[Bug] Homepage URL inconsistencies and crash in urllib.parse.urlparse
Description
The URL validation of the homepage is less strict in FastAPI, allowing things like https://aa...
with longer domain names than is valid and other such nonsense. None of this is particularly harmful except for some cases that cause urlparse
from urllib.parse
to throw a ValueError
like unmatched []
that you see in IPv6 addresses. The valid_homepage
function should catch these and return False
disallowing them.
Reproduction
Try and set your Homepage URL on https://localhost:8444/account/uncoupling/edit to https://[
.
Logs
Traceback (most recent call last):
File "/aurweb/./aurweb/asgi.py", line 197, in add_security_headers
response = await util.error_or_result(call_next, request)
File "/aurweb/./aurweb/util.py", line 228, in error_or_result
response = await next(*args, **kwargs)
File "/usr/lib/python3.10/site-packages/starlette/middleware/base.py", line 44, in call_next
raise app_exc
File "/usr/lib/python3.10/site-packages/starlette/middleware/base.py", line 34, in coro
await self.app(scope, request.receive, send_stream.send)
File "/usr/lib/python3.10/site-packages/starlette/middleware/base.py", line 63, in __call__
response = await self.dispatch_func(request, call_next)
File "/usr/lib/python3.10/site-packages/prometheus_fastapi_instrumentator/instrumentation.py", line 172, in dispatch_middleware
raise e from None
File "/usr/lib/python3.10/site-packages/prometheus_fastapi_instrumentator/instrumentation.py", line 169, in dispatch_middleware
response = await call_next(request)
File "/usr/lib/python3.10/site-packages/starlette/middleware/base.py", line 44, in call_next
raise app_exc
File "/usr/lib/python3.10/site-packages/starlette/middleware/base.py", line 34, in coro
await self.app(scope, request.receive, send_stream.send)
File "/usr/lib/python3.10/site-packages/starlette/exceptions.py", line 82, in __call__
raise exc
File "/usr/lib/python3.10/site-packages/starlette/exceptions.py", line 71, in __call__
await self.app(scope, receive, sender)
File "/usr/lib/python3.10/site-packages/starlette/routing.py", line 656, in __call__
await route.handle(scope, receive, send)
File "/usr/lib/python3.10/site-packages/starlette/routing.py", line 259, in handle
await self.app(scope, receive, send)
File "/usr/lib/python3.10/site-packages/starlette/routing.py", line 61, in app
response = await func(request)
File "/usr/lib/python3.10/site-packages/fastapi/routing.py", line 226, in app
raw_response = await run_endpoint_function(
File "/usr/lib/python3.10/site-packages/fastapi/routing.py", line 159, in run_endpoint_function
return await dependant.call(**values)
File "/aurweb/./aurweb/auth/__init__.py", line 181, in wrapper
return await _auth_required(True)(func)(*args, **kwargs)
File "/aurweb/./aurweb/auth/__init__.py", line 151, in wrapper
return await func(request, *args, **kwargs)
File "/aurweb/./aurweb/routers/accounts.py", line 402, in account_edit_post
ok, errors = process_account_form(request, user, args)
File "/aurweb/./aurweb/routers/accounts.py", line 150, in process_account_form
check(**args, request=request, user=user, _=_)
File "/aurweb/./aurweb/users/validate.py", line 98, in invalid_homepage
if HP and not util.valid_homepage(HP):
File "/aurweb/./aurweb/util.py", line 66, in valid_homepage
parts = urlparse(homepage)
File "/usr/lib/python3.10/urllib/parse.py", line 393, in urlparse
splitresult = urlsplit(url, scheme, allow_fragments)
File "/usr/lib/python3.10/urllib/parse.py", line 484, in urlsplit
raise ValueError("Invalid IPv6 URL")
ValueError: Invalid IPv6 URL
Version(s)
FastAPI.