René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"urllib.parse space handling CVE-2023-24329 appears unfixed","articleBody":"Everyone (including the [submitter](https://pointernull.com/security/python-url-parse-problem.html) of the now public exploit who submitted the issue half a year ago to `security@python.org` and the [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-24329)) seems to think that #99421 \"accidently fixed\" CVE-2023-24329.\r\n\r\nDid the Python Security Response Team verify that this vulnerability that was reported to them and that is now public was fixed by #99421?\r\n\r\nThe PoC from the submitter still works for me with the Debian package 3.11.2-4, which surprised me and makes me wonder whether the fix had any effect at all on the stripping of leading blanks issue in the CVE.\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-102470\n* gh-102508\n* gh-104575\n* gh-104592\n* gh-104593\n* gh-104895\n* gh-104896\n* gh-104918\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/AdrianBunk","@type":"Person","name":"AdrianBunk"},"datePublished":"2023-02-22T21:17:17.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":37},"url":"https://github.com/102153/cpython/issues/102153"}