René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[tangentially related to CVE-2023-24329] urlparse does not correctly handle schemes that begin with ASCII digits, '+', '-', and '.' characters","articleBody":"# Background\r\nRFC 3986 defines a scheme like this:\r\n- `scheme = ALPHA *( ALPHA / DIGIT / \"+\" / \"-\" / \".\" )`\r\n\r\nRFC 2234 defines an ALPHA like this:\r\n- `ALPHA = %x41-5A / %x61-7A`\r\n\r\nThe WHATWG URL spec defines a scheme like this:\r\n- \"A URL-scheme string must be one [ASCII alpha](https://infra.spec.whatwg.org/#ascii-alpha), followed by zero or more of [ASCII alphanumeric](https://infra.spec.whatwg.org/#ascii-alphanumeric), U+002B (+), U+002D (-), and U+002E (.).\"\r\n\r\n# The bug\r\nThis is the scheme string parsing code from `Lib/urllib/parse.py:462-468`:\r\n```python3\r\n    i = url.find(':')\r\n    if i \u003e 0:\r\n        for c in url[:i]:\r\n            if c not in scheme_chars:\r\n                break\r\n        else:\r\n            scheme, url = url[:i].lower(), url[i+1:]\r\n```\r\nThis is the definition of `scheme_chars` from `Lib/urllib/parse.py:77-80`:\r\n```python3\r\nscheme_chars = ('abcdefghijklmnopqrstuvwxyz'\r\n                'ABCDEFGHIJKLMNOPQRSTUVWXYZ'\r\n                '0123456789'\r\n                '+-.')\r\n```\r\nThis will erroneously validate schemes that begin with any of `('.', '-', '+', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9')`. This behavior is in violation of both specifications.\r\n\r\nThis bug is reproducible with the following snippet:\r\n```python\r\n\u003e\u003e\u003e from urllib.parse import urlparse\r\n\u003e\u003e\u003e urlparse(\".://\") # Should error, but doesn't\r\nParseResult(scheme='.', netloc='', path='', params='', query='', fragment='')\r\n```\r\n\r\n# My environment\r\n- CPython versions tested on:\r\n  - 3.12.0a1+ (fb844e1931bc1ad2f11565fbe25627a1a41b4203)\r\n  - 3.10.8\r\n- Operating system and architecture:\r\n  - Arch Linux x86_64\n\n\u003c!-- gh-pr-number: gh-99421 --\u003e\n* PR: gh-99421\n\u003c!-- /gh-pr-number --\u003e\n\n\n\u003c!-- gh-pr-number: gh-99446 --\u003e\n* PR: gh-99446\n\u003c!-- /gh-pr-number --\u003e\n","author":{"url":"https://github.com/kenballus","@type":"Person","name":"kenballus"},"datePublished":"2022-11-12T19:27:12.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":11},"url":"https://github.com/99418/cpython/issues/99418"}