diff options
| -rw-r--r-- | Lib/http/server.py | 7 | ||||
| -rw-r--r-- | Lib/test/test_httpservers.py | 7 | ||||
| -rw-r--r-- | Misc/NEWS | 4 |
3 files changed, 18 insertions, 0 deletions
diff --git a/Lib/http/server.py b/Lib/http/server.py index 5e91826..de6b531 100644 --- a/Lib/http/server.py +++ b/Lib/http/server.py @@ -338,6 +338,13 @@ class BaseHTTPRequestHandler(socketserver.StreamRequestHandler): HTTPStatus.BAD_REQUEST, "Line too long") return False + except http.client.HTTPException as err: + self.send_error( + HTTPStatus.REQUEST_HEADER_FIELDS_TOO_LARGE, + "Too many headers", + str(err) + ) + return False conntype = self.headers.get('Connection', "") if conntype.lower() == 'close': diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py index 5d44825..98798ae 100644 --- a/Lib/test/test_httpservers.py +++ b/Lib/test/test_httpservers.py @@ -859,6 +859,13 @@ class BaseHTTPRequestHandlerTestCase(unittest.TestCase): self.assertFalse(self.handler.get_called) self.assertEqual(self.handler.requestline, 'GET / HTTP/1.1') + def test_too_many_headers(self): + result = self.send_typical_request( + b'GET / HTTP/1.1\r\n' + b'X-Foo: bar\r\n' * 101 + b'\r\n') + self.assertEqual(result[0], b'HTTP/1.1 431 Too many headers\r\n') + self.assertFalse(self.handler.get_called) + self.assertEqual(self.handler.requestline, 'GET / HTTP/1.1') + def test_close_connection(self): # handle_one_request() should be repeatedly called until # it sets close_connection @@ -237,6 +237,10 @@ Core and Builtins Library ------- +- Issue #26586: In http.server, respond with "413 Request header fields too + large" if there are too many header fields to parse, rather than killing + the connection and raising an unhandled exception. Patch by Xiang Zhang. + - Issue #26676: Added missing XMLPullParser to ElementTree.__all__. - Issue #22854: Change BufferedReader.writable() and |