gh-153792: Fix urllib.request digest auth crash on a malformed challenge

AbstractDigestAuthHandler.retry_http_digest_auth parsed a server-controlled
WWW-Authenticate digest challenge without guarding the parse, so a malformed
challenge raised a bare ValueError or IndexError out of urlopen(). Catch those
around the two parse statements and decline (return None), as the handler
already does for a 40x it cannot handle.

Author: tonghuaroot

Lib/test/test_urllib2.py

@@ -1722,6 +1722,31 @@ def test_unsupported_auth_digest_handler(self):
         opener.add_handler(http_handler)
         self.assertRaises(ValueError, opener.open, "http://www.example.com")
 
+    def test_digest_auth_malformed_challenge(self):
+        # A malformed WWW-Authenticate digest challenge must make the handler
+        # decline (return None) rather than crash with a raw exception.
+        handler = urllib.request.HTTPDigestAuthHandler(None)
+        req = Request("http://www.example.com/")
+        for challenge in (
+            "Digest realm",   # parse_keqv_list: no '=' -> ValueError
+            "Digest realm=",  # parse_keqv_list: empty value -> IndexError
+            "Digest",         # auth.split(' ', 1) -> ValueError
+        ):
+            with self.subTest(challenge=challenge):
+                self.assertIsNone(handler.retry_http_digest_auth(req, challenge))
+
+        # Through the public opener.open() path the raw exception must not
+        # escape; the unhandled 401 surfaces as HTTPError instead.
+        opener = OpenerDirector()
+        opener.add_handler(urllib.request.HTTPDigestAuthHandler(None))
+        opener.add_handler(urllib.request.HTTPDefaultErrorHandler())
+        opener.add_handler(MockHTTPHandlerRedirect(
+            401, "WWW-Authenticate: Digest realm\r\n\r\n"))
+        with self.assertRaises(urllib.error.HTTPError) as cm:
+            opener.open("http://www.example.com/")
+        self.assertEqual(cm.exception.code, 401)
+        cm.exception.close()
+
     def test_unsupported_auth_basic_handler(self):
         # While using BasicAuthHandler
         opener = OpenerDirector()

Lib/urllib/request.py

@@ -1093,8 +1093,12 @@ def http_error_auth_reqed(self, auth_header, host, req, headers):
                                  " the following scheme: '%s'" % scheme)
 
     def retry_http_digest_auth(self, req, auth):
-        token, challenge = auth.split(' ', 1)
-        chal = parse_keqv_list(filter(None, parse_http_list(challenge)))
+        try:
+            token, challenge = auth.split(' ', 1)
+            chal = parse_keqv_list(filter(None, parse_http_list(challenge)))
+        except (ValueError, IndexError):
+            # A malformed challenge cannot be used to authenticate.
+            return None
         auth = self.get_authorization(req, chal)
         if auth:
             auth_val = 'Digest %s' % auth

Misc/NEWS.d/next/Library/2026-07-16-10-00-00.gh-issue-153792.Hs9Mk4.rst

@@ -0,0 +1,3 @@
+Fix :class:`urllib.request.HTTPDigestAuthHandler` raising :exc:`ValueError` or
+:exc:`IndexError` for a malformed ``WWW-Authenticate`` digest challenge. Patch
+by tonghuaroot.