Stowage/cpython
2
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2026-04-14 07:41:00 +00:00
Code Issues Projects Releases Packages Wiki Activity

[3.13] gh-142533: Document CRLF injection vulnerabilities in http.server doc (GH-143395) (#148021)

Browse source 
gh-142533: Document CRLF injection vulnerabilities in http.server doc (GH-143395)
(cherry picked from commit 617f4cc1c2)

Co-authored-by: Tadej Magajna <tmagajna@gmail.com>
Co-authored-by: Victor Stinner <vstinner@python.org>
This commit is contained in:
Miss Islington (bot) 2026-04-02 23:33:00 +02:00 • committed by GitHub
parent 45c92206eb
commit e43fae7a75
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
Doc/library/http.server.rst
View file

@ -247,6 +247,8 @@ provides three different variants:
specifying its value. Note that, after the send_header calls are done,
:meth:`end_headers` MUST BE called in order to complete the operation.
This method does not reject input containing CRLF sequences.
.. versionchanged:: 3.2
Headers are stored in an internal buffer.
@ -257,6 +259,8 @@ provides three different variants:
buffered and sent directly the output stream.If the *message* is not
specified, the HTTP message corresponding the response *code* is sent.
This method does not reject *message* containing CRLF sequences.
.. versionadded:: 3.2
.. method:: end_headers()
@ -553,6 +557,11 @@ Security considerations
requests, this makes it possible for files outside of the specified directory
to be served.
Methods :meth:`BaseHTTPRequestHandler.send_header` and
:meth:`BaseHTTPRequestHandler.send_response_only` assume sanitized input
and does not perform input validation such as checking for the presence of CRLF
sequences. Untrusted input may result in HTTP Header injection attacks.
Earlier versions of Python did not scrub control characters from the
log messages emitted to stderr from ``python -m http.server`` or the
default :class:`BaseHTTPRequestHandler` ``.log_message``