Skip to content

gh-137146: Validate IPv6 ZoneID characters against RFC 6874 in urllib.parse #137148

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mauricelambert wants to merge 9 commits into
base: main
Choose a base branch
from
Open

gh-137146: Validate IPv6 ZoneID characters against RFC 6874 in urllib.parse #137148

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
58f0d09
[PATCH] urllib.parse: Restrict IPv6 ZoneID characters to RFC 6874-com…
mauricelambert Jul 27, 2025
e33f050
Add blurb entries for IPv6 ZoneID validation fixes
mauricelambert Jul 27, 2025
0e2684d
gh-137146: Fix unicode characters in IPv6 Zone ID
mauricelambert Jul 28, 2025
be71b37
gh-137146: Add tests on IPv6 Zone ID checks
mauricelambert Jul 28, 2025
41feeee
Fix: reStructuredText language syntax
mauricelambert Jul 28, 2025
b93e903
gh-137146: Fix tests on IPv6 Zone ID checks
mauricelambert Jul 28, 2025
de4bfc7
Refactor: make implementation more compliant with standards
mauricelambert Feb 28, 2026
21ab53a
Adjust NEWS entry to follow conventions
mauricelambert Feb 28, 2026
f49014a
Fix: flags in compiled regex
mauricelambert Feb 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions Lib/urllib/parse.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -466,6 +466,8 @@ def _check_bracketed_host(hostname):
ip = ipaddress.ip_address(hostname) # Throws Value Error if not IPv6 or IPv4
if isinstance(ip, ipaddress.IPv4Address):
raise ValueError(f"An IPv4 address cannot be in brackets")
if "%" in hostname and not re.match(r"\A(%[a-fA-F0-9]{2}|[\w\.~-])+\z", hostname.split("%", 1)[1]):
raise ValueError(f"IPv6 ZoneID is invalid")

@picnixz picnixz Nov 2, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The f-string is not necessary (you can also remove it from the other raise ValueError).

@mauricelambert mauricelambert Feb 28, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the review, it's done.


# typed=True avoids BytesWarnings being emitted during cache key
# comparison since this API supports both bytes and str input.
Expand Down
1 change: 1 addition & 0 deletions Misc/NEWS.d/next/Library/2025-07-27-15-23-32.gh-issue-137146.BE_ylT.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Validate IPv6 ZoneID characters in bracketed hostnames to match RFC 6874. `urllib.parse` now rejects ZoneIDs containing invalid or unsafe characters.

@ZeroIntensity ZeroIntensity Jul 27, 2025 •
edited by picnixz
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is reStructuredText, not Markdown, so references look like this:

Suggested change
Validate IPv6 ZoneID characters in bracketed hostnames to match RFC 6874. `urllib.parse` now rejects ZoneIDs containing invalid or unsafe characters.
Validate IPv6 ZoneID characters in bracketed hostnames to match RFC 6874. :mod:`urllib.parse` now rejects ZoneIDs containing invalid or unsafe characters.

@picnixz picnixz Jul 28, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

urllib.parse is a module, if you want to talk about the function it's urllib.parse.urlparse. I've edited Zero's answer by changing the role as I didn't check which functions are affected (if it's the entire module, it's fine to only quote the module)

@ZeroIntensity ZeroIntensity Jul 28, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oops, thanks.

@mauricelambert mauricelambert Jul 29, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I corrected the blurb and added the tests, thank you for your help.

Loading