8000 [3.3][security] bpo-22928: Disabled HTTP header injections in http.client by vstinner · Pull Request #2861 · python/cpython · GitHub
[go: up one dir, main page]
Skip to content

[3.3][security] bpo-22928: Disabled HTTP header injections in http.client #2861

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 1 commit into from
Closed

[3.3][security] bpo-22928: Disabled HTTP header injections in http.client #2861

wants to merge 1 commit into from

Conversation

vstinner
Copy link
Member
@vstinner vstinner commented Jul 25, 2017 •
edited by bedevere-bot
Loading

Original patch by Demian Brecht.

Changed for the 3.3 backport:

  • remove subTest() from change
  • _is_legal_header_name regex: replace .fullmatch with .match, but
    add \A at start and \Z at end of the regex

(cherry picked from commit a112a8a)

https://bugs.python.org/issue22928

8000
@serhiy-storchaka @vstinner
Issue #22928: Disabled HTTP header injections in http.client.
57a8119 
Original patch by Demian Brecht.

Changed for the 3.3 backport:

* remove subTest() from change
* _is_legal_header_name regex: replace .fullmatch with .match, but
  add \A at start and \Z at end of the regex

(cherry picked from commit a112a8a)
@vstinner vstinner added the type-security A security issue label Jul 25, 2017
@vstinner vstinner changed the title [3.3][security] Issue #22928: Disabled HTTP header injections in http.client. [3.3][security] bpo-22928: Disabled HTTP header injections in http.client Jul 25, 2017
@vstinner
Copy link
Member Author

About the CI: test_pty failed once, but passed when run again.

It seems like on 3.3, if a test fails once, the overall test suite is considered as failed, even if the test pass when run again. On all other branches, regrtest would succeed in that case.

@vstinner
Copy link
Member Author

I scheduled a new Travis CI run and now all tests fail (test_pty didn't fail).

@vstinner
Copy link
Member Author

Oh, @serhiy-storchaka proposed almost the same PR a few days ago: PR #2817. I will close this one, once @serhiy-storchaka updated his PR with my suggestions.

@vstinner
Copy link
Member Author

Abandonned in favor of @serhiy-storchaka PR #2817 which now LGTM.

@vstinner vstinner closed this Jul 25, 2017
@vstinner vstinner deleted the http_injection33 branch July 25, 2017 12:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
type-security A security issue
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@vstinner @the-knights-who-say-ni @serhiy-storchaka
0