bpo-35906: Fix CRLF injection in urllib

[push0ebp]

Disallowing line break in URL parser.
Although I reported security issue a few months ago, it has not been fixed.
Please patch this vulnerability.

https://bugs.python.org/issue35906

[push0ebp]

this is not maintenance. but maintenance-branch-pr bot detected this PR to maintenance

[matrixise]

Related to this PR #11768

[push0ebp]

Hi, I am waiting for patching. but they have not patched yet, So I sent a PR again.

[tomashek]

Is this the accepted resolution of CVE-2019-9947? If so, what is blocking the merging of this PR?

[push0ebp]

Is this the accepted resolution of CVE-2019-9947? If so, what is blocking the merging of this PR?

they have not accepted it yet. I guess that they seem to be interested in this vulnerability. Although I sent a report to Python security a few weeks ago. but they haven't replied.

[csabella]

Thank you for the patch. Based on the last message on this ticket, this is fixed in bpo-30458, so I'm closing this pull request. Please add a comment to bpo-30458 if you believe needs further discussion. Thanks!