diff options
| -rw-r--r-- | Lib/httplib.py | 16 | ||||
| -rw-r--r-- | Lib/test/test_httplib.py | 23 | ||||
| -rw-r--r-- | Misc/NEWS.d/next/Security/2020-02-12-14-17-39.bpo-39603.Gt3RSg.rst | 2 |
3 files changed, 41 insertions, 0 deletions
diff --git a/Lib/httplib.py b/Lib/httplib.py index fcc4152aaf..a63677477d 100644 --- a/Lib/httplib.py +++ b/Lib/httplib.py @@ -257,6 +257,10 @@ _contains_disallowed_url_pchar_re = re.compile('[\x00-\x20\x7f-\xff]') # _is_allowed_url_pchars_re = re.compile(r"^[/!$&'()*+,;=:@%a-zA-Z0-9._~-]+$") # We are more lenient for assumed real world compatibility purposes. +# These characters are not allowed within HTTP method names +# to prevent http header injection. +_contains_disallowed_method_pchar_re = re.compile('[\x00-\x1f]') + # We always set the Content-Length header for these methods because some # servers will otherwise respond with a 411 _METHODS_EXPECTING_BODY = {'PATCH', 'POST', 'PUT'} @@ -935,6 +939,8 @@ class HTTPConnection: else: raise CannotSendRequest() + self._validate_method(method) + # Save the method for use later in the response phase self._method = method @@ -1020,6 +1026,16 @@ class HTTPConnection: # On Python 2, request is already encoded (default) return request + def _validate_method(self, method): + """Validate a method name for putrequest.""" + # prevent http header injection + match = _contains_disallowed_method_pchar_re.search(method) + if match: + raise ValueError( + "method can't contain control characters. %r " + "(found at least %r)" + % (method, match.group())) + def _validate_path(self, url): """Validate a url for putrequest.""" # Prevent CVE-2019-9740. diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py index d8a57f7353..e295bb796e 100644 --- a/Lib/test/test_httplib.py +++ b/Lib/test/test_httplib.py @@ -385,6 +385,28 @@ class HeaderTests(TestCase): conn.putheader(name, value) +class HttpMethodTests(TestCase): + def test_invalid_method_names(self): + methods = ( + 'GET\r', + 'POST\n', + 'PUT\n\r', + 'POST\nValue', + 'POST\nHOST:abc', + 'GET\nrHost:abc\n', + 'POST\rRemainder:\r', + 'GET\rHOST:\n', + '\nPUT' + ) + + for method in methods: + with self.assertRaisesRegexp( + ValueError, "method can't contain control characters"): + conn = httplib.HTTPConnection('example.com') + conn.sock = FakeSocket(None) + conn.request(method=method, url="/") + + class BasicTest(TestCase): def test_status_lines(self): # Test HTTP status lines @@ -1010,6 +1032,7 @@ class TunnelTests(TestCase): @test_support.reap_threads def test_main(verbose=None): test_support.run_unittest(HeaderTests, OfflineTest, BasicTest, TimeoutTest, + HttpMethodTests, HTTPTest, HTTPSTest, SourceAddressTest, TunnelTests) diff --git a/Misc/NEWS.d/next/Security/2020-02-12-14-17-39.bpo-39603.Gt3RSg.rst b/Misc/NEWS.d/next/Security/2020-02-12-14-17-39.bpo-39603.Gt3RSg.rst new file mode 100644 index 0000000000..990affc3ed --- /dev/null +++ b/Misc/NEWS.d/next/Security/2020-02-12-14-17-39.bpo-39603.Gt3RSg.rst @@ -0,0 +1,2 @@ +Prevent http header injection by rejecting control characters in +http.client.putrequest(...). |