Merge remote-tracking branch 'origin/main' into longobject-xmul-memset

Author: eendebakpt

Doc/library/urllib.error.rst

@@ -27,6 +27,10 @@ The following exceptions are raised by :mod:`!urllib.error` as appropriate:
       :exc:`URLError` used to be a subtype of :exc:`IOError`, which is now an
       alias of :exc:`OSError`.
 
+   .. versionchanged:: 3.16
+      The :attr:`~OSError.errno` and :attr:`~OSError.strerror` attributes are
+      now set from :attr:`reason` when it is an :exc:`OSError`.
+
 
 .. exception:: HTTPError(url, code, msg, hdrs, fp)
 

Lib/test/test_urllib2.py

@@ -82,6 +82,27 @@ def test_parse_http_list(self):
     def test_URLError_reasonstr(self):
         err = urllib.error.URLError('reason')
         self.assertIn(err.reason, str(err))
+        self.assertIsNone(err.errno)
+        self.assertIsNone(err.strerror)
+
+    def test_URLError_OSError_attributes(self):
+        # gh-50720: errno and strerror are copied from a wrapped OSError.
+        socket_error = socket.gaierror(-2, 'Name or service not known')
+
+        class FailingHTTPConnection(MockHTTPClass):
+            def request(self, *args, **kwargs):
+                raise socket_error
+
+        h = urllib.request.AbstractHTTPHandler()
+        req = Request("http://example.com/")
+        req.timeout = None
+
+        with self.assertRaises(urllib.error.URLError) as cm:
+            h.do_open(FailingHTTPConnection(), req)
+        err = cm.exception
+        self.assertIs(err.reason, socket_error)
+        self.assertEqual(err.errno, -2)
+        self.assertEqual(err.strerror, 'Name or service not known')
 
 
 class RequestHdrsTests(unittest.TestCase):
@@ -1789,6 +1810,31 @@ def test_proxy_digest_auth(self):
             http_handler.requests[1]
             .get_header("Proxy-authorization").startswith("Digest "))
 
+    def test_proxy_digest_auth_uri(self):
+        # The digest-uri of a request sent through an HTTP proxy is the
+        # absolute URL, matching the absolute-form request line
+        opener = OpenerDirector()
+        ph = urllib.request.ProxyHandler(dict(http="proxy.example.com:3128"))
+        opener.add_handler(ph)
+        password_manager = urllib.request.HTTPPasswordMgr()
+        digest_handler = urllib.request.ProxyDigestAuthHandler(password_manager)
+        realm = "ACME Networks"
+        http_handler = MockHTTPHandlerRedirect(
+            407,
+            'Proxy-Authenticate: Digest realm="%s", nonce="abcdef0123456789", '
+            'algorithm="SHA-256"\r\n\r\n' % realm)
+        opener.add_handler(digest_handler)
+        opener.add_handler(http_handler)
+
+        request_url = "http://acme.example.com/protected"
+        digest_handler.add_password(realm, "proxy.example.com:3128",
+                                    "wile", "coyote")
+        opener.open(request_url)
+
+        self.assertEqual(len(http_handler.requests), 2)
+        auth = http_handler.requests[1].get_header("Proxy-authorization")
+        self.assertIn('uri="%s"' % request_url, auth)
+
     def test_digest_auth_uses_full_url(self):
         # The non-proxy case must keep using the full request URL (not
         # just the host) for the password lookup, so that sub-URI realm
@@ -1811,6 +1857,26 @@ def test_digest_auth_uses_full_url(self):
         self.assertEqual(password_manager.target_realm, realm)
         self.assertEqual(password_manager.target_url, request_url)
 
+    def test_digest_auth_empty_path(self):
+        # gh-53089: the digest-uri must match the Request-URI, which is
+        # '/' for a URL with an empty path
+        password_manager = urllib.request.HTTPPasswordMgr()
+        digest_handler = urllib.request.HTTPDigestAuthHandler(password_manager)
+        realm = "ACME Networks"
+        digest_handler.add_password(realm, "http://acme.example.com",
+                                    "wile", "coyote")
+        req = Request("http://acme.example.com")
+        chal = {"realm": realm, "nonce": "abcdef0123456789",
+                "algorithm": "SHA-256"}
+
+        auth = digest_handler.get_authorization(req, chal)
+
+        H, KD = digest_handler.get_algorithm_impls("SHA-256")
+        respdig = KD(H("wile:%s:coyote" % realm),
+                     "abcdef0123456789:%s" % H("GET:/"))
+        self.assertIn('uri="/"', auth)
+        self.assertIn('response="%s"' % respdig, auth)
+
     def test_basic_and_digest_auth_handlers(self):
         # HTTPDigestAuthHandler raised an exception if it couldn't handle a 40*
         # response (https://bugs.python.org/issue1479302), where it should instead

Lib/urllib/error.py

@@ -27,6 +27,11 @@ def __init__(self, reason, filename=None):
         self.reason = reason
         if filename is not None:
             self.filename = filename
+        if isinstance(reason, OSError):
+            # OSError.__init__() is not called, so copy the attributes
+            # it would have set from the wrapped error (gh-50720).
+            self.errno = reason.errno
+            self.strerror = reason.strerror
 
     def __str__(self):
         return '<urlopen error %s>' % self.reason

Lib/urllib/request.py

@@ -1164,10 +1164,15 @@ def get_authorization(self, req, chal):
         else:
             entdig = None
 
+        # The digest-uri is the request-target as sent on the request line:
+        # the path, or the absolute URL when the request goes through an
+        # HTTP proxy.  RFC 7616, Section 3.4 allows both.  An empty path is
+        # sent as '/' by http.client, so use the same here.
+
+        uri = req.selector or '/'
+
         A1 = "%s:%s:%s" % (user, realm, pw)
-        A2 = "%s:%s" % (req.get_method(),
-                        # XXX selector: what about proxies and full urls
-                        req.selector)
+        A2 = "%s:%s" % (req.get_method(), uri)
         # NOTE: As per  RFC 2617, when server sends "auth,auth-int", the client could use either `auth`
         #     or `auth-int` to the response back. we use `auth` to send the response back.
         if qop is None:
@@ -1189,8 +1194,7 @@ def get_authorization(self, req, chal):
         # XXX should the partial digests be encoded too?
 
         base = 'username="%s", realm="%s", nonce="%s", uri="%s", ' \
-               'response="%s"' % (user, realm, nonce, req.selector,
-                                  respdig)
+               'response="%s"' % (user, realm, nonce, uri, respdig)
         if opaque:
             base += ', opaque="%s"' % opaque
         if entdig:

Misc/NEWS.d/next/Library/2026-10-29-19-42-53.gh-issue-53089.ewaIBvY6.rst

@@ -0,0 +1,5 @@
+:class:`urllib.request.HTTPDigestAuthHandler` now sends ``uri="/"`` in the
+Digest ``Authorization`` header for URLs with an empty path, such as
+``http://example.com``, matching the request-target sent by :mod:`http.client`.
+Previously it sent ``uri=""``, which servers could reject.
+Patch by Senthil Kumaran.

Misc/NEWS.d/next/Library/2026-10-29-20-52-57.gh-issue-50720.Kd1VMR.rst

@@ -0,0 +1,3 @@
+:exc:`urllib.error.URLError` now sets the :attr:`~OSError.errno` and
+:attr:`~OSError.strerror` attributes from
+:attr:`~urllib.error.URLError.reason` when it is an :exc:`OSError`.

configure

@@ -4466,6 +4466,11 @@ esac
 # check for systems that require aligned memory access
 AC_CACHE_CHECK([aligned memory access is required], [ac_cv_aligned_required],
 [AC_RUN_IFELSE([AC_LANG_SOURCE([[
+#ifdef __has_attribute
+#  if __has_attribute(no_sanitize)
+__attribute__((no_sanitize("alignment")))
+#  endif
+#endif
 int main(void)
 {
     char s[16];