Headline
CVE-2021-41945: GitHub - encode/httpx: A next generation HTTP client for Python. 🦋
Encode OSS httpx < 0.23.0 is affected by improper input validation in httpx.URL, httpx.Client and some functions using httpx.URL.copy_with.
HTTPX - A next-generation HTTP client for Python.
HTTPX is a fully featured HTTP client library for Python 3. It includes an integrated command line client, has support for both HTTP/1.1 and HTTP/2, and provides both sync and async APIs.
Install HTTPX using pip:
Now, let’s get started:
>>> import httpx
r = httpx.get(‘https://www.example.org/’) r <Response [200 OK]> r.status_code 200 r.headers[‘content-type’] ‘text/html; charset=UTF-8’ r.text ‘<!doctype html>\n<html>\n<head>\n<title>Example Domain</title>…’
Or, using the command-line client.
$ pip install 'httpx[cli]' # The command line client is an optional dependency.
Which now allows us to use HTTPX directly from the command-line…
Sending a request…
Features
HTTPX builds on the well-established usability of requests, and gives you:
- A broadly requests-compatible API.
- An integrated command-line client.
- HTTP/1.1 and HTTP/2 support.
- Standard synchronous interface, but with async support if you need it.
- Ability to make requests directly to WSGI applications or ASGI applications.
- Strict timeouts everywhere.
- Fully type annotated.
- 100% test coverage.
Plus all the standard features of requests…
- International Domains and URLs
- Keep-Alive & Connection Pooling
- Sessions with Cookie Persistence
- Browser-style SSL Verification
- Basic/Digest Authentication
- Elegant Key/Value Cookies
- Automatic Decompression
- Automatic Content Decoding
- Unicode Response Bodies
- Multipart File Uploads
- HTTP(S) Proxy Support
- Connection Timeouts
- Streaming Downloads
- .netrc Support
- Chunked Requests
Installation
Install with pip:
Or, to include the optional HTTP/2 support, use:
$ pip install httpx[http2]
HTTPX requires Python 3.7+.
Documentation
Project documentation is available at https://www.python-httpx.org/.
For a run-through of all the basics, head over to the QuickStart.
For more advanced topics, see the Advanced Usage section, the async support section, or the HTTP/2 section.
The Developer Interface provides a comprehensive API reference.
To find out about tools that integrate with HTTPX, see Third Party Packages.
Contribute
If you want to contribute with HTTPX check out the Contributing Guide to learn how to start.
Dependencies
The HTTPX project relies on these excellent libraries:
- httpcore - The underlying transport implementation for httpx.
- h11 - HTTP/1.1 support.
- certifi - SSL certificates.
- rfc3986 - URL parsing & normalization.
- idna - Internationalized domain name support.
- sniffio - Async library autodetection.
As well as these optional installs:
- h2 - HTTP/2 support. (Optional, with httpx[http2])
- socksio - SOCKS proxy support. (Optional, with httpx[socks])
- rich - Rich terminal support. (Optional, with httpx[cli])
- click - Command line client support. (Optional, with httpx[cli])
- brotli or brotlicffi - Decoding for “brotli” compressed responses. (Optional, with httpx[brotli])
A huge amount of credit is due to requests for the API layout that much of this work follows, as well as to urllib3 for plenty of design inspiration around the lower-level networking details.
HTTPX is BSD licensed code.
Designed & crafted with care.
— 🦋 —
Related news
Vulnerability in the Sun ZFS Storage Appliance product of Oracle Systems (component: Core). The supported version that is affected is 8.8.60. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Sun ZFS Storage Appliance. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Sun ZFS Storage Appliance. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`.