Skip to content

gh-137146: Validate IPv6 ZoneID characters against RFC 6874 in urllib.parse #137148

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 6 commits into
base: main
Choose a base branch
from
Open

gh-137146: Validate IPv6 ZoneID characters against RFC 6874 in urllib.parse #137148

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
58f0d09
[PATCH] urllib.parse: Restrict IPv6 ZoneID characters to RFC 6874-com…
mauricelambert Jul 27, 2025
e33f050
Add blurb entries for IPv6 ZoneID validation fixes
mauricelambert Jul 27, 2025
0e2684d
gh-137146: Fix unicode characters in IPv6 Zone ID
mauricelambert Jul 28, 2025
be71b37
gh-137146: Add tests on IPv6 Zone ID checks
mauricelambert Jul 28, 2025
41feeee
Fix: reStructuredText language syntax
mauricelambert Jul 28, 2025
b93e903
gh-137146: Fix tests on IPv6 Zone ID checks
mauricelambert Jul 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions Lib/urllib/parse.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -466,6 +466,8 @@ def _check_bracketed_host(hostname):
ip = ipaddress.ip_address(hostname) # Throws Value Error if not IPv6 or IPv4
if isinstance(ip, ipaddress.IPv4Address):
raise ValueError(f"An IPv4 address cannot be in brackets")
if "%" in hostname and not re.match(r"\A(%[a-fA-F0-9]{2}|[\w\.~-])+\z", hostname.split("%", 1)[1]):
raise ValueError(f"IPv6 ZoneID is invalid")

# typed=True avoids BytesWarnings being emitted during cache key
# comparison since this API supports both bytes and str input.
Expand Down
Loading