Skip to content

Commit baa4f73

Browse files
rodrigobnogueirarodrigobnogueira
committed
Add changelog fragment for PR 1659
1 parent d6e16e5 commit baa4f73

1 file changed

Lines changed: 5 additions & 0 deletions

File tree

‎CHANGES/1659.bugfix.rst‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
Raise :exc:`ValueError` when a URL's authority (netloc) component contains a
2+
backslash. Backslashes are not valid in the authority per :rfc:`3986` and create
3+
SSRF and ACL bypass vulnerabilities when yarl is used alongside WHATWG-compliant
4+
parsers that convert backslashes to forward slashes
5+
-- by :user:`rodrigobnogueira`.

0 commit comments

Comments
 (0)