mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-10-09 16:34:44 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 17

bpo-39603: Prevent header injection in http methods (GH-18485)

Browse source 
reject control chars in http method in http.client.putrequest to prevent http header injection
This commit is contained in:
AMIR 2020-07-19 00:46:10 +04:30 • committed by GitHub
parent 9b01c598ca
commit 8ca8a2e8fb
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 39 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

15
Lib/http/client.py
View file

@ -147,6 +147,10 @@ _contains_disallowed_url_pchar_re = re.compile('[\x00-\x20\x7f]')
# _is_allowed_url_pchars_re = re.compile(r"^[/!$&'()*+,;=:@%a-zA-Z0-9._~-]+$")
# We are more lenient for assumed real world compatibility purposes.
# These characters are not allowed within HTTP method names
# to prevent http header injection.
_contains_disallowed_method_pchar_re = re.compile('[\x00-\x1f]')
# We always set the Content-Length header for these methods because some
# servers will otherwise respond with a 411
_METHODS_EXPECTING_BODY = {'PATCH', 'POST', 'PUT'}
@ -1102,6 +1106,8 @@ class HTTPConnection:
else:
raise CannotSendRequest(self.__state)
self._validate_method(method)
# Save the method for use later in the response phase
self._method = method
@ -1192,6 +1198,15 @@ class HTTPConnection:
# ASCII also helps prevent CVE-2019-9740.
return request.encode('ascii')
def _validate_method(self, method):
"""Validate a method name for putrequest."""
# prevent http header injection
match = _contains_disallowed_method_pchar_re.search(method)
if match:
raise ValueError(
f"method can't contain control characters. {method!r} "
f"(found at least {match.group()!r})")
def _validate_path(self, url):
"""Validate a url for putrequest."""
# Prevent CVE-2019-9740.