Skip to content

Unhandled exception (IndexError) in URL parsing #1485

@lenix123

Description

@lenix123

Please confirm the following

  • I understand this is open source software provided for free and that I might not receive a timely response.
  • I am positive I am NOT reporting a (potential) security
    vulnerability, to the best of my knowledge. (These must be shared by
    submitting this report form instead, if
    any hesitation exists.)
  • I am willing to submit a pull request with reporoducers as xfailing test cases or even entire fix. (Assign this issue to me.)

Describe the bug

We were fuzzing URL() parser and have found IndexError.

To Reproduce

  1. install yarl 1.18.3:
pip install --force-reinstall -v "yarl==1.18.3"
  1. reproduce IndexError:
from yarl import URL
URL("//]'z[")

Expected behavior

Parse string without an error

Logs/tracebacks

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python3.10/dist-packages/yarl/_url.py", line 355, in __new__
    return pre_encoded_url(val) if encoded else encode_url(val)
  File "/usr/local/lib/python3.10/dist-packages/yarl/_url.py", line 147, in encode_url
    scheme, netloc, path, query, fragment = split_url(url_str)
  File "/usr/local/lib/python3.10/dist-packages/yarl/_parse.py", line 72, in split_url
    if bracketed_host[0] == "v":
IndexError: string index out of range

Python Version

$ python --version
Python 3.10.12

multidict Version

$ python -m pip show multidict
Version: 6.2.0

propcache Version

$ python -m pip show propcache
Version: 0.3.0

yarl Version

$ python -m pip show yarl
Version: 1.18.3

OS

Ubuntu:22.04

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    Status

    Done

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions