Fail with HTTP 400 for invalid headers

Test malformed Accept-Charset quality values.

Fixes #1370
Closes #1707

Co-authored-by: Zach Seils (seils) <seils@cisco.com>
Co-authored-by: Zach Seils <zachseils@gmail.com>

Author: 3 people

Diff for: cherrypy/lib/httputil.py

@@ -18,6 +18,7 @@
 from six.moves import range, builtins
 from six.moves.BaseHTTPServer import BaseHTTPRequestHandler
 
+import cherrypy
 from cherrypy._cpcompat import ntob, ntou
 from cherrypy._cpcompat import text_or_bytes
 from cherrypy._cpcompat import unquote_qs
@@ -202,7 +203,21 @@ def qvalue(self):
         val = self.params.get('q', '1')
         if isinstance(val, HeaderElement):
             val = val.value
-        return float(val)
+        try:
+            return float(val)
+        except ValueError as val_err:
+            """Fail client requests with invalid quality value.
+
+            Ref: https://github.com/cherrypy/cherrypy/issues/1370
+            """
+            six.raise_from(
+                cherrypy.HTTPError(
+                    400,
+                    'Malformed HTTP header: `{}`'.
+                    format(str(self)),
+                ),
+                val_err,
+            )
 
     def __cmp__(self, other):
         diff = builtins.cmp(self.qvalue, other.qvalue)

Diff for: cherrypy/test/test_encoding.py

@@ -360,6 +360,11 @@ def testEncoding(self):
         self.getPage('/utf8', [('Accept-Charset', 'us-ascii, ISO-8859-1')])
         self.assertStatus('406 Not Acceptable')
 
+        # Test malformed quality value, which should raise 400.
+        self.getPage('/mao_zedong', [('Accept-Charset',
+                                      'ISO-8859-1,utf-8;q=0.7,*;q=0.7)')])
+        self.assertStatus('400 Bad Request')
+
     def testGzip(self):
         zbuf = io.BytesIO()
         zfile = gzip.GzipFile(mode='wb', fileobj=zbuf, compresslevel=9)