{"action":"closed","issue":{"url":"https://api.github.com/repos/googleads/googleads-python-lib/issues/289","repository_url":"https://api.github.com/repos/googleads/googleads-python-lib","labels_url":"https://api.github.com/repos/googleads/googleads-python-lib/issues/289/labels{/name}","comments_url":"https://api.github.com/repos/googleads/googleads-python-lib/issues/289/comments","events_url":"https://api.github.com/repos/googleads/googleads-python-lib/issues/289/events","html_url":"https://github.com/googleads/googleads-python-lib/issues/289","id":328940162,"node_id":"MDU6SXNzdWUzMjg5NDAxNjI=","number":289,"title":"Issue: Allowing use of file:/ or custom schemes is often unexpected.","user":{"login":"STANAPI","id":39898500,"node_id":"MDQ6VXNlcjM5ODk4NTAw","avatar_url":"https://avatars0.githubusercontent.com/u/39898500?v=4","gravatar_id":"","url":"https://api.github.com/users/STANAPI","html_url":"https://github.com/STANAPI","followers_url":"https://api.github.com/users/STANAPI/followers","following_url":"https://api.github.com/users/STANAPI/following{/other_user}","gists_url":"https://api.github.com/users/STANAPI/gists{/gist_id}","starred_url":"https://api.github.com/users/STANAPI/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/STANAPI/subscriptions","organizations_url":"https://api.github.com/users/STANAPI/orgs","repos_url":"https://api.github.com/users/STANAPI/repos","events_url":"https://api.github.com/users/STANAPI/events{/privacy}","received_events_url":"https://api.github.com/users/STANAPI/received_events","type":"User","site_admin":false},"labels":[{"id":820263465,"node_id":"MDU6TGFiZWw4MjAyNjM0NjU=","url":"https://api.github.com/repos/googleads/googleads-python-lib/labels/P3","name":"P3","color":"6fc948","default":false}],"state":"closed","locked":false,"assignee":{"login":"msaniscalchi","id":6739520,"node_id":"MDQ6VXNlcjY3Mzk1MjA=","avatar_url":"https://avatars3.githubusercontent.com/u/6739520?v=4","gravatar_id":"","url":"https://api.github.com/users/msaniscalchi","html_url":"https://github.com/msaniscalchi","followers_url":"https://api.github.com/users/msaniscalchi/followers","following_url":"https://api.github.com/users/msaniscalchi/following{/other_user}","gists_url":"https://api.github.com/users/msaniscalchi/gists{/gist_id}","starred_url":"https://api.github.com/users/msaniscalchi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/msaniscalchi/subscriptions","organizations_url":"https://api.github.com/users/msaniscalchi/orgs","repos_url":"https://api.github.com/users/msaniscalchi/repos","events_url":"https://api.github.com/users/msaniscalchi/events{/privacy}","received_events_url":"https://api.github.com/users/msaniscalchi/received_events","type":"User","site_admin":false},"assignees":[{"login":"msaniscalchi","id":6739520,"node_id":"MDQ6VXNlcjY3Mzk1MjA=","avatar_url":"https://avatars3.githubusercontent.com/u/6739520?v=4","gravatar_id":"","url":"https://api.github.com/users/msaniscalchi","html_url":"https://github.com/msaniscalchi","followers_url":"https://api.github.com/users/msaniscalchi/followers","following_url":"https://api.github.com/users/msaniscalchi/following{/other_user}","gists_url":"https://api.github.com/users/msaniscalchi/gists{/gist_id}","starred_url":"https://api.github.com/users/msaniscalchi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/msaniscalchi/subscriptions","organizations_url":"https://api.github.com/users/msaniscalchi/orgs","repos_url":"https://api.github.com/users/msaniscalchi/repos","events_url":"https://api.github.com/users/msaniscalchi/events{/privacy}","received_events_url":"https://api.github.com/users/msaniscalchi/received_events","type":"User","site_admin":false}],"milestone":null,"comments":2,"created_at":"2018-06-04T07:35:05Z","updated_at":"2018-08-22T15:14:34Z","closed_at":"2018-08-22T15:14:34Z","author_association":"NONE","body":"Hello, fellow developers! There seem to be a few insecure parts in the Adwords API libraries, as it's allowing \r\nuse of file:/ or custom schemes is often unexpected.\r\n\r\nThe codes look like this below:\r\n---------------------------------------------\r\nbuild\\lib\\googleads\\adwords.py\r\ngoogleads\\adwords.py\r\n\r\n      # Generate an unpadded request body\r\n      request_body = self._BuildUploadRequestBody(\r\n          operations,\r\n          has_prefix=current_content_length == 0,\r\n          has_suffix=is_last)\r\n      req = urllib2.Request(upload_url)\r\n      req.add_header('Content-Type', 'application/xml')\r\n---------------------------------------------\r\n    # Send an HTTP POST request to the given upload_url\r\n    req = urllib2.Request(upload_url, data={}, headers=headers)\r\n    resp = self._url_opener.open(req)\r\n---------------------------------------------\r\n    request = urllib2.Request(\r\n        self._end_point, post_body,\r\n        self._header_handler.GetReportDownloadHeaders(**kwargs))\r\n---------------------------------------------\r\nbuild\\lib\\googleads\\util.py\r\n\r\n      headers = request.headers\r\n      u2request = urllib2.Request(url, msg, headers)\r\n      self.addcookies(u2request)\r\n---------------------------------------------\r\n\r\nWhat is the potential risk of this? Is there any way to improve?\r\n![image](https://user-images.githubusercontent.com/39898500/40904293-d7a96f2e-680c-11e8-9e3a-c6599db192f2.png)\r\n\r\n"}}
{"actor":{"display_login":"msaniscalchi"}}