urllib.parse doesn't fully comply to RFC 3986

[The-Compiler]

BPO	34360
Nosy	@orsenthil, @The-Compiler, @native-api, @howinator, @RJ722, @tirkarthi, @websurfer5

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2018-08-08.16:02:35.342>
labels = ['3.7', '3.8', 'type-bug', 'library']
title = "urllib.parse doesn't fully comply to RFC 3986"
updated_at = <Date 2020-08-07.06:49:54.821>
user = 'https://github.com/The-Compiler'

bugs.python.org fields:

activity = <Date 2020-08-07.06:49:54.821>
actor = 'Jeffrey.Kintscher'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2018-08-08.16:02:35.342>
creator = 'The Compiler'
dependencies = []
files = []
hgrepos = []
issue_num = 34360
keywords = []
message_count = 2.0
messages = ['323292', '323362']
nosy_count = 7.0
nosy_names = ['orsenthil', 'The Compiler', 'Ivan.Pozdeev', 'Howie Benefiel', 'RJ722', 'xtreak', 'Jeffrey.Kintscher']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue34360'
versions = ['Python 3.6', 'Python 3.7', 'Python 3.8']

[The-Compiler]

Since bpo-29651, the urllib.parse docs say:

Unmatched square brackets in the netloc attribute will raise a ValueError.

However, when there are at least one [ and ], but they don't match, there's somewhat inconsistent behavior:

>>> urllib.parse.urlparse('http://[::1]]').hostname
'::1'
>>> urllib.parse.urlparse('http://[[::1]').hostname
'[::1'

[native-api]

I confirm violation of https://tools.ietf.org/html/rfc3986#section-3.2.2 .

URLs are now covered by RFC 3986 which obsoletes RFC 1808 that `urllib's documentation refers to.

This new URL RFC adds [] to 'reserved' characters, so them being present unquoted anywhere where reserved characters are not allowed shall be a parsing error.

[The-Compiler]

Looks like this has been fixed:

• [CVE-2025-0938] urlparse does not flag hostname *containing* [ or ] as incorrect #105704
• gh-105704: Disallow square brackets ([ and ]) in domain names for parsed URLs #129418

cc (and thanks!) @sethmlarson @ZeroIntensity

[picnixz]

I'm going to close this one then as completed.