Fix: Mitigate urllib3 IPv6 Zone ID parsing bug #7088
+12
−0
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This Pull Request introduces a targeted mitigation in
Request.prepare_urlto prevent URL corruption caused by a bug in the dependency,urllib3.util.parse_url.The Problem
When a standards-compliant link-local IPv6 address with a Zone ID is passed to
requests(e.g.,http://[fe80::a%2553]/), the following sequence of failures occurs:urllib3):urllib3.util.parse_urlincorrectly decodes the Zone ID delimiter from the required URI format (%25) to a single percent sign (%). This leaves the host component in a corrupted state ([fe80::a%53]). It can also be the case mutlple calls ofurllib3.quoteandurllib3.unquotefurther change characters after the percent sign to its hexadecimal representation (%53 -> S).OSError: [Errno 22] Invalid argumentinurllib3's socket layer, as the host string is improperly formatted for the OS socket API.requestscomponents (like cookie handling), the parser may incorrectly decode the remaining%53as the character'S', leading toValueError.The Solution
This patch adds logic immediately after the
parse_urlcall to check for, and repair, the corrupted host component.%).%25).This ensures that the final
self.urlis a canonical URI per RFC 6874, allowing the request to proceed successfully once the underlyingurllib3connection logic is fixed to correctly handle the Zone ID. This fix prevents immediate internal corruption errors withinrequestsitself.