Skip to content

Response allows invalid status #1658

@RazerM

Description

@RazerM

I was accidentally passing a string status like '200' from Flask.

>>> from werkzeug import Response
>>> Response(status='200').status
'200'

This status isn't valid according to PEP 3333 and e.g. breaks Twisted's WSGI runner. Obviously the error was mine, but I thought perhaps Werkzeug should raise an error earlier.

Werkzeug already does some validation or coercion into the correct format:

>>> Response(status='abc').status
'0 abc'
>>> Response(status='').status
Traceback (most recent call last):
  File "/Users/frazer/.pyenv/versions/venv/lib/python3.7/site-packages/werkzeug/wrappers/base_response.py", line 314, in _set_status
    self._status_code = int(self._status.split(None, 1)[0])
IndexError: list index out of range

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/Users/frazer/.pyenv/versions/venv/lib/python3.7/site-packages/werkzeug/wrappers/base_response.py", line 202, in __init__
    self.status = status
  File "/Users/frazer/.pyenv/versions/venv/lib/python3.7/site-packages/werkzeug/wrappers/base_response.py", line 319, in _set_status
    raise ValueError("Empty status argument")
ValueError: Empty status argument

status only becomes invalid if both of these conditions are met:

  1. int(status) doesn't raise
  2. len(status.split(None, 1)) == 1

The current implementation:

@status.setter
def status(self, value):
try:
self._status = to_native(value)
except AttributeError:
raise TypeError("Invalid status argument")
try:
self._status_code = int(self._status.split(None, 1)[0])
except ValueError:
self._status_code = 0
self._status = "0 %s" % self._status
except IndexError:
raise ValueError("Empty status argument")

If line 315 used the property setter instead (self.status_code = ), the result would be valid:

>>> Response(status='200').status
'200 OK'

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions