René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[CVE-2024-11168] urlparse incorrectly retrieves IPv4 and regular name hosts from inside of brackets","articleBody":"# Background\r\n\r\nRFC 3986 defines a host as follows\r\n```\r\nhost = IP-literal / IPv4address / reg-name\r\n```\r\nWhere\r\n```\r\nIP-literal = \"[\" ( IPv6address / IPvFuture  ) \"]\"\r\nreg-name = *( unreserved / pct-encoded / sub-delims )\r\nIPv4address = dec-octet \".\" dec-octet \".\" dec-octet \".\" dec-octet\r\n```\r\n\r\nWhatWG says that \"A valid host string must be a [valid domain string](https://url.spec.whatwg.org/#valid-domain-string), a [valid IPv4-address string](https://url.spec.whatwg.org/#valid-ipv4-address-string), or: U+005B ([), followed by a [valid IPv6-address string](https://url.spec.whatwg.org/#valid-ipv6-address-string), followed by U+005D (]).\"\r\n\r\n# The Bug\r\n\r\nThis is code from ```Lib/urllib/parse.py:196-208``` used for retrieving the hostname from the netloc\r\n```python\r\n    @property\r\n    def _hostinfo(self):\r\n        netloc = self.netloc\r\n        _, _, hostinfo = netloc.rpartition('@')\r\n        _, have_open_br, bracketed = hostinfo.partition('[')\r\n        if have_open_br:\r\n            hostname, _, port = bracketed.partition(']')\r\n            _, _, port = port.partition(':')\r\n        else:\r\n            hostname, _, port = hostinfo.partition(':')\r\n        if not port:\r\n            port = None\r\n        return hostname, port\r\n```\r\n\r\nIt will incorrectly retrieve IPv4 addresses and regular name hosts from inside brackets. This is in violation of both specifications.\r\n\r\nMinimally reproducible example:\r\n```python\r\nfrom urllib.parse import urlsplit\r\n\r\nparsedURL = urlsplit('scheme://user@[regname]/Path')\r\nprint(parsedURL.hostname) # Prints 'regname'\r\n```\r\n\r\n# Your environment\r\n\r\n\u003c!-- Include as many relevant details as possible about the environment you experienced the bug in --\u003e\r\n\r\n- CPython versions tested on:\r\n   - 3.12a7 ([```23cf1e2```](https://github.com/JohnJamesUtley/cpython/commit/23cf1e20a6470588fbc64483031ceeec7614dc56))\r\n   - 3.10.10\r\n- Operating system and architecture:\r\n   - Arch Linux x86_64\r\n\r\n\u003c!--\r\nYou can freely edit this text. Remove any lines you believe are unnecessary.\r\n--\u003e\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-103849\n* gh-104349\n* gh-126975\n* gh-126976\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/JohnJamesUtley","@type":"Person","name":"JohnJamesUtley"},"datePublished":"2023-04-25T19:43:19.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":11},"url":"https://github.com/103848/cpython/issues/103848"}