Skip to content

Unhandled exception (IndexError) in URL parsing #1485

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
4 of 5 tasks
lenix123 opened this issue Mar 18, 2025 · 1 comment · May be fixed by #1512
Open
4 of 5 tasks

Unhandled exception (IndexError) in URL parsing #1485

lenix123 opened this issue Mar 18, 2025 · 1 comment · May be fixed by #1512

Comments

@lenix123
Copy link

Please confirm the following

  • I understand this is open source software provided for free and that I might not receive a timely response.
  • I am positive I am NOT reporting a (potential) security
    vulnerability, to the best of my knowledge. (These must be shared by
    submitting this report form instead, if
    any hesitation exists.)
  • I am willing to submit a pull request with reporoducers as xfailing test cases or even entire fix. (Assign this issue to me.)

Describe the bug

We were fuzzing URL() parser and have found IndexError.

To Reproduce

  1. install yarl 1.18.3:
pip install --force-reinstall -v "yarl==1.18.3"
  1. reproduce IndexError:
from yarl import URL
URL("//]'z[")

Expected behavior

Parse string without an error

Logs/tracebacks

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python3.10/dist-packages/yarl/_url.py", line 355, in __new__
    return pre_encoded_url(val) if encoded else encode_url(val)
  File "/usr/local/lib/python3.10/dist-packages/yarl/_url.py", line 147, in encode_url
    scheme, netloc, path, query, fragment = split_url(url_str)
  File "/usr/local/lib/python3.10/dist-packages/yarl/_parse.py", line 72, in split_url
    if bracketed_host[0] == "v":
IndexError: string index out of range

Python Version

$ python --version
Python 3.10.12

multidict Version

$ python -m pip show multidict
Version: 6.2.0

propcache Version

$ python -m pip show propcache
Version: 0.3.0

yarl Version

$ python -m pip show yarl
Version: 1.18.3

OS

Ubuntu:22.04

Additional context

No response

@webknjaz
Copy link
Member

Expected behavior

Parse string without an error

FTR, I think this expectation is incorrect, and the behavior should be raising a ValueError which #1512 attempts to implement. @lenix123 or do you have a justification for it to being parsed in a specific way?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Development

Successfully merging a pull request may close this issue.

3 participants