Staging
v0.5.1
https://github.com/python/cpython
Revision 07432c33a0cab9d40ec71b274ec4bca5c57ca6e9 authored by Miss Islington (bot) on 22 November 2019, 23:38:37 UTC, committed by GitHub on 22 November 2019, 23:38:37 UTC

* fix HTTP Digest handling in request.py

There is a bug triggered when server replies to a request with `WWW-Authenticate: Digest` where `qop="auth,auth-int"` rather than mere `qop="auth"`. Having both `auth` and `auth-int` is legitimate according to the `qop-options` rule in §3.2.1 of [[https://www.ietf.org/rfc/rfc2617.txt|RFC 2617]]:
>      qop-options       = "qop" "=" <"> 1GH-qop-value <">
>      qop-value         = "auth" | "auth-int" | token
> **qop-options**: [...] If present, it is a quoted string **of one or more** tokens indicating the "quality of protection" values supported by the server.  The value `"auth"` indicates authentication; the value `"auth-int"` indicates authentication with integrity protection

This is description confirmed by the definition of the [//n//]`GH-`[//m//]//rule// extended-BNF pattern defined in §2.1 of [[https://www.ietf.org/rfc/rfc2616.txt|RFC 2616]] as 'a comma-separated list of //rule// with at least //n// and at most //m// items'.

When this reply is parsed by `get_authorization`, request.py only tests for identity with `'auth'`, failing to recognize it as one of the supported modes the server announced, and claims that `"qop 'auth,auth-int' is not supported"`.

* 📜🤖 Added by blurb_it.

* bpo-38686 review fix: remember why.

* fix trailing space in Lib/urllib/request.py

Co-Authored-By: Brandt Bucher <brandtbucher@gmail.com>
(cherry picked from commit 14a89c47983f2fb9e7fdf33c769e622eefd3a14a)

Co-authored-by: PypeBros <PypeBros@users.noreply.github.com>
1 parent c58a811
Raw File
Tip revision: 07432c33a0cab9d40ec71b274ec4bca5c57ca6e9 authored by Miss Islington (bot) on 22 November 2019, 23:38:37 UTC
bpo-38686: fix HTTP Digest handling in request.py (GH-17045)
Tip revision: 07432c3
.gitattributes
# Binary data types
*.aif binary
*.aifc binary
*.aiff binary
*.au binary
*.bmp binary
*.exe binary
*.icns binary
*.gif binary
*.ico binary
*.jpg binary
*.pck binary
*.png binary
*.psd binary
*.tar binary
*.wav binary
*.whl binary
*.zip binary

# Specific binary files
Lib/test/sndhdrdata/sndhdr.* binary
PC/classicAppCompat.* binary

# Text files that should not be subject to eol conversion
Lib/test/cjkencodings/* -text
Lib/test/decimaltestdata/*.decTest -text
Lib/test/test_email/data/*.txt -text
Lib/test/xmltestdata/* -text
Lib/test/coding20731.py -text
Lib/test/test_importlib/data01/* -text

# CRLF files
*.bat text eol=crlf
*.ps1 text eol=crlf
*.sln text eol=crlf
*.vcxproj* text eol=crlf
*.props text eol=crlf
*.proj text eol=crlf
PCbuild/readme.txt text eol=crlf
PC/readme.txt text eol=crlf

# Generated files
# https://github.com/github/linguist#generated-code
Include/graminit.h          linguist-generated=true
Python/graminit.h           linguist-generated=true
Modules/clinic/*.h          linguist-generated=true
Objects/clinic/*.h          linguist-generated=true
PC/clinic/*.h               linguist-generated=true
Python/clinic/*.h           linguist-generated=true
Python/importlib.h          linguist-generated=true
Python/importlib_external.h linguist-generated=true
Include/Python-ast.h        linguist-generated=true
Python/Python-ast.c         linguist-generated=true
Include/opcode.h            linguist-generated=true
Python/opcode_targets.h     linguist-generated=true
Objects/typeslots.inc       linguist-generated=true
Modules/unicodedata_db.h    linguist-generated=true
back to top