Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Response allows invalid status #1658

Closed
RazerM opened this issue Nov 6, 2019 · 0 comments · Fixed by #1728
Closed

Response allows invalid status #1658

RazerM opened this issue Nov 6, 2019 · 0 comments · Fixed by #1728
Milestone

Comments

@RazerM
Copy link

RazerM commented Nov 6, 2019

I was accidentally passing a string status like '200' from Flask.

>>> from werkzeug import Response
>>> Response(status='200').status
'200'

This status isn't valid according to PEP 3333 and e.g. breaks Twisted's WSGI runner. Obviously the error was mine, but I thought perhaps Werkzeug should raise an error earlier.

Werkzeug already does some validation or coercion into the correct format:

>>> Response(status='abc').status
'0 abc'
>>> Response(status='').status
Traceback (most recent call last):
  File "/Users/frazer/.pyenv/versions/venv/lib/python3.7/site-packages/werkzeug/wrappers/base_response.py", line 314, in _set_status
    self._status_code = int(self._status.split(None, 1)[0])
IndexError: list index out of range

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/Users/frazer/.pyenv/versions/venv/lib/python3.7/site-packages/werkzeug/wrappers/base_response.py", line 202, in __init__
    self.status = status
  File "/Users/frazer/.pyenv/versions/venv/lib/python3.7/site-packages/werkzeug/wrappers/base_response.py", line 319, in _set_status
    raise ValueError("Empty status argument")
ValueError: Empty status argument

status only becomes invalid if both of these conditions are met:

  1. int(status) doesn't raise
  2. len(status.split(None, 1)) == 1

The current implementation:

@status.setter
def status(self, value):
try:
self._status = to_native(value)
except AttributeError:
raise TypeError("Invalid status argument")
try:
self._status_code = int(self._status.split(None, 1)[0])
except ValueError:
self._status_code = 0
self._status = "0 %s" % self._status
except IndexError:
raise ValueError("Empty status argument")

If line 315 used the property setter instead (self.status_code = ), the result would be valid:

>>> Response(status='200').status
'200 OK'
raymond-devries added a commit to raymond-devries/werkzeug that referenced this issue Feb 10, 2020
davidism pushed a commit to raymond-devries/werkzeug that referenced this issue Feb 10, 2020
raymond-devries added a commit to raymond-devries/werkzeug that referenced this issue Feb 11, 2020
raymond-devries added a commit to raymond-devries/werkzeug that referenced this issue Feb 11, 2020
Co-authored-by: lathamfell <lathamfell@gmail.com>
raymond-devries added a commit to raymond-devries/werkzeug that referenced this issue Feb 11, 2020
Co-authored-by: lathamfell <lathamfell@gmail.com>
raymond-devries added a commit to raymond-devries/werkzeug that referenced this issue Feb 11, 2020
Co-authored-by: lathamfell <lathamfell@gmail.com>
raymond-devries added a commit to raymond-devries/werkzeug that referenced this issue Feb 11, 2020
Co-authored-by: lathamfell <lathamfell@gmail.com>
raymond-devries added a commit to raymond-devries/werkzeug that referenced this issue Feb 11, 2020
Removed new tests to test through azure.

Co-authored-by: lathamfell <lathamfell@gmail.com>
raymond-devries added a commit to raymond-devries/werkzeug that referenced this issue Feb 11, 2020
Removed new tests to test through azure.

Co-authored-by: lathamfell <lathamfell@gmail.com>
raymond-devries added a commit to raymond-devries/werkzeug that referenced this issue Feb 11, 2020
…w tests to test through azure."

This reverts commit ef80905
raymond-devries added a commit to raymond-devries/werkzeug that referenced this issue Feb 11, 2020
…w tests to test through azure."

This reverts commit ef80905
raymond-devries added a commit to raymond-devries/werkzeug that referenced this issue Feb 11, 2020
Fixes pallets#1658

Co-authored-by: lathamfell <lathamfell@gmail.com>
raymond-devries added a commit to raymond-devries/werkzeug that referenced this issue Feb 11, 2020
Fixes pallets#1658

Co-authored-by: lathamfell <lathamfell@gmail.com>
raymond-devries added a commit to raymond-devries/werkzeug that referenced this issue Feb 11, 2020
Fixes pallets#1658

Co-authored-by: lathamfell <lathamfell@gmail.com>
raymond-devries added a commit to raymond-devries/werkzeug that referenced this issue Feb 11, 2020
Fixes pallets#1658

Co-authored-by: lathamfell <lathamfell@gmail.com>
raymond-devries added a commit to raymond-devries/werkzeug that referenced this issue Feb 11, 2020
Fixes pallets#1658

Co-authored-by: lathamfell <lathamfell@gmail.com>
raymond-devries added a commit to raymond-devries/werkzeug that referenced this issue Feb 11, 2020
…t cases.

Fixes pallets#1658

Co-authored-by: lathamfell <lathamfell@gmail.com>
raymond-devries added a commit to raymond-devries/werkzeug that referenced this issue Feb 11, 2020
Fixes pallets#1658

Co-authored-by: lathamfell <lathamfell@gmail.com>
raymond-devries added a commit to raymond-devries/werkzeug that referenced this issue Feb 12, 2020
Fixes pallets#1658

Co-authored-by: lathamfell <lathamfell@gmail.com>
raymond-devries added a commit to raymond-devries/werkzeug that referenced this issue Feb 12, 2020
Fixes pallets#1658

Co-authored-by: lathamfell <lathamfell@gmail.com>
@davidism davidism added this to the 2.0.0 milestone Mar 17, 2020
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Nov 13, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants