From b4c1ca29ccd45c608ff01ce0a4608b1837715573 Mon Sep 17 00:00:00 2001 From: "Miss Islington (bot)" <31488909+miss-islington@users.noreply.github.com> Date: Fri, 12 May 2023 13:54:12 -0700 Subject: [3.11] gh-103204: `http.server` - Enforce that HTTP version numbers must consist only of digits (GH-103205) (#104438) gh-103204: `http.server` - Enforce that HTTP version numbers must consist only of digits (GH-103205) Reject HTTP requests with invalid http/x.y version numbers: x or y being non-digits or too-long. --------- (cherry picked from commit cf720acfcbd8c9c25a706a4b6df136465a803992) Co-authored-by: Ben Kallus <49924171+kenballus@users.noreply.github.com> Co-authored-by: Oleg Iarygin Co-authored-by: Gregory P. Smith --- Lib/http/server.py | 4 ++++ Lib/test/test_httpservers.py | 21 +++++++++++++++++++++ .../2023-04-02-23-05-22.gh-issue-103204.bbDmu0.rst | 3 +++ 3 files changed, 28 insertions(+) create mode 100644 Misc/NEWS.d/next/Library/2023-04-02-23-05-22.gh-issue-103204.bbDmu0.rst diff --git a/Lib/http/server.py b/Lib/http/server.py index 3a6ac97769..da07f110f1 100644 --- a/Lib/http/server.py +++ b/Lib/http/server.py @@ -300,6 +300,10 @@ class BaseHTTPRequestHandler(socketserver.StreamRequestHandler): # - Leading zeros MUST be ignored by recipients. if len(version_number) != 2: raise ValueError + if any(not component.isdigit() for component in version_number): + raise ValueError("non digit in http version") + if any(len(component) > 10 for component in version_number): + raise ValueError("unreasonable length http version") version_number = int(version_number[0]), int(version_number[1]) except (ValueError, IndexError): self.send_error( diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py index 0382b5ec44..cdd1bea754 100644 --- a/Lib/test/test_httpservers.py +++ b/Lib/test/test_httpservers.py @@ -164,6 +164,27 @@ class BaseHTTPServerTestCase(BaseTestCase): res = self.con.getresponse() self.assertEqual(res.status, HTTPStatus.BAD_REQUEST) + def test_version_signs_and_underscores(self): + self.con._http_vsn_str = 'HTTP/-9_9_9.+9_9_9' + self.con.putrequest('GET', '/') + self.con.endheaders() + res = self.con.getresponse() + self.assertEqual(res.status, HTTPStatus.BAD_REQUEST) + + def test_major_version_number_too_long(self): + self.con._http_vsn_str = 'HTTP/909876543210.0' + self.con.putrequest('GET', '/') + self.con.endheaders() + res = self.con.getresponse() + self.assertEqual(res.status, HTTPStatus.BAD_REQUEST) + + def test_minor_version_number_too_long(self): + self.con._http_vsn_str = 'HTTP/1.909876543210' + self.con.putrequest('GET', '/') + self.con.endheaders() + res = self.con.getresponse() + self.assertEqual(res.status, HTTPStatus.BAD_REQUEST) + def test_version_none_get(self): self.con._http_vsn_str = '' self.con.putrequest('GET', '/') diff --git a/Misc/NEWS.d/next/Library/2023-04-02-23-05-22.gh-issue-103204.bbDmu0.rst b/Misc/NEWS.d/next/Library/2023-04-02-23-05-22.gh-issue-103204.bbDmu0.rst new file mode 100644 index 0000000000..f8b3aa5151 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2023-04-02-23-05-22.gh-issue-103204.bbDmu0.rst @@ -0,0 +1,3 @@ +Fixes :mod:`http.server` accepting HTTP requests with HTTP version numbers +preceded by '+', or '-', or with digit-separating '_' characters. The length +of the version numbers is also constrained. -- cgit v1.2.1