Prevent HTTPoxy attack (CVE-2016-1000110)
Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which
indicates that the script is in CGI mode.
Issue reported and patch contributed by Rémi Rampin.
diff --git a/Lib/urllib.py b/Lib/urllib.py
index 139fab9..c3ba2c9 100644
--- a/Lib/urllib.py
+++ b/Lib/urllib.py
@@ -1380,12 +1380,21 @@
If you need a different way, you can pass a proxies dictionary to the
[Fancy]URLopener constructor.
"""
+ # Get all variables
proxies = {}
for name, value in os.environ.items():
name = name.lower()
if value and name[-6:] == '_proxy':
proxies[name[:-6]] = value
+ # CVE-2016-1000110 - If we are running as CGI script, forget HTTP_PROXY
+ # (non-all-lowercase) as it may be set from the web server by a "Proxy:"
+ # header from the client
+ # If "proxy" is lowercase, it will still be used thanks to the next block
+ if 'REQUEST_METHOD' in os.environ:
+ proxies.pop('http', None)
+
+ # Get lowercase variables
for name, value in os.environ.items():
if name[-6:] == '_proxy':
name = name.lower()