Urgent.News

What's breaking now, across thousands of outlets.

More in Tech

Which host is https://trusted@evil.com? Our approval screen and our provisioner disagreed

Which host does this URL point to? >>> from urllib.parse import urlsplit >>> u = " https://api.trusted-weather.com:443@evil.com/data " >>> urlsplit ( u ). netloc .

  • URL https://api.trusted-weather.com:443@evil.com/data has two host interpretations
  • Display path shows evil.com as host, provisioner shows api.trusted-weather.com
  • Vulnerability fixed July 30, 2023 with nine regression tests

More from Tuesday 6 October →