Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

gh-103204:http.server - Enforce that HTTP version numbers must consist only of digits#103205

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
gpshead merged 10 commits intopython:mainfromkenballus:restrict-http-version-number-parsing
May 12, 2023
Merged

gh-103204:http.server - Enforce that HTTP version numbers must consist only of digits#103205

gpshead merged 10 commits intopython:mainfromkenballus:restrict-http-version-number-parsing
May 12, 2023

Conversation

@kenballus
Copy link
Contributor

@kenballuskenballus commentedApr 3, 2023•
edited by gpshead
Loading

gh-103204: Enforce that HTTP version numbers must consist only of digits

Currently,http.server accepts requests with version numbers preceded with'+' or'-', as well as those with'_' between digits. I am not aware of any other HTTP server that accepts such requests. This PR makes it reject those requests.

Fixes#103204.

@kenballuskenballus changed the titlegh-103204: Enforce that HTTP version numbers must consist only of digitsgh-103204:http.server - Enforce that HTTP version numbers must consist only of digitsApr 3, 2023
@arhadthedevarhadthedev added the stdlibStandard Library Python modules in the Lib/ directory labelApr 3, 2023
@JelleZijlstra
Copy link
Member

Could you add a unit test?

kenballus and OTheDev reacted with thumbs up emoji

@arhadthedev
Copy link
Member

@gpshead (as a more-than-twice committer intoLib/http/server.py)

@gpsheadgpshead added the needs backport to 3.11only security fixes labelMay 12, 2023
@gpsheadgpshead self-assigned thisMay 12, 2023
@gpshead
Copy link
Member

From a protocol standpoint this PR is pedantically correct, we shouldn't have accepted other values. Not that anyone is ever going to send them. I've also added to this PR a length constraint on the values accepted for good measure.

JelleZijlstra reacted with thumbs up emoji

@JelleZijlstra
Copy link
Member

.isdigit() allows any Unicode digit, so I was worried we could get into some shenanigans with weird non-ASCII digits. But it seems that the way we get this version string, that's not possible.

gpshead reacted with thumbs up emoji

@gpsheadgpshead merged commitcf720ac intopython:mainMay 12, 2023
@miss-islington
Copy link
Contributor

Thanks@kenballus for the PR, and@gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

@bedevere-bot
Copy link

GH-104438 is a backport of this pull request to the3.11 branch.

@bedevere-botbedevere-bot removed the needs backport to 3.11only security fixes labelMay 12, 2023
miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestMay 12, 2023
…st consist only of digits (pythonGH-103205)Reject HTTP requests with invalid http/x.y version numbers: x or y being non-digits or too-long.---------(cherry picked from commitcf720ac)Co-authored-by: Ben Kallus <49924171+kenballus@users.noreply.github.com>Co-authored-by: Oleg Iarygin <oleg@arhadthedev.net>Co-authored-by: Gregory P. Smith <greg@krypto.org>
gpshead added a commit that referenced this pull requestMay 12, 2023
…ust consist only of digits (GH-103205) (#104438)gh-103204: `http.server` - Enforce that HTTP version numbers must consist only of digits (GH-103205)Reject HTTP requests with invalid http/x.y version numbers: x or y being non-digits or too-long.---------(cherry picked from commitcf720ac)Co-authored-by: Ben Kallus <49924171+kenballus@users.noreply.github.com>Co-authored-by: Oleg Iarygin <oleg@arhadthedev.net>Co-authored-by: Gregory P. Smith <greg@krypto.org>
@kenballuskenballus deleted the restrict-http-version-number-parsing branchOctober 25, 2023 15:21
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@arhadthedevarhadthedevarhadthedev left review comments

Assignees

@gpsheadgpshead

Labels

stdlibStandard Library Python modules in the Lib/ directory

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

http.server parses HTTP version numbers too permissively.

6 participants

@kenballus@JelleZijlstra@arhadthedev@gpshead@miss-islington@bedevere-bot
[8]ページ先頭
©2009-2025 Movatter.jp