Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package vlang for openSUSE:Factory checked in at 2026-08-09 21:42:09 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/vlang (Old) and /work/SRC/openSUSE:Factory/.vlang.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "vlang" Sun Aug 9 21:42:09 2026 rev:8 rq:1370279 version:0.5.2 Changes: -------- --- /work/SRC/openSUSE:Factory/vlang/vlang.changes 2026-07-18 22:26:25.276975996 +0200 +++ /work/SRC/openSUSE:Factory/.vlang.new.16738/vlang.changes 2026-08-09 21:45:07.094278652 +0200 @@ -1,0 +2,8 @@ +Fri Aug 7 20:01:37 UTC 2026 - Eyad Issa <[email protected]> + +- CVE-2026-67201: vlang: server-side request forgery bypass flaw + allows circumvention of host-based allowlists due to a parser + differential between `net.urllib` and `net.http` (bsc#1273139) + * 0006-net-urllib-reject-backslashes.patch + +------------------------------------------------------------------- New: ---- 0006-net-urllib-reject-backslashes.patch ----------(New B)---------- New: differential between `net.urllib` and `net.http` (bsc#1273139) * 0006-net-urllib-reject-backslashes.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ vlang.spec ++++++ --- /var/tmp/diff_new_pack.pk2it5/_old 2026-08-09 21:45:07.826303640 +0200 +++ /var/tmp/diff_new_pack.pk2it5/_new 2026-08-09 21:45:07.830303776 +0200 @@ -40,6 +40,7 @@ Patch3: 0003-Unbundle-cJSON-and-zstd.patch Patch4: 0004-Fix-cJSON_GetErrorPos-undefined-reference.patch Patch5: 0005-Force-system-libgc-on-Linux.patch +Patch6: 0006-net-urllib-reject-backslashes.patch BuildRequires: (c_compiler or gcc) BuildRequires: diffutils ++++++ 0006-net-urllib-reject-backslashes.patch ++++++ >From 85859f0f3498d4091b38009c45ed390a97eeedc2 Mon Sep 17 00:00:00 2001 From: Alexander Medvednikov <[email protected]> Date: Sun, 26 Jul 2026 22:14:39 +0300 Subject: [PATCH] net.urllib: reject backslashes in URL authorities (#27947) --- vlib/net/urllib/urllib.v | 6 +++--- vlib/net/urllib/urllib_test.v | 21 +++++++++++++++++++++ 2 files changed, 24 insertions(+), 3 deletions(-) diff --git a/vlib/net/urllib/urllib.v b/vlib/net/urllib/urllib.v index 77d9d70645cd38..822d9a462359b9 100644 --- a/vlib/net/urllib/urllib.v +++ b/vlib/net/urllib/urllib.v @@ -51,7 +51,7 @@ fn should_escape(c u8, mode EncodingMode) bool { // we could possibly allow, and parse will reject them if we // escape them (because hosts can`t use %-encoding for // ASCII bytes). - if c in [`!`, `$`, `&`, `\\`, `(`, `)`, `*`, `+`, `,`, `;`, `=`, `:`, `[`, `]`, `<`, `>`, + if c in [`!`, `$`, `&`, `'`, `(`, `)`, `*`, `+`, `,`, `;`, `=`, `:`, `[`, `]`, `<`, `>`, `"`] { return false } @@ -203,7 +203,7 @@ fn unescape(s_ string, mode EncodingMode) !string { else { if (mode == .encode_host || mode == .encode_zone) && s[i] < 0x80 && should_escape(s[i], mode) { - error(error_msg('unescape: invalid character in host name', s[i..i + 1])) + return error(error_msg('unescape: invalid character in host name', s[i..i + 1])) } i++ } @@ -1025,7 +1025,7 @@ pub fn valid_userinfo(s string) bool { continue } match r { - `-`, `.`, `_`, `:`, `~`, `!`, `$`, `&`, `\\`, `(`, `)`, `*`, `+`, `,`, `;`, `=`, `%`, + `-`, `.`, `_`, `:`, `~`, `!`, `$`, `&`, `'`, `(`, `)`, `*`, `+`, `,`, `;`, `=`, `%`, `@` { continue } diff --git a/vlib/net/urllib/urllib_test.v b/vlib/net/urllib/urllib_test.v index cba5b6cba1c004..9b31cf11b78e0a 100644 --- a/vlib/net/urllib/urllib_test.v +++ b/vlib/net/urllib/urllib_test.v @@ -140,6 +140,27 @@ fn test_parse_authority() { } } +fn test_parse_rejects_backslash_in_authority() { + invalid_urls := [ + r'http://127.0.0.1\@google.com/', + r'http://[email protected]\path', + r'http://google.com\path', + ] + for url in invalid_urls { + if _ := urllib.parse(url) { + assert false, 'parser must reject "${url}"' + } + } +} + +fn test_parse_allows_apostrophe_in_authority() { + url := urllib.parse("http://o'connor@example'host/")! + assert url.host == "example'host" + if user := url.user { + assert user.username == "o'connor" + } +} + fn test_parse_slashes() { assert urllib.parse('/')!.str() == '/' assert urllib.parse('//')!.str() == '//'
