v2.20.1

Incorrect ValueError Message on ~requests.utils.from_key_val_list comments

HISTORY.md

@@ -8,6 +8,14 @@ dev
 
 -   \[Short description of non-trivial change.\]
 
+2.20.1 (2018-11-08)
+-------------------
+
+**Bugfixes**
+
+- Fixed bug with unintended Authorization header stripping for
+  redirects using default ports (http/80, https/443).
+
 2.20.0 (2018-10-18)
 -------------------
 

docs/community/support.rst

@@ -20,8 +20,9 @@ Send a Tweet
 
 If your question is less than 280 characters, feel free to send a tweet to
 `@kennethreitz <https://twitter.com/kennethreitz>`_,
-`@sigmavirus24 <https://twitter.com/sigmavirus24>`_, or
-`@lukasaoz <https://twitter.com/lukasaoz>`_.
+`@sigmavirus24 <https://twitter.com/sigmavirus24>`_,
+`@lukasaoz <https://twitter.com/lukasaoz>`_, or
+`@nateprewitt <https://twitter.com/nateprewitt>`_.
 
 File an Issue
 -------------

docs/community/updates.rst

@@ -28,4 +28,4 @@ Follow `@kennethreitz <https://twitter.com/kennethreitz>`_ for updates.
 Release and Version History
 ===========================
 
-.. include:: ../../HISTORY.rst
+.. include:: ../../HISTORY.md

docs/community/vulnerabilities.rst

@@ -5,13 +5,13 @@ Vulnerability Disclosure
 
 If you think you have found a potential security vulnerability in requests,
 please email `sigmavirus24 <mailto:graffatcolmingov@gmail.com>`_ and
-`Lukasa <mailto:cory@lukasa.co.uk>`_ directly. **Do not file a public issue.**
+`Nate <mailto:nate.prewitt@gmail.com>`_ directly. **Do not file a public issue.**
 
 Our PGP Key fingerprints are:
 
 - 0161 BB7E B208 B5E0 4FDC  9F81 D9DA 0A04 9113 F853 (@sigmavirus24)
 
-- 90DC AE40 FEA7 4B14 9B70  662D F25F 2144 EEC1 373D (@lukasa)
+- 8722 7E29 AD9C FF5C FAC3  EA6A 44D3 FF97 B80D C864 (@nateprewitt)
 
 If English is not your first language, please try to describe the problem and
 its impact to the best of your ability. For greater detail, please use your
@@ -95,13 +95,16 @@ if upgrading is not an option.
 Previous CVEs
 -------------
 
+- Fixed in 2.20.0
+  - `CVE 2018-18074 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-18074>`_
+
 - Fixed in 2.6.0
 
-  - `CVE 2015-2296 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=2015-2296>`_,
+  - `CVE 2015-2296 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=2015-2296>`_,
     reported by Matthew Daley of `BugFuzz <https://bugfuzz.com/>`_.
 
 - Fixed in 2.3.0
 
-  - `CVE 2014-1829 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-1829>`_
+  - `CVE 2014-1829 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-1829>`_
 
-  - `CVE 2014-1830 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-1830>`_
+  - `CVE 2014-1830 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-1830>`_

docs/dev/contributing.rst

@@ -13,11 +13,12 @@ contributing to the Requests project is *very* generous of you.
 This document lays out guidelines and advice for contributing to this project.
 If you're thinking of contributing, please start by reading this document and
 getting a feel for how contributing to this project works. If you have any
-questions, feel free to reach out to either `Ian Cordasco`_ or `Cory Benfield`_,
-the primary maintainers.
+questions, feel free to reach out to either `Ian Cordasco`_, `Cory Benfield`_,
+or `Nate Prewitt`_, the primary maintainers.
 
 .. _Ian Cordasco: http://www.coglib.com/~icordasc/
 .. _Cory Benfield: https://lukasa.co.uk/about
+.. _Nate Prewitt: https://www.nateprewitt.com/
 
 If you have non-technical feedback, philosophical ponderings, crazy ideas, or
 other general thoughts about Requests or its position within the Python

docs/dev/philosophy.rst

@@ -11,7 +11,7 @@ Management Style
 
 `Kenneth Reitz <https://www.kennethreitz.org/>`_ is the BDFL. He has final say in any decision related to the Requests project. Kenneth is responsible for the direction and form of the library, as well as its presentation. In addition to making decisions based on technical merit, he is responsible for making decisions based on the development philosophy of Requests.
 
-`Ian Cordasco <http://www.coglib.com/~icordasc/>`_ and `Cory Benfield <https://lukasa.co.uk/about/>`_ are the core contributors. They are responsible for triaging bug reports, reviewing pull requests and ensuring that Kenneth is kept up to speed with developments around the library. The day-to-day managing of the project is done by the core contributors. They are responsible for making judgements about whether or not a feature request is likely to be accepted by Kenneth. Their word is, in some ways, more final than Kenneth's.
+`Ian Cordasco <http://www.coglib.com/~icordasc/>`_, `Cory Benfield <https://lukasa.co.uk/about/>`_, and `Nate Prewitt <https://www.nateprewitt.com/>`_ are the core contributors. They are responsible for triaging bug reports, reviewing pull requests and ensuring that Kenneth is kept up to speed with developments around the library. The day-to-day managing of the project is done by the core contributors. They are responsible for making judgements about whether or not a feature request is likely to be accepted by Kenneth. Their word is, in some ways, more final than Kenneth's.
 
 Values
 ~~~~~~

docs/user/quickstart.rst

@@ -481,7 +481,7 @@ response.
 
 For example, GitHub redirects all HTTP requests to HTTPS::
 
-    >>> r = requests.get('https://github.com/')
+    >>> r = requests.get('http://github.com/')
 
     >>> r.url
     'https://github.com/'
@@ -496,7 +496,7 @@ For example, GitHub redirects all HTTP requests to HTTPS::
 If you're using GET, OPTIONS, POST, PUT, PATCH or DELETE, you can disable
 redirection handling with the ``allow_redirects`` parameter::
 
-    >>> r = requests.get('https://github.com/', allow_redirects=False)
+    >>> r = requests.get('http://github.com/', allow_redirects=False)
 
     >>> r.status_code
     301
@@ -506,7 +506,7 @@ redirection handling with the ``allow_redirects`` parameter::
 
 If you're using HEAD, you can enable redirection as well::
 
-    >>> r = requests.head('https://github.com/', allow_redirects=True)
+    >>> r = requests.head('http://github.com/', allow_redirects=True)
 
     >>> r.url
     'https://github.com/'

requests/__version__.py

@@ -5,8 +5,8 @@
 __title__ = 'requests'
 __description__ = 'Python HTTP for Humans.'
 __url__ = 'http://python-requests.org'
-__version__ = '2.20.0'
-__build__ = 0x022000
+__version__ = '2.20.1'
+__build__ = 0x022001
 __author__ = 'Kenneth Reitz'
 __author_email__ = 'me@kennethreitz.org'
 __license__ = 'Apache 2.0'

requests/sessions.py

@@ -19,7 +19,7 @@ from .cookies import (
 from .models import Request, PreparedRequest, DEFAULT_REDIRECT_LIMIT
 from .hooks import default_hooks, dispatch_hook
 from ._internal_utils import to_native_string
-from .utils import to_key_val_list, default_headers
+from .utils import to_key_val_list, default_headers, DEFAULT_PORTS
 from .exceptions import (
     TooManyRedirects, InvalidSchema, ChunkedEncodingError, ContentDecodingError)
 
@@ -128,8 +128,17 @@ class SessionRedirectMixin(object):
         if (old_parsed.scheme == 'http' and old_parsed.port in (80, None)
                 and new_parsed.scheme == 'https' and new_parsed.port in (443, None)):
             return False
+
+        # Handle default port usage corresponding to scheme.
+        changed_port = old_parsed.port != new_parsed.port
+        changed_scheme = old_parsed.scheme != new_parsed.scheme
+        default_port = (DEFAULT_PORTS.get(old_parsed.scheme, None), None)
+        if (not changed_scheme and old_parsed.port in default_port
+                and new_parsed.port in default_port):
+            return False
+
         # Standard case: root URI must match
-        return old_parsed.port != new_parsed.port or old_parsed.scheme != new_parsed.scheme
+        return changed_port or changed_scheme
 
     def resolve_redirects(self, resp, req, stream=False, timeout=None,
                           verify=True, cert=None, proxies=None, yield_requests=False, **adapter_kwargs):

requests/utils.py

@@ -38,6 +38,8 @@ NETRC_FILES = ('.netrc', '_netrc')
 
 DEFAULT_CA_BUNDLE_PATH = certs.where()
 
+DEFAULT_PORTS = {'http': 80, 'https': 443}
+
 
 if sys.platform == 'win32':
     # provide a proxy_bypass version on Windows without DNS lookups
@@ -264,7 +266,7 @@ def from_key_val_list(value):
         >>> from_key_val_list([('key', 'val')])
         OrderedDict([('key', 'val')])
         >>> from_key_val_list('string')
-        ValueError: need more than 1 value to unpack
+        ValueError: cannot encode objects that are not 2-tuples
         >>> from_key_val_list({'key': 'val'})
         OrderedDict([('key', 'val')])
 

tests/test_requests.py

@@ -1611,6 +1611,17 @@ class TestRequests:
         s = requests.Session()
         assert s.should_strip_auth('http://example.com:1234/foo', 'https://example.com:4321/bar')
 
+    @pytest.mark.parametrize(
+        'old_uri, new_uri', (
+            ('https://example.com:443/foo', 'https://example.com/bar'),
+            ('http://example.com:80/foo', 'http://example.com/bar'),
+            ('https://example.com/foo', 'https://example.com:443/bar'),
+            ('http://example.com/foo', 'http://example.com:80/bar')
+        ))
+    def test_should_strip_auth_default_port(self, old_uri, new_uri):
+        s = requests.Session()
+        assert not s.should_strip_auth(old_uri, new_uri)
+
     def test_manual_redirect_with_partial_body_read(self, httpbin):
         s = requests.Session()
         r1 = s.get(httpbin('redirect/2'), allow_redirects=False, stream=True)