python,python3: Fix CVE-2019-9740 and CVE-2019-9947

These patches address issues: CVE-2019-9740: Python urllib CRLF injection vulnerability CVE-2019-9947: Header Injection in urllib Links to Python issues: https://bugs.python.org/issue36276 (resolved duplicated of 30458) https://bugs.python.org/issue35906 (resolved duplicated of 30458) https://bugs.python.org/issue30458 Issue 30458 is still currently open, waiting for a decision for Python 3.5; these patches for Python 2.7 and 3.7 have been merged. Signed-off-by: Jeffery To <jeffery.to@gmail.com>
5 years ago · 9331fbb1a0
--- a/lang/python/python/Makefile
+++ b/lang/python/python/Makefile
@ -12,7 +12,7 @@ include ../python-version.mk

 PKG_NAME:=python
 PKG_VERSION:=$(PYTHON_VERSION).$(PYTHON_VERSION_MICRO)
 PKG_RELEASE:=5
 PKG_RELEASE:=6

 PKG_SOURCE:=Python-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://www.python.org/ftp/python/$(PKG_VERSION)
--- a/lang/python/python/patches/022-bpo-30458-Disallow-control-chars-in-http-URLs-GH-13315.patch
+++ b/lang/python/python/patches/022-bpo-30458-Disallow-control-chars-in-http-URLs-GH-13315.patch
@ -0,0 +1,365 @@
 From 8af9afdb2938f3d993eaea549c7bc5fbe75bb7e7 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
 Date: Tue, 7 May 2019 17:28:47 +0200
 Subject: [PATCH 1/2] bpo-30458: Disallow control chars in http URLs.
 (GH-12755) (GH-13154)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit

 Disallow control chars in http URLs in urllib2.urlopen.  This
 addresses a potential security problem for applications that do not
 sanity check their URLs where http request headers could be injected.

 Disable https related urllib tests on a build without ssl (GH-13032)
 These tests require an SSL enabled build. Skip these tests when
 python is built without SSL to fix test failures.

 Use httplib.InvalidURL instead of ValueError as the new error case's
 exception. (GH-13044)

 Backport Co-Authored-By: Miro Hrončok <miro@hroncok.cz>

 (cherry picked from commit 7e200e0763f5b71c199aaf98bd5588f291585619)

 Notes on backport to Python 2.7:

 * test_urllib tests urllib.urlopen() which quotes the URL and so is
  not vulerable to HTTP Header Injection.
 * Add tests to test_urllib2 on urllib2.urlopen().
 * Reject non-ASCII characters: range 0x80-0xff.
 ---
 Lib/httplib.py                                | 16 +++++
 Lib/test/test_urllib.py                       | 31 +++++++++
 Lib/test/test_urllib2.py                      | 63 ++++++++++++++++---
 Lib/test/test_xmlrpc.py                       |  8 ++-
 .../2019-04-10-08-53-30.bpo-30458.51E-DA.rst  |  1 +
 5 files changed, 111 insertions(+), 8 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst

 diff --git a/Lib/httplib.py b/Lib/httplib.py
 index 60a8fb4e355f..1b41c346e090 100644
 --- a/Lib/httplib.py
 +++ b/Lib/httplib.py
@@ -247,6 +247,16 @@
 _is_legal_header_name = re.compile(r'\A[^:\s][^:\r\n]*\Z').match
 _is_illegal_header_value = re.compile(r'\n(?![ \t])|\r(?![ \t\n])').search
 
 +# These characters are not allowed within HTTP URL paths.
 +#  See https://tools.ietf.org/html/rfc3986#section-3.3 and the
 +#  https://tools.ietf.org/html/rfc3986#appendix-A pchar definition.
 +# Prevents CVE-2019-9740.  Includes control characters such as \r\n.
 +# Restrict non-ASCII characters above \x7f (0x80-0xff).
 +_contains_disallowed_url_pchar_re = re.compile('[\x00-\x20\x7f-\xff]')
 +# Arguably only these _should_ allowed:
 +#  _is_allowed_url_pchars_re = re.compile(r"^[/!$&'()*+,;=:@%a-zA-Z0-9._~-]+$")
 +# We are more lenient for assumed real world compatibility purposes.
 +
 # We always set the Content-Length header for these methods because some
 # servers will otherwise respond with a 411
 _METHODS_EXPECTING_BODY = {'PATCH', 'POST', 'PUT'}
@@ -927,6 +937,12 @@ def putrequest(self, method, url, skip_host=0, skip_accept_encoding=0):
         self._method = method
         if not url:
             url = '/'
 +        # Prevent CVE-2019-9740.
 +        match = _contains_disallowed_url_pchar_re.search(url)
 +        if match:
 +            raise InvalidURL("URL can't contain control characters. %r "
 +                             "(found at least %r)"
 +                             % (url, match.group()))
         hdr = '%s %s %s' % (method, url, self._http_vsn_str)
 
         self._output(hdr)
 diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py
 index 1ce9201c0693..bdc6e78f8678 100644
 --- a/Lib/test/test_urllib.py
 +++ b/Lib/test/test_urllib.py
@@ -9,6 +9,10 @@
 import sys
 import mimetools
 import tempfile
 +try:
 +    import ssl
 +except ImportError:
 +    ssl = None
 
 from test import test_support
 from base64 import b64encode
@@ -257,6 +261,33 @@ def test_url_fragment(self):
         finally:
             self.unfakehttp()
 
 +    @unittest.skipUnless(ssl, "ssl module required")
 +    def test_url_with_control_char_rejected(self):
 +        for char_no in range(0, 0x21) + range(0x7f, 0x100):
 +            char = chr(char_no)
 +            schemeless_url = "//localhost:7777/test%s/" % char
 +            self.fakehttp(b"HTTP/1.1 200 OK\r\n\r\nHello.")
 +            try:
 +                # urllib quotes the URL so there is no injection.
 +                resp = urllib.urlopen("http:" + schemeless_url)
 +                self.assertNotIn(char, resp.geturl())
 +            finally:
 +                self.unfakehttp()
 +
 +    @unittest.skipUnless(ssl, "ssl module required")
 +    def test_url_with_newline_header_injection_rejected(self):
 +        self.fakehttp(b"HTTP/1.1 200 OK\r\n\r\nHello.")
 +        host = "localhost:7777?a=1 HTTP/1.1\r\nX-injected: header\r\nTEST: 123"
 +        schemeless_url = "//" + host + ":8080/test/?test=a"
 +        try:
 +            # urllib quotes the URL so there is no injection.
 +            resp = urllib.urlopen("http:" + schemeless_url)
 +            self.assertNotIn(' ', resp.geturl())
 +            self.assertNotIn('\r', resp.geturl())
 +            self.assertNotIn('\n', resp.geturl())
 +        finally:
 +            self.unfakehttp()
 +
     def test_read_bogus(self):
         # urlopen() should raise IOError for many error codes.
         self.fakehttp('''HTTP/1.1 401 Authentication Required
 diff --git a/Lib/test/test_urllib2.py b/Lib/test/test_urllib2.py
 index 6d24d5ddf83c..d13f86f68bae 100644
 --- a/Lib/test/test_urllib2.py
 +++ b/Lib/test/test_urllib2.py
@@ -1,5 +1,5 @@
 import unittest
 -from test import test_support
 +from test import support
 from test import test_urllib
 
 import os
@@ -15,6 +15,9 @@
 except ImportError:
     ssl = None
 
 +from test.test_urllib import FakeHTTPMixin
 +
 +
 # XXX
 # Request
 # CacheFTPHandler (hard to write)
@@ -683,7 +686,7 @@ def test_file(self):
         h = urllib2.FileHandler()
         o = h.parent = MockOpener()
 
 -        TESTFN = test_support.TESTFN
 +        TESTFN = support.TESTFN
         urlpath = sanepathname2url(os.path.abspath(TESTFN))
         towrite = "hello, world\n"
         urls = [
@@ -1154,7 +1157,7 @@ def test_basic_auth_with_unquoted_realm(self):
         opener.add_handler(auth_handler)
         opener.add_handler(http_handler)
         msg = "Basic Auth Realm was unquoted"
 -        with test_support.check_warnings((msg, UserWarning)):
 +        with support.check_warnings((msg, UserWarning)):
             self._test_basic_auth(opener, auth_handler, "Authorization",
                                   realm, http_handler, password_manager,
                                   "http://acme.example.com/protected",
@@ -1262,7 +1265,7 @@ def _test_basic_auth(self, opener, auth_handler, auth_header,
         self.assertEqual(len(http_handler.requests), 1)
         self.assertFalse(http_handler.requests[0].has_header(auth_header))
 
 -class MiscTests(unittest.TestCase):
 +class MiscTests(unittest.TestCase, FakeHTTPMixin):
 
     def test_build_opener(self):
         class MyHTTPHandler(urllib2.HTTPHandler): pass
@@ -1317,6 +1320,52 @@ def test_unsupported_algorithm(self):
             "Unsupported digest authentication algorithm 'invalid'"
         )
 
 +    @unittest.skipUnless(ssl, "ssl module required")
 +    def test_url_with_control_char_rejected(self):
 +        for char_no in range(0, 0x21) + range(0x7f, 0x100):
 +            char = chr(char_no)
 +            schemeless_url = "//localhost:7777/test%s/" % char
 +            self.fakehttp(b"HTTP/1.1 200 OK\r\n\r\nHello.")
 +            try:
 +                # We explicitly test urllib.request.urlopen() instead of the top
 +                # level 'def urlopen()' function defined in this... (quite ugly)
 +                # test suite.  They use different url opening codepaths.  Plain
 +                # urlopen uses FancyURLOpener which goes via a codepath that
 +                # calls urllib.parse.quote() on the URL which makes all of the
 +                # above attempts at injection within the url _path_ safe.
 +                escaped_char_repr = repr(char).replace('\\', r'\\')
 +                InvalidURL = httplib.InvalidURL
 +                with self.assertRaisesRegexp(
 +                    InvalidURL, "contain control.*" + escaped_char_repr):
 +                    urllib2.urlopen("http:" + schemeless_url)
 +                with self.assertRaisesRegexp(
 +                    InvalidURL, "contain control.*" + escaped_char_repr):
 +                    urllib2.urlopen("https:" + schemeless_url)
 +            finally:
 +                self.unfakehttp()
 +
 +    @unittest.skipUnless(ssl, "ssl module required")
 +    def test_url_with_newline_header_injection_rejected(self):
 +        self.fakehttp(b"HTTP/1.1 200 OK\r\n\r\nHello.")
 +        host = "localhost:7777?a=1 HTTP/1.1\r\nX-injected: header\r\nTEST: 123"
 +        schemeless_url = "//" + host + ":8080/test/?test=a"
 +        try:
 +            # We explicitly test urllib.request.urlopen() instead of the top
 +            # level 'def urlopen()' function defined in this... (quite ugly)
 +            # test suite.  They use different url opening codepaths.  Plain
 +            # urlopen uses FancyURLOpener which goes via a codepath that
 +            # calls urllib.parse.quote() on the URL which makes all of the
 +            # above attempts at injection within the url _path_ safe.
 +            InvalidURL = httplib.InvalidURL
 +            with self.assertRaisesRegexp(
 +                InvalidURL, r"contain control.*\\r.*(found at least . .)"):
 +                urllib2.urlopen("http:" + schemeless_url)
 +            with self.assertRaisesRegexp(InvalidURL, r"contain control.*\\n"):
 +                urllib2.urlopen("https:" + schemeless_url)
 +        finally:
 +            self.unfakehttp()
 +
 +
 
 class RequestTests(unittest.TestCase):
 
@@ -1412,14 +1461,14 @@ def test_HTTPError_interface_call(self):
 
 def test_main(verbose=None):
     from test import test_urllib2
 -    test_support.run_doctest(test_urllib2, verbose)
 -    test_support.run_doctest(urllib2, verbose)
 +    support.run_doctest(test_urllib2, verbose)
 +    support.run_doctest(urllib2, verbose)
     tests = (TrivialTests,
              OpenerDirectorTests,
              HandlerTests,
              MiscTests,
              RequestTests)
 -    test_support.run_unittest(*tests)
 +    support.run_unittest(*tests)
 
 if __name__ == "__main__":
     test_main(verbose=True)
 diff --git a/Lib/test/test_xmlrpc.py b/Lib/test/test_xmlrpc.py
 index 36b3be67fd6b..90ccb30716ff 100644
 --- a/Lib/test/test_xmlrpc.py
 +++ b/Lib/test/test_xmlrpc.py
@@ -659,7 +659,13 @@ def test_dotted_attribute(self):
     def test_partial_post(self):
         # Check that a partial POST doesn't make the server loop: issue #14001.
         conn = httplib.HTTPConnection(ADDR, PORT)
 -        conn.request('POST', '/RPC2 HTTP/1.0\r\nContent-Length: 100\r\n\r\nbye')
 +        conn.send('POST /RPC2 HTTP/1.0\r\n'
 +                  'Content-Length: 100\r\n\r\n'
 +                  'bye HTTP/1.1\r\n'
 +                  'Host: %s:%s\r\n'
 +                  'Accept-Encoding: identity\r\n'
 +                  'Content-Length: 0\r\n\r\n'
 +                  % (ADDR, PORT))
         conn.close()
 
 class SimpleServerEncodingTestCase(BaseServerTestCase):
 diff --git a/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst b/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst
 new file mode 100644
 index 000000000000..47cb899df1af
 --- /dev/null
 +++ b/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst
@@ -0,0 +1 @@
 +Address CVE-2019-9740 by disallowing URL paths with embedded whitespace or control characters through into the underlying http client request.  Such potentially malicious header injection URLs now cause an httplib.InvalidURL exception to be raised.

 From 9f8ae2a2e4b836fe3136e84e55b8de62cb40904f Mon Sep 17 00:00:00 2001
 From: Victor Stinner <vstinner@redhat.com>
 Date: Mon, 20 May 2019 16:53:15 +0200
 Subject: [PATCH 2/2] Address Gregory's comments

 ---
 Lib/test/test_urllib.py  |  6 ------
 Lib/test/test_urllib2.py | 14 +++++++-------
 2 files changed, 7 insertions(+), 13 deletions(-)

 diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py
 index bdc6e78f8678..d7778d4194f3 100644
 --- a/Lib/test/test_urllib.py
 +++ b/Lib/test/test_urllib.py
@@ -9,10 +9,6 @@
 import sys
 import mimetools
 import tempfile
 -try:
 -    import ssl
 -except ImportError:
 -    ssl = None
 
 from test import test_support
 from base64 import b64encode
@@ -261,7 +257,6 @@ def test_url_fragment(self):
         finally:
             self.unfakehttp()
 
 -    @unittest.skipUnless(ssl, "ssl module required")
     def test_url_with_control_char_rejected(self):
         for char_no in range(0, 0x21) + range(0x7f, 0x100):
             char = chr(char_no)
@@ -274,7 +269,6 @@ def test_url_with_control_char_rejected(self):
             finally:
                 self.unfakehttp()
 
 -    @unittest.skipUnless(ssl, "ssl module required")
     def test_url_with_newline_header_injection_rejected(self):
         self.fakehttp(b"HTTP/1.1 200 OK\r\n\r\nHello.")
         host = "localhost:7777?a=1 HTTP/1.1\r\nX-injected: header\r\nTEST: 123"
 diff --git a/Lib/test/test_urllib2.py b/Lib/test/test_urllib2.py
 index d13f86f68bae..9531818e16b2 100644
 --- a/Lib/test/test_urllib2.py
 +++ b/Lib/test/test_urllib2.py
@@ -1,5 +1,5 @@
 import unittest
 -from test import support
 +from test import test_support
 from test import test_urllib
 
 import os
@@ -686,7 +686,7 @@ def test_file(self):
         h = urllib2.FileHandler()
         o = h.parent = MockOpener()
 
 -        TESTFN = support.TESTFN
 +        TESTFN = test_support.TESTFN
         urlpath = sanepathname2url(os.path.abspath(TESTFN))
         towrite = "hello, world\n"
         urls = [
@@ -1157,7 +1157,7 @@ def test_basic_auth_with_unquoted_realm(self):
         opener.add_handler(auth_handler)
         opener.add_handler(http_handler)
         msg = "Basic Auth Realm was unquoted"
 -        with support.check_warnings((msg, UserWarning)):
 +        with test_support.check_warnings((msg, UserWarning)):
             self._test_basic_auth(opener, auth_handler, "Authorization",
                                   realm, http_handler, password_manager,
                                   "http://acme.example.com/protected",
@@ -1350,7 +1350,7 @@ def test_url_with_newline_header_injection_rejected(self):
         host = "localhost:7777?a=1 HTTP/1.1\r\nX-injected: header\r\nTEST: 123"
         schemeless_url = "//" + host + ":8080/test/?test=a"
         try:
 -            # We explicitly test urllib.request.urlopen() instead of the top
 +            # We explicitly test urllib2.urlopen() instead of the top
             # level 'def urlopen()' function defined in this... (quite ugly)
             # test suite.  They use different url opening codepaths.  Plain
             # urlopen uses FancyURLOpener which goes via a codepath that
@@ -1461,14 +1461,14 @@ def test_HTTPError_interface_call(self):
 
 def test_main(verbose=None):
     from test import test_urllib2
 -    support.run_doctest(test_urllib2, verbose)
 -    support.run_doctest(urllib2, verbose)
 +    test_support.run_doctest(test_urllib2, verbose)
 +    test_support.run_doctest(urllib2, verbose)
     tests = (TrivialTests,
              OpenerDirectorTests,
              HandlerTests,
              MiscTests,
              RequestTests)
 -    support.run_unittest(*tests)
 +    test_support.run_unittest(*tests)
 
 if __name__ == "__main__":
     test_main(verbose=True)
--- a/lang/python/python3/Makefile
+++ b/lang/python/python3/Makefile
@ -14,7 +14,7 @@ PYTHON_VERSION:=$(PYTHON3_VERSION)
 PYTHON_VERSION_MICRO:=$(PYTHON3_VERSION_MICRO)

 PKG_NAME:=python3
 PKG_RELEASE:=11
 PKG_RELEASE:=12
 PKG_VERSION:=$(PYTHON_VERSION).$(PYTHON_VERSION_MICRO)

 PKG_SOURCE:=Python-$(PKG_VERSION).tar.xz
--- a/lang/python/python3/patches/022-bpo-30458-Disallow-control-chars-in-http-URLs-GH-13154.patch
+++ b/lang/python/python3/patches/022-bpo-30458-Disallow-control-chars-in-http-URLs-GH-13154.patch
@ -0,0 +1,146 @@
 From 233e3211cfdcca7310e25529e9115fbaddf47cca Mon Sep 17 00:00:00 2001
 From: "Gregory P. Smith" <greg@krypto.org>
 Date: Tue, 30 Apr 2019 19:12:21 -0700
 Subject: [PATCH] bpo-30458: Disallow control chars in http URLs. (GH-12755)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit

 Disallow control chars in http URLs in urllib.urlopen.  This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected.

 Disable https related urllib tests on a build without ssl (GH-13032)
 These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures.

 Use http.client.InvalidURL instead of ValueError as the new error case's exception. (GH-13044)

 Co-Authored-By: Miro Hrončok <miro@hroncok.cz>
 ---
 Lib/http/client.py                            | 15 ++++++
 Lib/test/test_urllib.py                       | 53 +++++++++++++++++++
 Lib/test/test_xmlrpc.py                       |  7 ++-
 .../2019-04-10-08-53-30.bpo-30458.51E-DA.rst  |  1 +
 4 files changed, 75 insertions(+), 1 deletion(-)
 create mode 100644 Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst

 diff --git a/Lib/http/client.py b/Lib/http/client.py
 index 1de151c38e92..2afd452fe30f 100644
 --- a/Lib/http/client.py
 +++ b/Lib/http/client.py
@@ -140,6 +140,16 @@
 _is_legal_header_name = re.compile(rb'[^:\s][^:\r\n]*').fullmatch
 _is_illegal_header_value = re.compile(rb'\n(?![ \t])|\r(?![ \t\n])').search
 
 +# These characters are not allowed within HTTP URL paths.
 +#  See https://tools.ietf.org/html/rfc3986#section-3.3 and the
 +#  https://tools.ietf.org/html/rfc3986#appendix-A pchar definition.
 +# Prevents CVE-2019-9740.  Includes control characters such as \r\n.
 +# We don't restrict chars above \x7f as putrequest() limits us to ASCII.
 +_contains_disallowed_url_pchar_re = re.compile('[\x00-\x20\x7f]')
 +# Arguably only these _should_ allowed:
 +#  _is_allowed_url_pchars_re = re.compile(r"^[/!$&'()*+,;=:@%a-zA-Z0-9._~-]+$")
 +# We are more lenient for assumed real world compatibility purposes.
 +
 # We always set the Content-Length header for these methods because some
 # servers will otherwise respond with a 411
 _METHODS_EXPECTING_BODY = {'PATCH', 'POST', 'PUT'}
@@ -1101,6 +1111,11 @@ def putrequest(self, method, url, skip_host=False,
         self._method = method
         if not url:
             url = '/'
 +        # Prevent CVE-2019-9740.
 +        match = _contains_disallowed_url_pchar_re.search(url)
 +        if match:
 +            raise InvalidURL(f"URL can't contain control characters. {url!r} "
 +                             f"(found at least {match.group()!r})")
         request = '%s %s %s' % (method, url, self._http_vsn_str)
 
         # Non-ASCII characters should have been eliminated earlier
 diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py
 index 2ac73b58d832..7214492eca9d 100644
 --- a/Lib/test/test_urllib.py
 +++ b/Lib/test/test_urllib.py
@@ -329,6 +329,59 @@ def test_willclose(self):
         finally:
             self.unfakehttp()
 
 +    @unittest.skipUnless(ssl, "ssl module required")
 +    def test_url_with_control_char_rejected(self):
 +        for char_no in list(range(0, 0x21)) + [0x7f]:
 +            char = chr(char_no)
 +            schemeless_url = f"//localhost:7777/test{char}/"
 +            self.fakehttp(b"HTTP/1.1 200 OK\r\n\r\nHello.")
 +            try:
 +                # We explicitly test urllib.request.urlopen() instead of the top
 +                # level 'def urlopen()' function defined in this... (quite ugly)
 +                # test suite.  They use different url opening codepaths.  Plain
 +                # urlopen uses FancyURLOpener which goes via a codepath that
 +                # calls urllib.parse.quote() on the URL which makes all of the
 +                # above attempts at injection within the url _path_ safe.
 +                escaped_char_repr = repr(char).replace('\\', r'\\')
 +                InvalidURL = http.client.InvalidURL
 +                with self.assertRaisesRegex(
 +                    InvalidURL, f"contain control.*{escaped_char_repr}"):
 +                    urllib.request.urlopen(f"http:{schemeless_url}")
 +                with self.assertRaisesRegex(
 +                    InvalidURL, f"contain control.*{escaped_char_repr}"):
 +                    urllib.request.urlopen(f"https:{schemeless_url}")
 +                # This code path quotes the URL so there is no injection.
 +                resp = urlopen(f"http:{schemeless_url}")
 +                self.assertNotIn(char, resp.geturl())
 +            finally:
 +                self.unfakehttp()
 +
 +    @unittest.skipUnless(ssl, "ssl module required")
 +    def test_url_with_newline_header_injection_rejected(self):
 +        self.fakehttp(b"HTTP/1.1 200 OK\r\n\r\nHello.")
 +        host = "localhost:7777?a=1 HTTP/1.1\r\nX-injected: header\r\nTEST: 123"
 +        schemeless_url = "//" + host + ":8080/test/?test=a"
 +        try:
 +            # We explicitly test urllib.request.urlopen() instead of the top
 +            # level 'def urlopen()' function defined in this... (quite ugly)
 +            # test suite.  They use different url opening codepaths.  Plain
 +            # urlopen uses FancyURLOpener which goes via a codepath that
 +            # calls urllib.parse.quote() on the URL which makes all of the
 +            # above attempts at injection within the url _path_ safe.
 +            InvalidURL = http.client.InvalidURL
 +            with self.assertRaisesRegex(
 +                InvalidURL, r"contain control.*\\r.*(found at least . .)"):
 +                urllib.request.urlopen(f"http:{schemeless_url}")
 +            with self.assertRaisesRegex(InvalidURL, r"contain control.*\\n"):
 +                urllib.request.urlopen(f"https:{schemeless_url}")
 +            # This code path quotes the URL so there is no injection.
 +            resp = urlopen(f"http:{schemeless_url}")
 +            self.assertNotIn(' ', resp.geturl())
 +            self.assertNotIn('\r', resp.geturl())
 +            self.assertNotIn('\n', resp.geturl())
 +        finally:
 +            self.unfakehttp()
 +
     def test_read_0_9(self):
         # "0.9" response accepted (but not "simple responses" without
         # a status line)
 diff --git a/Lib/test/test_xmlrpc.py b/Lib/test/test_xmlrpc.py
 index 32263f7f0b3b..0e002ec4ef9f 100644
 --- a/Lib/test/test_xmlrpc.py
 +++ b/Lib/test/test_xmlrpc.py
@@ -945,7 +945,12 @@ def test_unicode_host(self):
     def test_partial_post(self):
         # Check that a partial POST doesn't make the server loop: issue #14001.
         conn = http.client.HTTPConnection(ADDR, PORT)
 -        conn.request('POST', '/RPC2 HTTP/1.0\r\nContent-Length: 100\r\n\r\nbye')
 +        conn.send('POST /RPC2 HTTP/1.0\r\n'
 +                  'Content-Length: 100\r\n\r\n'
 +                  'bye HTTP/1.1\r\n'
 +                  f'Host: {ADDR}:{PORT}\r\n'
 +                  'Accept-Encoding: identity\r\n'
 +                  'Content-Length: 0\r\n\r\n'.encode('ascii'))
         conn.close()
 
     def test_context_manager(self):
 diff --git a/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst b/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst
 new file mode 100644
 index 000000000000..ed8027fb4d64
 --- /dev/null
 +++ b/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst
@@ -0,0 +1 @@
 +Address CVE-2019-9740 by disallowing URL paths with embedded whitespace or control characters through into the underlying http client request.  Such potentially malicious header injection URLs now cause an http.client.InvalidURL exception to be raised.