From d91e2c740890837edafaee24d68112b776cda9c5 Mon Sep 17 00:00:00 2001
From: Seth Michael Larson <seth@python.org>
Date: Fri, 31 Jan 2025 11:41:34 -0600
Subject: [PATCH] gh-105704: Disallow square brackets (`[` and `]`) in domain
 names for parsed URLs (GH-129418)

* gh-105704: Disallow square brackets ( and ) in domain names for parsed URLs

* Use Sphinx references

Co-authored-by: Peter Bierma <zintensitydev@gmail.com>

* Add mismatched bracket test cases, fix news format

* Add more test coverage for ports

---------

(cherry picked from commit d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
---
 Lib/test/test_urlparse.py                                                |   61 +++++++---
 Lib/urlparse.py                                                          |   21 +++
 Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst |    4 
 3 files changed, 71 insertions(+), 15 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst

Index: Python-2.7.18/Lib/test/test_urlparse.py
===================================================================
--- Python-2.7.18.orig/Lib/test/test_urlparse.py	2025-02-26 09:41:20.637917806 +0100
+++ Python-2.7.18/Lib/test/test_urlparse.py	2025-02-26 09:41:20.740476346 +0100
@@ -561,27 +561,62 @@
         self.assertEqual(p2.path, '+31641044153')
 
     def test_invalid_bracketed_hosts(self):
-        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[192.0.2.146]/Path?Query')
-        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[important.com:8000]/Path?Query')
-        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v123r.IP]/Path?Query')
-        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v12ae]/Path?Query')
-        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v.IP]/Path?Query')
-        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v123.]/Path?Query')
-        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v]/Path?Query')
-        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af::2309::fae7:1234]/Path?Query')
-        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af:2309::fae7:1234:2342:438e:192.0.2.146]/Path?Query')
-        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@]v6a.ip[/Path')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'Scheme://user@[192.0.2.146]/Path?Query')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'Scheme://user@[important.com:8000]/Path?Query')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'Scheme://user@[v123r.IP]/Path?Query')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'Scheme://user@[v12ae]/Path?Query')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'Scheme://user@[v.IP]/Path?Query')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'Scheme://user@[v123.]/Path?Query')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'Scheme://user@[v]/Path?Query')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'Scheme://user@[0439:23af::2309::fae7:1234]/Path?Query')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'Scheme://user@[0439:23af:2309::fae7:1234:2342:438e:192.0.2.146]/Path?Query')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'Scheme://user@]v6a.ip[/Path')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://prefix.[v6a.ip]')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://[v6a.ip].suffix')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://prefix.[v6a.ip]/')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://[v6a.ip].suffix/')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://prefix.[v6a.ip]?')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://[v6a.ip].suffix?')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://prefix.[::1]')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://[::1].suffix')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://prefix.[::1]/')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://[::1].suffix/')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://prefix.[::1]?')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://[::1].suffix?')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://prefix.[::1]:a')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://[::1].suffix:a')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://prefix.[::1]:a1')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://[::1].suffix:a1')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://prefix.[::1]:1a')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://[::1].suffix:1a')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://prefix.[::1]:')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://[::1].suffix:/')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://prefix.[::1]:?')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://user@prefix.[v6a.ip]')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://user@[v6a.ip].suffix')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://[v6a.ip')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://v6a.ip]')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://]v6a.ip[')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://]v6a.ip')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://v6a.ip[')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://prefix.[v6a.ip')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://v6a.ip].suffix')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://prefix]v6a.ip[suffix')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://prefix]v6a.ip')
+        self.assertRaises(ValueError, urlparse.urlsplit, 'scheme://v6a.ip[suffix')
 
     def test_splitting_bracketed_hosts(self):
-        p1 = urllib.parse.urlsplit('scheme://user@[v6a.ip]/path?query')
+        p1 = urlparse.urlsplit('scheme://user@[v6a.ip]:1234/path?query')
         self.assertEqual(p1.hostname, 'v6a.ip')
         self.assertEqual(p1.username, 'user')
         self.assertEqual(p1.path, '/path')
-        p2 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7%test]/path?query')
+        self.assertEqual(p1.port, 1234)
+        p2 = urlparse.urlsplit('scheme://user@[0439:23af:2309::fae7%test]/path?query')
         self.assertEqual(p2.hostname, '0439:23af:2309::fae7%test')
         self.assertEqual(p2.username, 'user')
         self.assertEqual(p2.path, '/path')
-        p3 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7:1234:192.0.2.146%test]/path?query')
+        self.assertIs(p2.port, None)
+        p3 = urlparse.urlsplit('scheme://user@[0439:23af:2309::fae7:1234:192.0.2.146%test]/path?query')
         self.assertEqual(p3.hostname, '0439:23af:2309::fae7:1234:192.0.2.146%test')
         self.assertEqual(p3.username, 'user')
         self.assertEqual(p3.path, '/path')
Index: Python-2.7.18/Lib/urlparse.py
===================================================================
--- Python-2.7.18.orig/Lib/urlparse.py	2025-02-26 09:41:20.638161194 +0100
+++ Python-2.7.18/Lib/urlparse.py	2025-02-26 09:44:24.107834813 +0100
@@ -194,6 +194,24 @@
                              % netloc)
 
 
+def _check_bracketed_netloc(netloc):
+    # Note that this function must mirror the splitting
+    # done in NetlocResultMixins._hostinfo().
+    hostname_and_port = netloc.rpartition('@')[2]
+    before_bracket, have_open_br, bracketed = hostname_and_port.partition('[')
+    if have_open_br:
+        # No data is allowed before a bracket.
+        if before_bracket:
+            raise ValueError("Invalid IPv6 URL")
+        hostname, _, port = bracketed.partition(']')
+        # No data is allowed after the bracket but before the port delimiter.
+        if port and not port.startswith(":"):
+            raise ValueError("Invalid IPv6 URL")
+    else:
+        hostname, _, port = hostname_and_port.partition(':')
+    _check_bracketed_host(hostname)
+
+
 # Valid bracketed hosts are defined in
 # https://www.rfc-editor.org/rfc/rfc3986#page-49 and https://url.spec.whatwg.org/
 def _check_bracketed_host(hostname):
@@ -239,8 +257,7 @@
                         (']' in netloc and '[' not in netloc)):
                     raise ValueError("Invalid IPv6 URL")
                 if '[' in netloc and ']' in netloc:
-                    bracketed_host = netloc.partition('[')[2].partition(']')[0]
-                    _check_bracketed_host(bracketed_host)
+                    _check_bracketed_netloc(netloc)
             if allow_fragments and '#' in url:
                 url, fragment = url.split('#', 1)
             if '?' in url:
Index: Python-2.7.18/Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ Python-2.7.18/Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst	2025-02-26 09:41:20.740965517 +0100
@@ -0,0 +1,4 @@
+When using :func:`urllib.parse.urlsplit` and :func:`urllib.parse.urlparse` host
+parsing would not reject domain names containing square brackets (``[`` and
+``]``). Square brackets are only valid for IPv6 and IPvFuture hosts according to
+`RFC 3986 Section 3.2.2 <https://www.rfc-editor.org/rfc/rfc3986#section-3.2.2>`__.
