I was fixing security issue in WebOb for openSUSE and in one of the concerned commits I found this:
Subject: Replace the use of Python’s stdlib urljoin with our own
Reliance on the version shipped with Python has led to multiple issues because it doesn’t treat input as potentially hostile and makes certain decisions to strip characters before doing its work. In particular urllib.parse.urljoin() removes ASCII tab/CR/LF anywhere in the URL and strips leading and trailing C0 control and space characters before parsing, which has repeatedly turned an otherwise harmless relative reference into a protocol-relative or absolute URL.
Instead we now have our own version of urljoin() in webob.util, which implements the RFC 3986 reference resolution algorithm and resolves the reference exactly as given, without removing any characters. It is used to make the Location header absolute, by Request.relative_url(), and by the _HTTPMove based HTTP exceptions, which now normalize the Location header through the same code path as the Response object (so a protocol-relative location passed to e.g. HTTPFound no longer redirects off-host either).
Is it really so? Is really urljoin() known to be suboptimal? If it is so, shouldn’t it be replaced by something which “implements the RFC 3986 reference resolution algorithm and resolves the reference exactly as given”? Is there a ticket for it on the issue tracker?