Improper parsing of Content-Length

[kenballus]

Description

gunicorn currently parses Content-Length using int. This causes problems because int accepts a lot more than should be acceptable in that content. The biggest problem characters are, '-', '+', and '_'.

Examples

HTTP requests in which gunicorn misinterprets content-length (assume all newlines are CRLF):

Underscore between digits

GET / HTTP/1.1
Connection: close
Host: whatever
Content-Length: 0_1

Plus sign prefix

GET / HTTP/1.1
Connection: close
Host: whatever
Content-Length: +1

Minus sign prefix (only works for 0)

GET / HTTP/1.1
Connection: close
Host: whatever
Content-Length: -0

Solution

The set of things you want to accept in a Content-Length header is not equal to the set of things that can get through int without error. During Content-Length parsing, check that the value is all ASCII digits.

Versions

CPython version: 3.10.11
Gunicorn version: 20.1.0

[jasonamyers]

@benoitc I took a shot at this in the attached PR.