https://mazinahmed.net/tags/automation/Recent content in Automation on Mazin AhmedHugoenSun, 12 Apr 2020 00:00:00 +0000https://mazinahmed.net/blog/testing-for-path-traversal-with-python/Sun, 12 Apr 2020 00:00:00 +0000https://mazinahmed.net/blog/testing-for-path-traversal-with-python/<hr> <p>I have noticed an odd behavior in the <code>requests</code> module in Python, which uses urllib3. I inspected the root cause via regression testing, and I found that the root cause was a change introduced in urllib3.</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-python" data-lang="python"><span style="display:flex;"><span><span style="color:#f92672">import</span> requests </span></span><span style="display:flex;"><span>requests<span style="color:#f92672">.</span>get(<span style="color:#e6db74">&#34;http://127.0.0.1/../../../../doing/certain/check&#34;</span>) </span></span></code></pre></div><p>This should typically send the request to <code>/../../../../doing/certain/check</code>. Instead, it requests <code>/doing/certain/check</code> and modifies the specified input.</p> <p>The reason is dot-segment normalization, following RFC3986.</p> <p>The change to normalize URIs was introduced in this commit[1] to follow RFC3986[2]. The change is based on the &ldquo;Remove Dot Segments&rdquo; section in the RFC.</p>