urllib.request:AttributeError: 'dict' object has no attribute 'get_all' in http_error_auth_reqed function

@Fidget-Spinner

BPO	45572
Nosy	@Fidget-Spinner, @akulakov
PRs	gh-89735: documented headers param for urllib.request.http_error_auth_reqed() #30814
Files	3.7.4 hang on.png 3.7.4 fix Regex ok.png 3.7.12 fail.png 3.11.0a1 fail.png

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2021-10-22.13:35:34.228>
labels = ['type-bug', '3.8', '3.9', '3.10', '3.11', '3.7', 'library']
title = "urllib.request:AttributeError: 'dict' object has no attribute 'get_all' in http_error_auth_reqed function"
updated_at = <Date 2022-01-23.00:57:40.389>
user = 'https://bugs.python.org/sxt1001'

bugs.python.org fields:

activity = <Date 2022-01-23.00:57:40.389>
actor = 'vstinner'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2021-10-22.13:35:34.228>
creator = 'sxt1001'
dependencies = []
files = ['50386', '50387', '50388', '50389']
hgrepos = []
issue_num = 45572
keywords = ['patch']
message_count = 3.0
messages = ['404767', '406813', '411318']
nosy_count = 3.0
nosy_names = ['kj', 'andrei.avk', 'sxt1001']
pr_nums = ['30814']
priority = 'normal'
resolution = None
stage = 'patch review'
status = 'open'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue45572'
versions = ['Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10', 'Python 3.11']

Linked PRs

The python version I currently use in my development environment is 3.7.4. Using the following script, the program has never output, and seems to have entered an infinite loop.

To reproduce the issue we can use the following code:

from urllib.request import AbstractBasicAuthHandler
auth_handler = AbstractBasicAuthHandler()
header = {'www-authenticate': 'Basic ' + ',' * 64 + ' ' + 'foo' + ' ' +'realm'}
auth_handler.http_error_auth_reqed('www-authenticate','unused','unused',header)

So I tried to upgrade it to version 3.7.12, and the program will directly report an error. The information is as follows:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python3.7/urllib/request.py", line 990, in http_error_auth_reqed
    headers = headers.get_all(authreq)
AttributeError: 'dict' object has no attribute 'get_all'

This problem also exists when I upgrade Python 3 to 3.11.0a1. In Python version 3.7.4, the cause of program hang on seems to be a security vulnerability. Refer to https://bugs.python.org/issue39503. The reason for CVE is not the wrong type of headers. However, after repairing CVE, it seems that the type of headers is limited? For the CVE patch, I tried to only fix the part of the regular expression, and the program can run. So, after repairing CVE-2020-8492, what type should the headers parameter be for http_error_auth_reqed function? Based on the current code, how should I adapt and modify it to make it run normally?

gh-89735: Document requirements for the *headers* argument (GH-155640)

[3.13] gh-89735: Document requirements for the *headers* argument (GH…

[3.14] gh-89735: Document requirements for the *headers* argument (GH…

[3.15] gh-89735: Document requirements for the *headers* argument (GH…

pythongh-89735: Document requirements for the *headers* argument (pyt…

Navigation Menu

Repository navigation

urllib.request:AttributeError: 'dict' object has no attribute 'get_all' in http_error_auth_reqed function #89735

Linked PRs

9 remaining items

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

urllib.request:AttributeError: 'dict' object has no attribute 'get_all' in http_error_auth_reqed function #89735

Description

Linked PRs

Activity

sxt1001 commented on Oct 22, 2021

9 remaining items

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions