http_check.py is intended to check HTTP/HTTPS headers (Gzip, ETag, Last-Modified). However, it does not validate the URL scheme, and urllib.request.urlopen handles file: URLs by default.
While file:///etc/passwd is rejected due to a missing netloc, passing file://localhost/... bypasses the check and causes the script to open and read local files.
Example input: python3 python/http_check.py "file://localhost/etc/passwd"
Expected behavior: The script should only accept http:// and https:// URLs and reject other schemes.
http_check.py is intended to check HTTP/HTTPS headers (Gzip, ETag, Last-Modified). However, it does not validate the URL scheme, and urllib.request.urlopen handles file: URLs by default.
While file:///etc/passwd is rejected due to a missing netloc, passing file://localhost/... bypasses the check and causes the script to open and read local files.
Example input:
python3 python/http_check.py "file://localhost/etc/passwd"Expected behavior: The script should only accept http:// and https:// URLs and reject other schemes.