Add tests for the urllib[2] vulnerability. Change to raise exceptions.
diff --git a/Lib/urllib.py b/Lib/urllib.py
index b835f52..97597f4 100644
--- a/Lib/urllib.py
+++ b/Lib/urllib.py
@@ -638,7 +638,8 @@
newurl = headers['uri']
else:
return
-
+ void = fp.read()
+ fp.close()
# In case the server sent a relative URL, join with original:
newurl = basejoin(self.type + ":" + url, newurl)
@@ -648,10 +649,11 @@
if not (newurl_lower.startswith('http://') or
newurl_lower.startswith('https://') or
newurl_lower.startswith('ftp://')):
- return
+ raise IOError('redirect error', errcode,
+ errmsg + " - Redirection to url '%s' is not allowed" %
+ newurl,
+ headers)
- void = fp.read()
- fp.close()
return self.open(newurl)
def http_error_301(self, url, fp, errcode, errmsg, headers, data=None):