[Python-checkins] cpython (3.2): Issue #16037: HTTPMessage.readheaders() raises an HTTPException when more than
georg.brandl
python-checkins at python.org
Tue Sep 30 14:46:57 CEST 2014
https://hg.python.org/cpython/rev/deee87d61436
changeset: 92659:deee87d61436
branch: 3.2
user: Georg Brandl <georg at python.org>
date: Tue Sep 30 14:08:04 2014 +0200
summary:
Issue #16037: HTTPMessage.readheaders() raises an HTTPException when more than
100 headers are read. Adapted from patch by Jyrki Pulliainen.
files:
Doc/library/http.client.rst | 2 +-
Lib/http/client.py | 4 ++++
Lib/test/test_httplib.py | 9 +++++++++
Misc/NEWS | 5 ++++-
4 files changed, 18 insertions(+), 2 deletions(-)
diff --git a/Doc/library/http.client.rst b/Doc/library/http.client.rst
--- a/Doc/library/http.client.rst
+++ b/Doc/library/http.client.rst
@@ -169,9 +169,9 @@
A subclass of :exc:`HTTPException`. Raised if a server responds with a HTTP
status code that we don't understand.
+
The constants defined in this module are:
-
.. data:: HTTP_PORT
The default port for the HTTP protocol (always ``80``).
diff --git a/Lib/http/client.py b/Lib/http/client.py
--- a/Lib/http/client.py
+++ b/Lib/http/client.py
@@ -206,6 +206,8 @@
# maximal line length when calling readline().
_MAXLINE = 65536
+_MAXHEADERS = 100
+
class HTTPMessage(email.message.Message):
# XXX The only usage of this method is in
@@ -253,6 +255,8 @@
if len(line) > _MAXLINE:
raise LineTooLong("header line")
headers.append(line)
+ if len(headers) > _MAXHEADERS:
+ raise HTTPException("got more than %d headers" % _MAXHEADERS)
if line in (b'\r\n', b'\n', b''):
break
hstring = b''.join(headers).decode('iso-8859-1')
diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py
--- a/Lib/test/test_httplib.py
+++ b/Lib/test/test_httplib.py
@@ -272,6 +272,15 @@
if resp.read():
self.fail("Did not expect response from HEAD request")
+ def test_too_many_headers(self):
+ headers = '\r\n'.join('Header%d: foo' % i
+ for i in range(client._MAXHEADERS + 1)) + '\r\n'
+ text = ('HTTP/1.1 200 OK\r\n' + headers)
+ s = FakeSocket(text)
+ r = client.HTTPResponse(s)
+ self.assertRaisesRegex(client.HTTPException,
+ r"got more than \d+ headers", r.begin)
+
def test_send_file(self):
expected = (b'GET /foo HTTP/1.1\r\nHost: example.com\r\n'
b'Accept-Encoding: identity\r\nContent-Length:')
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -1,4 +1,4 @@
-++++++++++
++++++++++++
Python News
+++++++++++
@@ -10,6 +10,9 @@
Library
-------
+- Issue #16037: HTTPMessage.readheaders() raises an HTTPException when more than
+ 100 headers are read. Adapted from patch by Jyrki Pulliainen.
+
- Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes
inside subjectAltName correctly. Formerly the module has used OpenSSL's
GENERAL_NAME_print() function to get the string represention of ASN.1
--
Repository URL: https://hg.python.org/cpython
More information about the Python-checkins
mailing list