summaryrefslogtreecommitdiffstats
path: root/Lib/http
Commit message (Collapse)AuthorAgeFilesLines
* bpo-38804: Fix REDoS in http.cookiejar (GH-17157) (#17343)Miss Islington (bot)2019-11-221-6/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The regex http.cookiejar.LOOSE_HTTP_DATE_RE was vulnerable to regular expression denial of service (REDoS). LOOSE_HTTP_DATE_RE.match is called when using http.cookiejar.CookieJar to parse Set-Cookie headers returned by a server. Processing a response from a malicious HTTP server can lead to extreme CPU usage and execution will be blocked for a long time. The regex contained multiple overlapping \s* capture groups. Ignoring the ?-optional capture groups the regex could be simplified to \d+-\w+-\d+(\s*\s*\s*)$ Therefore, a long sequence of spaces can trigger bad performance. Matching a malicious string such as LOOSE_HTTP_DATE_RE.match("1-c-1" + (" " * 2000) + "!") caused catastrophic backtracking. The fix removes ambiguity about which \s* should match a particular space. You can create a malicious server which responds with Set-Cookie headers to attack all python programs which access it e.g. from http.server import BaseHTTPRequestHandler, HTTPServer def make_set_cookie_value(n_spaces): spaces = " " * n_spaces expiry = f"1-c-1{spaces}!" return f"b;Expires={expiry}" class Handler(BaseHTTPRequestHandler): def do_GET(self): self.log_request(204) self.send_response_only(204) GH- Don't bother sending Server and Date n_spaces = ( int(self.path[1:]) GH- Can GET e.g. /100 to test shorter sequences if len(self.path) > 1 else 65506 GH- Max header line length 65536 ) value = make_set_cookie_value(n_spaces) for i in range(99): GH- Not necessary, but we can have up to 100 header lines self.send_header("Set-Cookie", value) self.end_headers() if __name__ == "__main__": HTTPServer(("", 44020), Handler).serve_forever() This server returns 99 Set-Cookie headers. Each has 65506 spaces. Extracting the cookies will pretty much never complete. Vulnerable client using the example at the bottom of https://docs.python.org/3/library/http.cookiejar.html : import http.cookiejar, urllib.request cj = http.cookiejar.CookieJar() opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj)) r = opener.open("http://localhost:44020/") The popular requests library was also vulnerable without any additional options (as it uses http.cookiejar by default): import requests requests.get("http://localhost:44020/") * Regression test for http.cookiejar REDoS If we regress, this test will take a very long time. * Improve performance of http.cookiejar.ISO_DATE_RE A string like "444444" + (" " * 2000) + "A" could cause poor performance due to the 2 overlapping \s* groups, although this is not as serious as the REDoS in LOOSE_HTTP_DATE_RE was. (cherry picked from commit 1b779bfb8593739b11cbb988ef82a883ec9d077e) Co-authored-by: bcaller <bcaller@users.noreply.github.com>
* [3.6] bpo-38216, bpo-36274: Allow subclasses to separately override ↵Jason R. Coombs2019-09-281-10/+18
| | | | | | | validation and encoding behavior (GH-16448) (GH-16462) (cherry picked from commit 7774d7831e8809795c64ce27f7df52674581d298) Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>
* bpo-30458: Disallow control chars in http URLs. (GH-12755) (GH-13155)Miro Hrončok2019-05-081-0/+15
| | | | | | | | | | Disallow control chars in http URLs in urllib.urlopen. This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected. Disable https related urllib tests on a build without ssl (GH-13032) These tests require an SSL enabled build. Skip these tests when python is built without SSL to fix test failures. Use http.client.InvalidURL instead of ValueError as the new error case's exception. (GH-13044) Co-Authored-By: Miro Hrončok <miro@hroncok.cz>
* bpo-35647: Fix path check in cookiejar (GH-11436) (GH-12268)Miss Islington (bot)2019-03-121-5/+9
| | | Co-authored-by: Xtreak <tir.karthi@gmail.com>
* bpo-35121: prefix dot in domain for proper subdomain validation (GH-10258) ↵Miss Islington (bot)2019-03-101-2/+11
| | | | | | | | (GH-12260) Don't send cookies of domain A without Domain attribute to domain B when domain A is a suffix match of domain B while using a cookiejar with `http.cookiejar.DefaultCookiePolicy` policy. Patch by Karthikeyan Singaravelan. (cherry picked from commit ca7fe5063593958e5efdf90f068582837f07bd14) Co-authored-by: Xtreak <tir.karthi@gmail.com>
* bpo-33365: print the header values beside the keys (GH-6611)Miss Islington (bot)2018-06-191-1/+1
| | | | | | | | with debuglevel=1 only the header keys got printed. With this change the header values get printed as well and the single header entries get '\n' as a separator. (cherry picked from commit 936f03e7fafc28fd6fdfba11d162c776b89c0167) Co-authored-by: Marco Strigl <mstrigl@suse.com>
* bpo-33663: Convert content length to string before putting to header (GH-7754)Miss Islington (bot)2018-06-181-1/+1
| | | | | (cherry picked from commit b36b0a3765bcacb4dcdbf12060e9e99711855da8) Co-authored-by: ValeriyaSinevich <valeriya.sinevich@phystech.edu>
* bpo-991266: Fix quoting of Comment attribute of SimpleCookie (GH-6555)Miss Islington (bot)2018-04-231-0/+2
| | | | | (cherry picked from commit d5a2377c3d70e4143bcbee4a765b3434e21f683a) Co-authored-by: Berker Peksag <berker.peksag@gmail.com>
* [3.6] bpo-32297: Fix misspellings in Python source code comments (GH-4803) ↵Andrew Svetlov2017-12-141-1/+1
| | | | | | | | | | | | | | (#4864) * [3.6] bpo-32297: Few misspellings found in Python source code comments. (GH-4803) * Fix multiple typos in code comments * Add spacing in comments (test_logging.py, test_math.py) * Fix spaces at the beginning of comments in test_logging.py. (cherry picked from commit 53f7a7c2814fbfd8a29200926601a32fa48bacb3)
* Issue #22493: Inline flags now should be used only at the start of theSerhiy Storchaka2016-09-111-2/+1
| | | | | regular expression. Deprecation warning is emitted if uses them in the middle of the regular expression.
* Issue #28022: Deprecate ssl-related arguments in favor of SSLContext.Christian Heimes2016-09-101-0/+6
| | | | | | | The deprecation include manual creation of SSLSocket and certfile/keyfile (or similar) in ftplib, httplib, imaplib, smtplib, poplib and urllib. ssl.wrap_socket() is not marked as deprecated yet.
* Issue 27948: Allow backslashes in the literal string portion of f-strings, ↵Eric V. Smith2016-09-101-1/+1
| | | | but not in the expressions. Also, require expressions to begin and end with literal curly braces.
* [merge from 3.5] - Issue28010 - Make http.client.HTTPConnection.putrequestSenthil Kumaran2016-09-081-1/+2
|\ | | | | | | documentation consistent with the code.
| * Issue28010 - Make http.client.HTTPConnection.putrequest documentation ↵Senthil Kumaran2016-09-081-1/+2
| | | | | | | | consistent with the code.
| * Issue #27895: Spelling fixes (Contributed by Ville Skyttä).Martin Panter2016-09-071-1/+1
| |
* | #27364: fix "incorrect" uses of escape character in the stdlib.R David Murray2016-09-083-5/+5
| | | | | | | | | | | | | | And most of the tools. Patch by Emanual Barry, reviewed by me, Serhiy Storchaka, and Martin Panter.
* | Issue 27921: Remove backslash from another f-string.Eric V. Smith2016-09-031-1/+1
| |
* | Issue #27895: Spelling fixes (Contributed by Ville Skyttä).Raymond Hettinger2016-08-301-1/+1
| |
* | Issue #12319: Always send file request bodies using chunked encodingMartin Panter2016-08-271-23/+8
| | | | | | | | | | | | | | The previous attempt to determine the file’s Content-Length gave a false positive for pipes on Windows. Also, drop the special case for sending zero-length iterable bodies.
* | MergeRaymond Hettinger2016-08-261-1/+1
|\ \ | |/
| * Issue 19504: Change "customise" to "customize" American spelling.Raymond Hettinger2016-08-261-1/+1
| |
* | Issue #12319: Support for chunked encoding of HTTP request bodiesMartin Panter2016-08-241-50/+149
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the body object is a file, its size is no longer determined with fstat(), since that can report the wrong result (e.g. reading from a pipe). Instead, determine the size using seek(), or fall back to chunked encoding for unseekable files. Also, change the logic for detecting text files to check for TextIOBase inheritance, rather than inspecting the “mode” attribute, which may not exist (e.g. BytesIO and StringIO). The Content-Length for text files is no longer determined ahead of time, because the original logic could have been wrong depending on the codec and newline translation settings. Patch by Demian Brecht and Rolf Krahl, with a few tweaks by me.
* | [merge from 3.5] - Issue #27466: Change time format returned bySenthil Kumaran2016-07-101-1/+1
|\ \ | |/ | | | | http.cookie.time2netscape, confirming the netscape cookie format.
| * Issue #27466: Change time format returned by http.cookie.time2netscape,Senthil Kumaran2016-07-101-1/+1
| | | | | | | | confirming the netscape cookie format.
* | Issue #25738: Merge HTTP server from 3.5Martin Panter2016-06-081-13/+20
|\ \ | |/
| * Issue #25738: Don’t send message body for 205 Reset ContentMartin Panter2016-06-081-10/+20
| | | | | | | | Patch by Susumu Koshiba.
* | Issue #27076: Merge spelling from 3.5Martin Panter2016-05-261-1/+1
|\ \ | |/
| * Issue #27076: Doc, comment and tests spelling fixesMartin Panter2016-05-261-1/+1
| | | | | | | | Most fixes to Doc/ and Lib/ directories by Ville Skyttä.
* | Merge typo fixes from 3.5Martin Panter2016-05-081-1/+1
|\ \ | |/
| * Fix typos in comments, documentation and test method namesMartin Panter2016-05-081-1/+1
| |
* | Issue #24902: Print server URL on http.server startupBerker Peksag2016-04-291-1/+2
| | | | | | | | Initial patch by Felix Kaiser.
* | Issue #26657: Merge http.server fix from 3.5Martin Panter2016-04-181-3/+3
|\ \ | |/
| * Issue #26657: Fix Windows directory traversal vulnerability with http.serverMartin Panter2016-04-181-3/+3
| | | | | | | | | | Based on patch by Philipp Hagemeister. This fixes a regression caused by revision f4377699fd47.
* | Issue #26404: Add context manager to socketserver, by Aviv PalivodaMartin Panter2016-04-131-10/+8
| |
* | Issue #26585: Eliminate _quote_html() and use html.escape(quote=False)Martin Panter2016-04-111-8/+8
| | | | | | | | Patch by Xiang Zhang.
* | Merge typo fixes from 3.5Martin Panter2016-04-051-1/+1
|\ \ | |/
| * Fix typos in documentation and commentsMartin Panter2016-04-051-1/+1
| |
* | Issue #26586: Simple enhancements to BaseHTTPRequestHandler by Xiang ZhangMartin Panter2016-04-031-15/+13
| |
* | Issue #26586: Merge excessive HTTP header handling from 3.5Martin Panter2016-04-031-0/+7
|\ \ | |/
| * Issue #26586: Handle excessive header fields in http.server, by Xiang ZhangMartin Panter2016-04-031-0/+7
| |
* | Issue #26499: Merge HTTPResponse fix from 3.5Martin Panter2016-03-171-0/+8
|\ \ | |/
| * Issue #26499: Fixes to HTTPResponse.readline() and read1(), by Silent GhostMartin Panter2016-03-171-0/+8
| |
* | Issue #747320: Use email.utils.formatdate() to avoid code duplicationBerker Peksag2016-03-141-6/+2
| | | | | | | | | | | | in BaseHTTPRequestHandler Initial patch by karlcow.
* | Issue #16181: cookiejar.http2time() now returns None if year is higher than ↵Berker Peksag2016-03-141-1/+4
|\ \ | |/ | | | | datetime.MAXYEAR
| * Issue #16181: cookiejar.http2time() now returns None if year is higher than ↵Berker Peksag2016-03-141-1/+4
| | | | | | | | datetime.MAXYEAR
* | Issue #26302: merge from 3.5Jason R. Coombs2016-02-241-1/+1
|\ \ | |/
| * Issue #26302: Correctly identify comma as an invalid character for a cookie ↵Anish Shah2016-02-071-1/+1
| | | | | | | | (correcting regression in Python 3.5).
* | Issue #26045: Merge http.client error addition from 3.5Martin Panter2016-02-091-1/+16
|\ \ | |/
| * Issue #26045: Add UTF-8 suggestion to error in http.clientMartin Panter2016-02-091-1/+16
| | | | | | | | Based on patch by Guido van Rossum.
* | Issue #25899: Converted non-ASCII characters in docstrings and manpageSerhiy Storchaka2015-12-181-2/+2
|\ \ | |/ | | | | | | to ASCII replacements. Removed UTF-8 BOM from Misc/NEWS. Original patch by Chris Angelico.
generated by cgit v0.12 at 2026-01-01 23:03:38 (GMT)