diff options
| author | Ben Kallus <49924171+kenballus@users.noreply.github.com> | 2023-05-12 20:25:58 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-05-12 20:25:58 (GMT) |
| commit | cf720acfcbd8c9c25a706a4b6df136465a803992 (patch) | |
| tree | 5907abcc053c6355e63190ff0c2bc7124ca39225 /Lib/http | |
| parent | 25db95d224d18fb7b7f53165aeaa87632b0230f2 (diff) | |
| download | cpython-cf720acfcbd8c9c25a706a4b6df136465a803992.zip cpython-cf720acfcbd8c9c25a706a4b6df136465a803992.tar.gz cpython-cf720acfcbd8c9c25a706a4b6df136465a803992.tar.bz2 | |
gh-103204: `http.server` - Enforce that HTTP version numbers must consist only of digits (#103205)
Reject HTTP requests with invalid http/x.y version numbers: x or y being non-digits or too-long.
---------
Co-authored-by: Oleg Iarygin <oleg@arhadthedev.net>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Diffstat (limited to 'Lib/http')
| -rw-r--r-- | Lib/http/server.py | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/Lib/http/server.py b/Lib/http/server.py index a245ffb..ca6240d 100644 --- a/Lib/http/server.py +++ b/Lib/http/server.py @@ -300,6 +300,10 @@ class BaseHTTPRequestHandler(socketserver.StreamRequestHandler): # - Leading zeros MUST be ignored by recipients. if len(version_number) != 2: raise ValueError + if any(not component.isdigit() for component in version_number): + raise ValueError("non digit in http version") + if any(len(component) > 10 for component in version_number): + raise ValueError("unreasonable length http version") version_number = int(version_number[0]), int(version_number[1]) except (ValueError, IndexError): self.send_error( |