mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-11-03 19:34:08 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

gh-103204: http.server - Enforce that HTTP version numbers must consist only of digits (#103205)

Browse source 
Reject HTTP requests with invalid http/x.y version numbers: x or y being non-digits or too-long.

---------

Co-authored-by: Oleg Iarygin <oleg@arhadthedev.net>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
This commit is contained in:
Ben Kallus 2023-05-12 16:25:58 -04:00 • committed by GitHub
parent 25db95d224
commit cf720acfcb
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 28 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

21
Lib/test/test_httpservers.py
View file

@ -164,6 +164,27 @@ class BaseHTTPServerTestCase(BaseTestCase):
res = self.con.getresponse()
self.assertEqual(res.status, HTTPStatus.BAD_REQUEST)
def test_version_signs_and_underscores(self):
self.con._http_vsn_str = 'HTTP/-9_9_9.+9_9_9'
self.con.putrequest('GET', '/')
self.con.endheaders()
res = self.con.getresponse()
self.assertEqual(res.status, HTTPStatus.BAD_REQUEST)
def test_major_version_number_too_long(self):
self.con._http_vsn_str = 'HTTP/909876543210.0'
self.con.putrequest('GET', '/')
self.con.endheaders()
res = self.con.getresponse()
self.assertEqual(res.status, HTTPStatus.BAD_REQUEST)
def test_minor_version_number_too_long(self):
self.con._http_vsn_str = 'HTTP/1.909876543210'
self.con.putrequest('GET', '/')
self.con.endheaders()
res = self.con.getresponse()
self.assertEqual(res.status, HTTPStatus.BAD_REQUEST)
def test_version_none_get(self):
self.con._http_vsn_str = ''
self.con.putrequest('GET', '/')