May 12, 2023 · Apr 3, 2023 · Apr 3, 2023 · Apr 3, 2023 · Apr 3, 2023 · May 12, 2023
diff --git a/Lib/http/server.py b/Lib/http/server.py
                #   - Leading zeros MUST be ignored by recipients.
                if len(version_number) != 2:
                    raise ValueError
                if any(not component.isdigit() for component in version_number):
                    raise ValueError("non digit in http version")
                if any(len(component) > 10 for component in version_number):
                    raise ValueError("unreasonable length http version")
                version_number = int(version_number[0]), int(version_number[1])
            except (ValueError, IndexError):
                self.send_error(
diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
        res = self.con.getresponse()
        self.assertEqual(res.status, HTTPStatus.BAD_REQUEST)

    def test_version_signs_and_underscores(self):
        self.con._http_vsn_str = 'HTTP/-9_9_9.+9_9_9'
        self.con.putrequest('GET', '/')
        self.con.endheaders()
        res = self.con.getresponse()
        self.assertEqual(res.status, HTTPStatus.BAD_REQUEST)

    def test_major_version_number_too_long(self):
        self.con._http_vsn_str = 'HTTP/909876543210.0'
        self.con.putrequest('GET', '/')
        self.con.endheaders()
        res = self.con.getresponse()
        self.assertEqual(res.status, HTTPStatus.BAD_REQUEST)

    def test_minor_version_number_too_long(self):
        self.con._http_vsn_str = 'HTTP/1.909876543210'
        self.con.putrequest('GET', '/')
        self.con.endheaders()
        res = self.con.getresponse()
        self.assertEqual(res.status, HTTPStatus.BAD_REQUEST)

    def test_version_none_get(self):
        self.con._http_vsn_str = ''
        self.con.putrequest('GET', '/')
diff --git a/Misc/NEWS.d/next/Library/2023-04-02-23-05-22.gh-issue-103204.bbDmu0.rst b/Misc/NEWS.d/next/Library/2023-04-02-23-05-22.gh-issue-103204.bbDmu0.rst
 Fixes :mod:`http.server` accepting HTTP requests with HTTP version numbers
 preceded by '+', or '-', or with digit-separating '_' characters.  The length
 of the version numbers is also constrained.
Original file line number	Diff line number	Diff line change
Expand Up		@@ -300,6 +300,10 @@ def parse_request(self):
		# - Leading zeros MUST be ignored by recipients.
		if len(version_number) != 2:
		raise ValueError
		if any(not component.isdigit() for component in version_number):
		raise ValueError("non digit in http version")
		if any(len(component) > 10 for component in version_number):
		raise ValueError("unreasonable length http version")
		version_number = int(version_number[0]), int(version_number[1])
		except (ValueError, IndexError):
		self.send_error(
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -164,6 +164,27 @@ def test_version_digits(self):
		res = self.con.getresponse()
		self.assertEqual(res.status, HTTPStatus.BAD_REQUEST)

		def test_version_signs_and_underscores(self):
		self.con._http_vsn_str = 'HTTP/-9_9_9.+9_9_9'
		self.con.putrequest('GET', '/')
		self.con.endheaders()
		res = self.con.getresponse()
		self.assertEqual(res.status, HTTPStatus.BAD_REQUEST)

		def test_major_version_number_too_long(self):
		self.con._http_vsn_str = 'HTTP/909876543210.0'
		self.con.putrequest('GET', '/')
		self.con.endheaders()
		res = self.con.getresponse()
		self.assertEqual(res.status, HTTPStatus.BAD_REQUEST)

		def test_minor_version_number_too_long(self):
		self.con._http_vsn_str = 'HTTP/1.909876543210'
		self.con.putrequest('GET', '/')
		self.con.endheaders()
		res = self.con.getresponse()
		self.assertEqual(res.status, HTTPStatus.BAD_REQUEST)

		def test_version_none_get(self):
		self.con._http_vsn_str = ''
		self.con.putrequest('GET', '/')
Expand Down
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,3 @@
		Fixes :mod:`http.server` accepting HTTP requests with HTTP version numbers
		preceded by '+', or '-', or with digit-separating '_' characters. The length
		of the version numbers is also constrained.