mirror of
https://github.com/python/cpython
synced 2024-10-14 19:21:29 +00:00
gh-103204: http.server
- Enforce that HTTP version numbers must consist only of digits (#103205)
Reject HTTP requests with invalid http/x.y version numbers: x or y being non-digits or too-long. --------- Co-authored-by: Oleg Iarygin <oleg@arhadthedev.net> Co-authored-by: Gregory P. Smith <greg@krypto.org>
This commit is contained in:
parent
25db95d224
commit
cf720acfcb
|
@ -300,6 +300,10 @@ def parse_request(self):
|
|||
# - Leading zeros MUST be ignored by recipients.
|
||||
if len(version_number) != 2:
|
||||
raise ValueError
|
||||
if any(not component.isdigit() for component in version_number):
|
||||
raise ValueError("non digit in http version")
|
||||
if any(len(component) > 10 for component in version_number):
|
||||
raise ValueError("unreasonable length http version")
|
||||
version_number = int(version_number[0]), int(version_number[1])
|
||||
except (ValueError, IndexError):
|
||||
self.send_error(
|
||||
|
|
|
@ -164,6 +164,27 @@ def test_version_digits(self):
|
|||
res = self.con.getresponse()
|
||||
self.assertEqual(res.status, HTTPStatus.BAD_REQUEST)
|
||||
|
||||
def test_version_signs_and_underscores(self):
|
||||
self.con._http_vsn_str = 'HTTP/-9_9_9.+9_9_9'
|
||||
self.con.putrequest('GET', '/')
|
||||
self.con.endheaders()
|
||||
res = self.con.getresponse()
|
||||
self.assertEqual(res.status, HTTPStatus.BAD_REQUEST)
|
||||
|
||||
def test_major_version_number_too_long(self):
|
||||
self.con._http_vsn_str = 'HTTP/909876543210.0'
|
||||
self.con.putrequest('GET', '/')
|
||||
self.con.endheaders()
|
||||
res = self.con.getresponse()
|
||||
self.assertEqual(res.status, HTTPStatus.BAD_REQUEST)
|
||||
|
||||
def test_minor_version_number_too_long(self):
|
||||
self.con._http_vsn_str = 'HTTP/1.909876543210'
|
||||
self.con.putrequest('GET', '/')
|
||||
self.con.endheaders()
|
||||
res = self.con.getresponse()
|
||||
self.assertEqual(res.status, HTTPStatus.BAD_REQUEST)
|
||||
|
||||
def test_version_none_get(self):
|
||||
self.con._http_vsn_str = ''
|
||||
self.con.putrequest('GET', '/')
|
||||
|
|
|
@ -0,0 +1,3 @@
|
|||
Fixes :mod:`http.server` accepting HTTP requests with HTTP version numbers
|
||||
preceded by '+', or '-', or with digit-separating '_' characters. The length
|
||||
of the version numbers is also constrained.
|
Loading…
Reference in a new issue