cpython-50f0a6b5e0a3aeb689946abe200ab8547fa06118.tar.gz | |
Prevent HTTPoxy attack (CVE-2016-1000110)
Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which
indicates that the script is in CGI mode.
Issue #27568 Reported and patch contributed by R?mi Rampin.
Diffstat (limited to 'Lib/urllib')
| -rw-r--r-- | Lib/urllib/request.py | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/Lib/urllib/request.py b/Lib/urllib/request.py index ef62acc710..537b765a12 100644 --- a/Lib/urllib/request.py +++ b/Lib/urllib/request.py @@ -2366,6 +2366,13 @@ def getproxies_environment(): name = name.lower() if value and name[-6:] == '_proxy': proxies[name[:-6]] = value + + # CVE-2016-1000110 - If we are running as CGI script, forget HTTP_PROXY + # (non-all-lowercase) as it may be set from the web server by a "Proxy:" + # header from the client + if 'REQUEST_METHOD' in os.environ: + proxies.pop('http', None) + return proxies def proxy_bypass_environment(host): |