Skip to content

Conversation

@serhiy-storchaka
Copy link
Member

@serhiy-storchaka serhiy-storchaka commented Aug 1, 2022

If an HTTP link is redirected to a same looking HTTPS link, the latter can
be used directly without changes in readability and behavior.
It protects from a men-in-the-middle attack.

This change does not affect Python examples. It is a different issue.

Changed the following URLs and their sub-URLs:

http://babel.pocoo.org
http://bugs.jython.org
http://bugs.python.org/issue12524
http://buildbot.python.org/3.7.stable
http://buildbot.python.org/3.8.stable
http://buildbot.python.org/3.9.stable
http://buildbot.python.org/3.x.stable
http://cwe.mitre.org/data/definitions/257.html
http://cython.org
http://en.wikipedia.org/wiki/Moving_average
http://flufli18n.readthedocs.io/en/latest
http://gnosis.cx/TPiP
http://hg.jcea.es/pybsddb/file/tip/ChangeLog
http://importlib-resources.readthedocs.io/en/latest
http://invisible-island.net/ncurses/ncurses.faq.html
http://invisible-island.net/ncurses/ncurses-intro.html
http://ironpython.net
http://jkorpela.fi/http.html
http://jkorpela.fi/unicode/guide.html
http://learning-python.com/about-pp4e.html
http://macvim-dev.github.io/macvim
http://man7.org/linux/man-pages/man2/getrandom.2.html
http://mathworld.wolfram.com/BinomialDistribution.html
http://packaging.python.org
http://pubs.opengroup.org/onlinepubs/009695399/functions/opendir.html
http://pubs.opengroup.org/onlinepubs/009695399/functions/readdir_r.html
http://pubs.opengroup.org/onlinepubs/7908799/xbd/envvar.html
http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap04.html
http://pypy.org
http://pytest.org
http://python-future.org
http://python.org
http://python-pillow.org
http://pyvideo.org/video/1768/the-guts-of-unicode-in-python
http://pyvideo.org/video/289/pycon-2010--mastering-python-3-i-o
http://pyyaml.org
http://schemers.org/Documents/Standards/R5RS/HTML/r5rs-Z-H-9.html
http://setuptools.readthedocs.io/en/latest/pkg_resources.html
http://svn.python.org
http://udrepper.livejournal.com/20407.html
http://ws.apache.org/xmlrpc/types.html
http://www.boost.org/libs/python/doc/index.html
http://www.bytereef.org/mpdecimal/quickstart.html
http://www.cwi.nl
http://www.defmacro.org/ramblings/fp.html
http://www.drdobbs.com
http://www.jsonrpc.org
http://www.jython.org
http://www.nuitka.net
http://www.openexr.com
http://www.openssl.org
http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1256.pdf
http://www.pypy.org
http://www.pysqlite.org
http://www.python.org
http://www.swig.org
http://www.tldp.org/HOWTO/XML-RPC-HOWTO/index.html
http://www.wide.ad.jp

…to HTTPS

If an HTTP link is redirected to a same looking HTTPS link, the latter can
be used directly without changes in readability and behavior.
It protects from a men-in-the-middle attack.

This change does not affect Python examples.
@serhiy-storchaka
Copy link
Member Author

@gvanrossum This change affects Doc/license.rst, so I ask a permission to do this. Or I can extract Doc/license.rst changes into a separate PR.

@serhiy-storchaka serhiy-storchaka merged commit f79547a into python:main Aug 4, 2022
@miss-islington
Copy link
Contributor

Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11.
🐍🍒⛏🤖

@miss-islington
Copy link
Contributor

Sorry, @serhiy-storchaka, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker f79547a429d5c90af83a0da821e082cba20d4712 3.11

@miss-islington
Copy link
Contributor

Sorry @serhiy-storchaka, I had trouble checking out the 3.10 backport branch.
Please backport using cherry_picker on command line.
cherry_picker f79547a429d5c90af83a0da821e082cba20d4712 3.10

@bedevere-bot
Copy link

GH-95643 is a backport of this pull request to the 3.11 branch.

serhiy-storchaka added a commit to serhiy-storchaka/cpython that referenced this pull request Aug 4, 2022
…direct to HTTPS (pythonGH-95527)

If an HTTP link is redirected to a same looking HTTPS link, the latter can
be used directly without changes in readability and behavior.
It protects from a men-in-the-middle attack.

This change does not affect Python examples..
(cherry picked from commit f79547a)

Co-authored-by: Serhiy Storchaka <[email protected]>
@bedevere-bot
Copy link

GH-95644 is a backport of this pull request to the 3.10 branch.

@bedevere-bot bedevere-bot removed the needs backport to 3.10 only security fixes label Aug 4, 2022
serhiy-storchaka added a commit to serhiy-storchaka/cpython that referenced this pull request Aug 4, 2022
…to HTTPS (pythonGH-95527)

If an HTTP link is redirected to a same looking HTTPS link, the latter can
be used directly without changes in readability and behavior.
It protects from a men-in-the-middle attack.

This change does not affect Python examples.
serhiy-storchaka added a commit to serhiy-storchaka/cpython that referenced this pull request Aug 4, 2022
…direct to HTTPS (pythonGH-95527)

If an HTTP link is redirected to a same looking HTTPS link, the latter can
be used directly without changes in readability and behavior.
It protects from a men-in-the-middle attack.

This change does not affect Python examples..
(cherry picked from commit f79547a)

Co-authored-by: Serhiy Storchaka <[email protected]>
serhiy-storchaka added a commit that referenced this pull request Aug 4, 2022
… to HTTPS (GH-95527) (GH-95643)

If an HTTP link is redirected to a same looking HTTPS link, the latter can
be used directly without changes in readability and behavior.
It protects from a men-in-the-middle attack.

This change does not affect Python examples..
(cherry picked from commit f79547a)

Co-authored-by: Serhiy Storchaka <[email protected]>
serhiy-storchaka added a commit that referenced this pull request Aug 4, 2022
… to HTTPS (GH-95527) (GH-95644)

If an HTTP link is redirected to a same looking HTTPS link, the latter can
be used directly without changes in readability and behavior.
It protects from a men-in-the-middle attack.

This change does not affect Python examples..
(cherry picked from commit f79547a)

Co-authored-by: Serhiy Storchaka <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

docs Documentation in the Doc dir skip news

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants