mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-04 08:59:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

gh-103204: http.server - Enforce that HTTP version numbers must consist only of digits (#103205)

Browse source 
Reject HTTP requests with invalid http/x.y version numbers: x or y being non-digits or too-long.

---------

Co-authored-by: Oleg Iarygin <oleg@arhadthedev.net>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
This commit is contained in:
Ben Kallus 2023-05-12 16:25:58 -04:00 • committed by GitHub
parent 25db95d224
commit cf720acfcb
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 28 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Lib/http/server.py
View file

@ -300,6 +300,10 @@ class BaseHTTPRequestHandler(socketserver.StreamRequestHandler):
# - Leading zeros MUST be ignored by recipients.
if len(version_number) != 2:
raise ValueError
if any(not component.isdigit() for component in version_number):
raise ValueError("non digit in http version")
if any(len(component) > 10 for component in version_number):
raise ValueError("unreasonable length http version")
version_number = int(version_number[0]), int(version_number[1])
except (ValueError, IndexError):
self.send_error(