{{ message }}
Repository navigation
Reject absolute-form targets without an authority before parsing (#13858) - #13860
Merged
Conversation
…-libs#13858) <!-- Thank you for your contribution! --> Follow-up to aio-libs#13855 for aio-libs/yarl#1937. With that change, yarl's default WHATWG mode reads a host from `http:host/p`, `http:/host/p` and `http:///host/p`, as browsers do. The Python and Cython request parsers passed an absolute-form request target to `URL()` and rejected it only if yarl found no host. They now first check that the target has `//` followed by a non-empty authority, so `GET http:///protected` and `GET http:/protected` stay rejected as RFC 9110 requires, whatever yarl version is installed. The client tests used `http:///example.com` and `http:///path` as URLs without a host. They now use `http://` where an invalid URL is needed, and `http:///example.com` is dropped from the invalid URL test data. With yarl#1937 it is `http://example.com/`, and as a redirect it leads to `example.com`, as in browsers. No with the released yarl, where such targets were already rejected. With yarl#1937, the server keeps rejecting absolute-form targets without an authority instead of reading a host from them. No, it is one string check shared by both parsers. Follow-up to aio-libs#13855; needed by aio-libs/yarl#1937. - [x] I think the code is well written - [x] Unit tests for the changes exist - [ ] Documentation reflects the changes: N/A, no documented behavior changes - [ ] If you provide code modification, please add yourself to `CONTRIBUTORS.txt`: N/A, already listed - [x] Add a new news fragment into the `CHANGES/` folder Drafted with Claude Code (Claude Opus 5.5); reviewed by @asvetlov. <details> <summary>Agent run details (optional, for reviewers)</summary> Tests with the Cython extensions built (llhttp generated, `make cythonize`, `build_ext --inplace`): `pytest tests -n auto`, 5246 passed, 22 skipped, 17 xfailed, both with yarl master (f761c37) and with the yarl#1937 branch (8d0f111). Pure-Python run of `test_http_parser.py`, `test_client_functional.py` and `test_client_session.py` with the yarl#1937 branch: 884 passed. Lint: black, isort, codespell passed. The local pre-commit flake8 hook fails to load `flake8-requirements` (`pkg_resources` missing), so flake8 (E, F, W) was run directly and passed. yesqa was skipped for the same reason, because it wrongly strips `# noqa: I900`. </details> (cherry picked from commit ce960dd)
Merging this PR will not alter performance
Comparing 
Footnotes
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #13855 for aio-libs/yarl#1937. With that change, yarl's default WHATWG mode reads a host from
http:host/p,http:/host/pandhttp:///host/p, as browsers do. The Python and Cython request parsers passed an absolute-form request target toURL()and rejected it only if yarl found no host. They now first check that the target has//followed by a non-empty authority, soGET http:///protectedandGET http:/protectedstay rejected as RFC 9110 requires, whatever yarl version is installed.The client tests used
http:///example.comandhttp:///pathas URLs without a host. They now usehttp://where an invalid URL is needed, andhttp:///example.comis dropped from the invalid URL test data. With yarl#1937 it ishttp://example.com/, and as a redirect it leads toexample.com, as in browsers.No with the released yarl, where such targets were already rejected. With yarl#1937, the server keeps rejecting absolute-form targets without an authority instead of reading a host from them.
No, it is one string check shared by both parsers.
Follow-up to #13855; needed by aio-libs/yarl#1937.
CONTRIBUTORS.txt: N/A, already listedCHANGES/folderDrafted with Claude Code (Claude Opus 5.5); reviewed by @asvetlov.
Agent run details (optional, for reviewers)
Tests with the Cython extensions built (llhttp generated,
make cythonize,build_ext --inplace):pytest tests -n auto, 5246 passed, 22 skipped, 17 xfailed, both with yarl master (f761c37) and with the yarl#1937 branch (8d0f111). Pure-Python run oftest_http_parser.py,test_client_functional.pyandtest_client_session.pywith the yarl#1937 branch: 884 passed.Lint: black, isort, codespell passed. The local pre-commit flake8 hook fails to load
flake8-requirements(pkg_resourcesmissing), so flake8 (E, F, W) was run directly and passed. yesqa was skipped for the same reason, because it wrongly strips# noqa: I900.(cherry picked from commit ce960dd)
What do these changes do?
Are there changes in behavior for the user?
Is it a substantial burden for the maintainers to support this?
Related issue number
Checklist
CONTRIBUTORS.txtCHANGES/foldername it
<issue_or_pr_num>.<type>.rst(e.g.588.bugfix.rst)if you don't have an issue number, change it to the pull request
number after creating the PR
.bugfix: A bug fix for something the maintainers deemed animproper undesired behavior that got corrected to match
pre-agreed expectations.
.feature: A new behavior, public APIs. That sort of stuff..deprecation: A declaration of future API removals and breakingchanges in behavior.
.breaking: When something public is removed in a breaking way.Could be deprecated in an earlier release.
.doc: Notable updates to the documentation structure or buildprocess.
.packaging: Notes for downstreams about unobvious side effectsand tooling. Changes in the test invocation considerations and
runtime assumptions.
.contrib: Stuff that affects the contributor experience. e.g.Running tests, building the docs, setting up the development
environment.
.misc: Changes that are hard to assign to any of the abovecategories.
Make sure to use full sentences with correct case and punctuation,
for example:
Use the past tense or the present tense a non-imperative mood,
referring to what's changed compared to the last released version
of this project.