From ff308a06047cd60806d604a7cf612e5656ee2ac9 Mon Sep 17 00:00:00 2001 From: Jake Howard Date: Wed, 29 May 2024 14:48:27 +0100 Subject: Fixed 35467 -- Replaced urlparse with urlsplit where appropriate. This work should not generate any change of functionality, and `urlsplit` is approximately 6x faster. Most use cases of `urlparse` didn't touch the path, so they can be converted to `urlsplit` without any issue. Most of those which do use `.path`, simply parse the URL, mutate the querystring, then put them back together, which is also fine (so long as urlunsplit is used). --- django/utils/http.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'django/utils/http.py') diff --git a/django/utils/http.py b/django/utils/http.py index 78dfee7fee..bf783562dd 100644 --- a/django/utils/http.py +++ b/django/utils/http.py @@ -6,7 +6,7 @@ from datetime import datetime, timezone from email.utils import formatdate from urllib.parse import quote, unquote from urllib.parse import urlencode as original_urlencode -from urllib.parse import urlparse +from urllib.parse import urlsplit from django.utils.datastructures import MultiValueDict from django.utils.regex_helper import _lazy_re_compile @@ -271,11 +271,11 @@ def url_has_allowed_host_and_scheme(url, allowed_hosts, require_https=False): def _url_has_allowed_host_and_scheme(url, allowed_hosts, require_https=False): # Chrome considers any URL with more than two slashes to be absolute, but - # urlparse is not so flexible. Treat any url with three slashes as unsafe. + # urlsplit is not so flexible. Treat any url with three slashes as unsafe. if url.startswith("///"): return False try: - url_info = urlparse(url) + url_info = urlsplit(url) except ValueError: # e.g. invalid IPv6 addresses return False # Forbid URLs like http:///example.com - with a scheme, but without a hostname. -- cgit v1.3