Mariusz Felisiak afb23f5929 [3.1.x] Fixed #32713, Fixed CVE-2021-32052 -- Prevented newlines and tabs from being accepted in URLValidator on Python 3.9.5+.
In Python 3.9.5+ urllib.parse() automatically removes ASCII newlines
and tabs from URLs [1, 2]. Unfortunately it created an issue in
the URLValidator. URLValidator uses urllib.urlsplit() and
urllib.urlunsplit() for creating a URL variant with Punycode which no
longer contains newlines and tabs in Python 3.9.5+. As a consequence,
the regular expression matched the URL (without unsafe characters) and
the source value (with unsafe characters) was considered valid.

[1] https://bugs.python.org/issue43882 and
[2] 76cd81d603

Backport of e1e81aa1c4427411e3c68facdd761229ffea6f6f from main.
2021-05-06 08:50:52 +02:00
..
2021-02-25 17:27:54 +01:00
2017-05-24 09:13:26 -04:00

The documentation in this tree is in plain text files and can be viewed using any text file viewer.

It uses ReST (reStructuredText), and the Sphinx documentation system. This allows it to be built into other forms for easier viewing and browsing.

To create an HTML version of the docs:

  • Install Sphinx (using python -m pip install Sphinx or some other method).
  • In this docs/ directory, type make html (or make.bat html on Windows) at a shell prompt.

The documentation in _build/html/index.html can then be viewed in a web browser.