mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-04 00:48:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

[3.11] gh-103204: http.server - Enforce that HTTP version numbers must consist only of digits (GH-103205) (#104438)

Browse source 
gh-103204: `http.server` - Enforce that HTTP version numbers must consist only of digits (GH-103205)

Reject HTTP requests with invalid http/x.y version numbers: x or y being non-digits or too-long.

---------

(cherry picked from commit cf720acfcb)

Co-authored-by: Ben Kallus <49924171+kenballus@users.noreply.github.com>
Co-authored-by: Oleg Iarygin <oleg@arhadthedev.net>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
This commit is contained in:
Miss Islington (bot) 2023-05-12 13:54:12 -07:00 • committed by GitHub
parent 7055088500
commit b4c1ca29cc
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 28 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Lib/http/server.py
View file

@ -300,6 +300,10 @@ class BaseHTTPRequestHandler(socketserver.StreamRequestHandler):
# - Leading zeros MUST be ignored by recipients.
if len(version_number) != 2:
raise ValueError
if any(not component.isdigit() for component in version_number):
raise ValueError("non digit in http version")
if any(len(component) > 10 for component in version_number):
raise ValueError("unreasonable length http version")
version_number = int(version_number[0]), int(version_number[1])
except (ValueError, IndexError):
self.send_error(