Python 3.6.2 corrects parsing at security boundaries

A parser used for a security decision has to identify the same structure as the code that later acts on the input. A hostname check is ineffective if one part of the program sees an address and another sees authentication syntax. Python 3.6.2 corrects one such ambiguity in urllib.parse.splithost(). The example in the release notes shows how a fragment delimiter can change the interpretation of an apparent host.

The release page dates Python 3.6.2 to July 17. The tagged NEWS file says the final release has no changes after its second candidate. That candidate includes security corrections for URL parsing and Windows subprocess handling, plus an update to the bundled Expat parser. These changes belong to the maintenance release itself, without requiring a new Python language series.

I place considerable weight on this part of Python maintenance. The standard library is often the reason a small program can communicate with other systems without much application code. That convenience also means a library's parsing rules can participate in a program's security policy.

A fragment delimiter changes the host interpretation

Issue 30500 gives the input //127.0.0.1#@evil.com/. The corrected splithost() recognizes 127.0.0.1 as the host. Previously, according to the NEWS entry, it treated @evil.com as the host in an authentication-style interpretation. The fragment marker appears before the at sign, so the parsing correction changes which part of the input counts as the authority being examined.

The practical concern is disagreement between interpretations of one string. A program might inspect a parsed host before deciding whether to permit an operation. If that inspection uses the wrong part of the input, its policy can apply to a different host from the one intended by the surrounding URL structure. The correction fixes this documented case in the parsing helper. It does not claim to supply a complete access-control policy for every URL-consuming application.

This is also why the position of punctuation matters more than its mere presence. Rejecting or accepting a string based on whether it contains an at sign would not express the structural rule involved. The parser has to understand where the fragment begins. The release's concrete input is more informative than describing the change simply as stronger URL validation.

Process environments are structured input too

Issue 30730 prevents environment-variable injection in Windows subprocess handling. The NEWS entry says the correction prevents passing other environment variables and command arguments. A child process receives configuration through an operating-system interface, so the conversion from Python data to that interface must preserve the intended separation of values.

The scope matters. The release identifies a Windows subprocess correction, not a change that makes arbitrary commands safe on every platform. Application code still chooses the executable and its inputs. This fix concerns the library's handling of the supplied process environment and the possibility of representing additional data through that handling.

These two security entries concern different APIs but share a concrete requirement. A structured value supplied to an API must retain its intended boundaries when the implementation interprets or transmits it. A hostname should not become authentication syntax because of a misplaced parsing boundary, and a process-environment value should not become another environment entry or command input.

Bundled parser maintenance reaches Python applications

The second candidate updates the Expat copy from 2.2.0 to 2.2.1. The release notes name several security fixes, including CVE-2017-9233, an external-entity infinite-loop denial of service. They also list integer-overflow work and hash-flooding protection. Python applications that use the bundled parser depend on that implementation even when their own source contains only standard-library calls.

The same NEWS entry explicitly excludes one issue from Python's exposure. CVE-2016-5300 concerns operating-system entropy sources, but Python already obtains operating-system entropy and supplies an Expat hash salt through XML_SetHashSalt(). That qualification prevents a list of upstream changes from becoming an inaccurate list of vulnerabilities in Python. Bundling a component creates a dependency on its fixes, while the embedding application's existing configuration can change which upstream problems apply.

Interrupted operations must release resources

The maintenance set also corrects asynchronous SSL socket leaks. Issue 29870 concerns an aborted connection in asyncio's SSL implementation. Issue 29743 covers closing a transport during the handshake. These failures occur while a connection is being established or torn down, so successful application traffic does not exercise the relevant paths.

Another entry, issue 27585, fixes cancellation of a waiter in asyncio.Lock. Cancellation interrupts an operation that may already be represented in synchronization state. Correct cleanup has to account for that interruption as part of the normal behavior of the abstraction. The NEWS names the correction without promising a broader redesign of cancellation.

I find these failure-path fixes particularly relevant to Python's protocol-based style. An application can express a lock wait or connection attempt concisely while delegating its resource ownership to the library. That delegation is useful only when interruption leaves the underlying state usable. Python 3.6.2 addresses specific cases in that machinery alongside the parsing fixes, so the maintenance update changes behavior at both input and resource boundaries.