-
-
Notifications
You must be signed in to change notification settings - Fork 34.5k
gh-142533: Document CRLF injection vulnerability in http.server and wsgiref modules #143395
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from 4 commits
b1edcf8
39c5198
2751d9b
d88da64
57ff6a9
0be4e58
3f8dd05
eb4fbfb
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -263,6 +263,7 @@ manipulation of WSGI response headers using a mapping-like interface. | |
|
|
||
| Content-Disposition: attachment; filename="bud.gif" | ||
|
|
||
| This method does not reject input containing CRLF sequences. | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This is no longer true, please check the update wsgiref code.
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Indeed, the vulnerability was addressed while this change was in review. Thank you. I removed my |
||
|
|
||
| .. versionchanged:: 3.5 | ||
| *headers* parameter is optional. | ||
|
|
@@ -897,3 +898,12 @@ directory and port number (default: 8000) on the command line:: | |
| httpd.server_close() | ||
|
|
||
|
|
||
| .. _wsgiref-security: | ||
|
|
||
| Security considerations | ||
| ----------------------- | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Please format this the same as we did for Http.server, that is: add a label and enough blank lines. |
||
|
|
||
| The :class:`wsgiref.headers.Headers` class assumes sanitized input for header | ||
| names and values and does not perform input validation such as checking for the | ||
| presence of CRLF sequences. Untrusted input may result in CRLF injection | ||
| attacks. | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
and
send_response_only()