diff options
author | AMIR <31338382+amiremohamadi@users.noreply.github.com> | 2020-07-19 00:46:10 +0430 |
---|---|---|
committer | Petr Viktorin <pviktori@redhat.com> | 2020-09-30 16:36:00 +0200 |
commit | 2da5f0eb5fbcde721fef36ff7e9d1f67c18bcdf7 (patch) | |
tree | 85e15a18236c0c0b1f1c88108d3cc779c314b396 | |
parent | fcc4a585fe13a8920fdb1f1d1ddf04eaed0025eb (diff) | |
download | cpython-git-fedora-2.7.tar.gz |
00354-cve-2020-26116-http-request-method-crlf-injection-in-httplib.patchfedora-2.7.18-6fedora-2.7
00354 #
Reject control chars in HTTP method in httplib.putrequest to prevent
HTTP header injection
Backported from Python 3.5-3.10 (and adjusted for py2's single-module httplib):
- https://bugs.python.org/issue39603
- https://github.com/python/cpython/pull/18485 (3.10)
- https://github.com/python/cpython/pull/21946 (3.5)
Co-authored-by: AMIR <31338382+amiremohamadi@users.noreply.github.com>
-rw-r--r-- | Lib/httplib.py | 16 | ||||
-rw-r--r-- | Lib/test/test_httplib.py | 23 | ||||
-rw-r--r-- | Misc/NEWS.d/next/Security/2020-02-12-14-17-39.bpo-39603.Gt3RSg.rst | 2 |
3 files changed, 41 insertions, 0 deletions
diff --git a/Lib/httplib.py b/Lib/httplib.py index fcc4152aaf..a63677477d 100644 --- a/Lib/httplib.py +++ b/Lib/httplib.py @@ -257,6 +257,10 @@ _contains_disallowed_url_pchar_re = re.compile('[\x00-\x20\x7f-\xff]') # _is_allowed_url_pchars_re = re.compile(r"^[/!$&'()*+,;=:@%a-zA-Z0-9._~-]+$") # We are more lenient for assumed real world compatibility purposes. +# These characters are not allowed within HTTP method names +# to prevent http header injection. +_contains_disallowed_method_pchar_re = re.compile('[\x00-\x1f]') + # We always set the Content-Length header for these methods because some # servers will otherwise respond with a 411 _METHODS_EXPECTING_BODY = {'PATCH', 'POST', 'PUT'} @@ -935,6 +939,8 @@ class HTTPConnection: else: raise CannotSendRequest() + self._validate_method(method) + # Save the method for use later in the response phase self._method = method @@ -1020,6 +1026,16 @@ class HTTPConnection: # On Python 2, request is already encoded (default) return request + def _validate_method(self, method): + """Validate a method name for putrequest.""" + # prevent http header injection + match = _contains_disallowed_method_pchar_re.search(method) + if match: + raise ValueError( + "method can't contain control characters. %r " + "(found at least %r)" + % (method, match.group())) + def _validate_path(self, url): """Validate a url for putrequest.""" # Prevent CVE-2019-9740. diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py index d8a57f7353..e295bb796e 100644 --- a/Lib/test/test_httplib.py +++ b/Lib/test/test_httplib.py @@ -385,6 +385,28 @@ class HeaderTests(TestCase): conn.putheader(name, value) +class HttpMethodTests(TestCase): + def test_invalid_method_names(self): + methods = ( + 'GET\r', + 'POST\n', + 'PUT\n\r', + 'POST\nValue', + 'POST\nHOST:abc', + 'GET\nrHost:abc\n', + 'POST\rRemainder:\r', + 'GET\rHOST:\n', + '\nPUT' + ) + + for method in methods: + with self.assertRaisesRegexp( + ValueError, "method can't contain control characters"): + conn = httplib.HTTPConnection('example.com') + conn.sock = FakeSocket(None) + conn.request(method=method, url="/") + + class BasicTest(TestCase): def test_status_lines(self): # Test HTTP status lines @@ -1010,6 +1032,7 @@ class TunnelTests(TestCase): @test_support.reap_threads def test_main(verbose=None): test_support.run_unittest(HeaderTests, OfflineTest, BasicTest, TimeoutTest, + HttpMethodTests, HTTPTest, HTTPSTest, SourceAddressTest, TunnelTests) diff --git a/Misc/NEWS.d/next/Security/2020-02-12-14-17-39.bpo-39603.Gt3RSg.rst b/Misc/NEWS.d/next/Security/2020-02-12-14-17-39.bpo-39603.Gt3RSg.rst new file mode 100644 index 0000000000..990affc3ed --- /dev/null +++ b/Misc/NEWS.d/next/Security/2020-02-12-14-17-39.bpo-39603.Gt3RSg.rst @@ -0,0 +1,2 @@ +Prevent http header injection by rejecting control characters in +http.client.putrequest(...). |