Skip to content

[3.11] gh-143925: Reject control characters in data: URL mediatypes #144114

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
pablogsal merged 1 commit into from
Jan 25, 2026
Merged

[3.11] gh-143925: Reject control characters in data: URL mediatypes #144114

pablogsal merged 1 commit into from
Jan 25, 2026
+14 −0

Conversation

@sethmlarson
Copy link
Contributor

@sethmlarson sethmlarson commented Jan 21, 2026 •
edited by bedevere-app bot
Loading

(cherry picked from commit f25509e) (cherry picked from commit 2c9c746)

@sethmlarson
[3.11] pythongh-143925: Reject control characters in data: URL mediat…
66c966a 
…ypes

(cherry picked from commit f25509e)
(cherry picked from commit 2c9c746)

Co-authored-by: Seth Michael Larson <seth@python.org>
@sethmlarson sethmlarson requested a review from pablogsal January 21, 2026 15:45
@sethmlarson sethmlarson added the type-security A security issue label Jan 21, 2026
@bedevere-app bedevere-app bot mentioned this pull request Jan 21, 2026
Open
pablogsal
pablogsal approved these changes Jan 25, 2026
View reviewed changes
Copy link
Member

@pablogsal pablogsal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM Thanks a lot @sethmlarson

@pablogsal pablogsal merged commit 3f396ca into python:3.11 Jan 25, 2026
25 checks passed
@bedevere-bot
Copy link

bedevere-bot commented Jan 25, 2026

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot ARM64 macOS 3.11 (tier-2) has failed when building commit 3f396ca.

What do you need to do:

  1. Don't panic.
  2. Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
  3. Go to the page of the buildbot that failed (https://buildbot.python.org/#/builders/1030/builds/1910) and take a look at the build logs.
  4. Check if the failure is related to this commit (3f396ca) or if it is a false positive.
  5. If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/#/builders/1030/builds/1910

Failed tests:

  • test_urllib2net
  • test_ssl

Failed subtests:

  • test_preauth_data_to_tls_server - test.test_ssl.TestPreHandshakeClose.test_preauth_data_to_tls_server

Summary of the results of the build (if available):

==

Click to see traceback logs 
Traceback (most recent call last):
  File "/Users/buildbot/buildarea/3.11.pablogsal-macos-m1.macos-with-brew/build/Lib/test/test_ssl.py", line 5095, in test_preauth_data_to_tls_server
    self.non_linux_skip_if_other_okay_error(wrap_error)
  File "/Users/buildbot/buildarea/3.11.pablogsal-macos-m1.macos-with-brew/build/Lib/test/test_ssl.py", line 5042, in non_linux_skip_if_other_okay_error
    re.search('wrong.version.number', getattr(err, "reason", ""), re.I)):
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/buildbot/buildarea/3.11.pablogsal-macos-m1.macos-with-brew/build/Lib/re/__init__.py", line 176, in search
    return _compile(pattern, flags).search(string)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
TypeError: expected string or bytes-like object, got 'NoneType'

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pablogsal pablogsal pablogsal approved these changes

Assignees

No one assigned

Labels

release-blocker type-security A security issue

Projects

Release and Deferred blockers 🚫
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@sethmlarson @bedevere-bot @pablogsal