Skip to content

Commit 38f199c

Browse files
webknjazZach Seils (seils)seils
committed
Fail with HTTP 400 for invalid headers
Test malformed Accept-Charset quality values. Fixes #1370 Closes #1707 Co-authored-by: Zach Seils (seils) <seils@cisco.com> Co-authored-by: Zach Seils <zachseils@gmail.com>
1 parent 841f795 commit 38f199c

File tree

2 files changed

+21
-1
lines changed

2 files changed

+21
-1
lines changed

Diff for: cherrypy/lib/httputil.py

+16-1
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
from six.moves import range, builtins
1919
from six.moves.BaseHTTPServer import BaseHTTPRequestHandler
2020

21+
import cherrypy
2122
from cherrypy._cpcompat import ntob, ntou
2223
from cherrypy._cpcompat import text_or_bytes
2324
from cherrypy._cpcompat import unquote_qs
@@ -202,7 +203,21 @@ def qvalue(self):
202203
val = self.params.get('q', '1')
203204
if isinstance(val, HeaderElement):
204205
val = val.value
205-
return float(val)
206+
try:
207+
return float(val)
208+
except ValueError as val_err:
209+
"""Fail client requests with invalid quality value.
210+
211+
Ref: https://github.com/cherrypy/cherrypy/issues/1370
212+
"""
213+
six.raise_from(
214+
cherrypy.HTTPError(
215+
400,
216+
'Malformed HTTP header: `{}`'.
217+
format(str(self)),
218+
),
219+
val_err,
220+
)
206221

207222
def __cmp__(self, other):
208223
diff = builtins.cmp(self.qvalue, other.qvalue)

Diff for: cherrypy/test/test_encoding.py

+5
Original file line numberDiff line numberDiff line change
@@ -360,6 +360,11 @@ def testEncoding(self):
360360
self.getPage('/utf8', [('Accept-Charset', 'us-ascii, ISO-8859-1')])
361361
self.assertStatus('406 Not Acceptable')
362362

363+
# Test malformed quality value, which should raise 400.
364+
self.getPage('/mao_zedong', [('Accept-Charset',
365+
'ISO-8859-1,utf-8;q=0.7,*;q=0.7)')])
366+
self.assertStatus('400 Bad Request')
367+
363368
def testGzip(self):
364369
zbuf = io.BytesIO()
365370
zfile = gzip.GzipFile(mode='wb', fileobj=zbuf, compresslevel=9)

0 commit comments

Comments
 (0)