GeezerVison is showing github.com — [3.11] gh-144370: Disallow usage of control characters in status in w… · python/cpython@3b80905
File treeExpand file treeCollapse file tree Open diff view settings Expand file treeCollapse file tree Open diff view settings Collapse file Copy file name to clipboardExpand all lines: Lib/test/test_wsgiref.py +19Lines changed: 19 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -855,6 +855,25 @@ def write(self, b): | 855 | 855 | self.assertIsNotNone(h.status) | 856 | 856 | self.assertIsNotNone(h.environ) | 857 | 857 |
| | 858 | + def testRaisesControlCharacters(self): | | 859 | + for c0 in control_characters_c0(): | | 860 | + with self.subTest(c0): | | 861 | + base = BaseHandler() | | 862 | + with self.assertRaises(ValueError): | | 863 | + base.start_response(c0, [('x', 'y')]) | | 864 | + | | 865 | + base = BaseHandler() | | 866 | + with self.assertRaises(ValueError): | | 867 | + base.start_response('200 OK', [(c0, 'y')]) | | 868 | + | | 869 | + # HTAB (\x09) is allowed in header values, but not in names. | | 870 | + base = BaseHandler() | | 871 | + if c0 != "\t": | | 872 | + with self.assertRaises(ValueError): | | 873 | + base.start_response('200 OK', [('x', c0)]) | | 874 | + else: | | 875 | + base.start_response('200 OK', [('x', c0)]) | | 876 | + | 858 | 877 |
| 859 | 878 | if __name__ == "__main__": | 860 | 879 | unittest.main() |
Collapse file Copy file name to clipboardExpand all lines: Lib/wsgiref/handlers.py +3-1Lines changed: 3 additions & 1 deletion | Original file line number | Diff line number | Diff line change |
|---|
| 1 | 1 | """Base classes for server/gateway implementations""" | 2 | 2 |
| 3 | 3 | from .util import FileWrapper, guess_scheme, is_hop_by_hop | 4 | | -from .headers import Headers | | 4 | +from .headers import Headers, _name_disallowed_re | 5 | 5 |
| 6 | 6 | import sys, os, time | 7 | 7 |
| @@ -237,6 +237,8 @@ def start_response(self, status, headers,exc_info=None): | 237 | 237 | self.status = status | 238 | 238 | self.headers = self.headers_class(headers) | 239 | 239 | status = self._convert_string_type(status, "Status") | | 240 | + if _name_disallowed_re.search(status): | | 241 | + raise ValueError("Control characters are not allowed in status") | 240 | 242 | assert len(status)>=4,"Status must be at least 4 characters" | 241 | 243 | assert status[:3].isdigit(), "Status message must begin w/3-digit code" | 242 | 244 | assert status[3]==" ", "Status message must have a space after code" | |
Collapse file Copy file name to clipboardExpand all lines: Misc/ACKS +1Lines changed: 1 addition & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -1021,6 +1021,7 @@ Wolfgang Langner | 1021 | 1021 | Detlef Lannert | 1022 | 1022 | Rémi Lapeyre | 1023 | 1023 | Soren Larsen | | 1024 | +Seth Michael Larson | 1024 | 1025 | Amos Latteier | 1025 | 1026 | Piers Lauder | 1026 | 1027 | Ben Laurie | |
Collapse file Copy file name to clipboard +2Lines changed: 2 additions & 0 deletions - Display the source diff
- Display the rich diff
| Original file line number | Diff line number | Diff line change |
|---|
| | 1 | +Disallow usage of control characters in status in :mod:`wsgiref.handlers` to prevent HTTP header injections. | | 2 | +Patch by Benedikt Johannes. |
|