New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[3.3] bpo-22928: Disabled HTTP header injections in http.client. #2817

Merged
merged 2 commits into from Jul 26, 2017

Conversation

Projects
None yet
5 participants
@serhiy-storchaka
Copy link
Member

serhiy-storchaka commented Jul 22, 2017

Original patch by Demian Brecht.
(cherry picked from commit a112a8a)

https://bugs.python.org/issue22928

[3.3] Issue GH-22928: Disabled HTTP header injections in http.client.
Original patch by Demian Brecht..
(cherry picked from commit a112a8a)
@mention-bot

This comment has been minimized.

Copy link

mention-bot commented Jul 22, 2017

@serhiy-storchaka, thanks for your PR! By analyzing the history of the files in this pull request, we identified @pitrou, @gvanrossum and @orsenthil to be potential reviewers.

@vstinner

This comment has been minimized.

Copy link
Member

vstinner commented Jul 25, 2017

See my comment on the bpo: http://bugs.python.org/issue22928#msg299053


# the patterns for both name and value are more leniant than RFC
# definitions to allow for backwards compatibility
_is_legal_header_name = re.compile(rb'[^:\s][^:\r\n]*\Z').match

This comment has been minimized.

@vstinner

vstinner Jul 25, 2017

Member

Python 2.7 regex starts with \A. Is it useful?

This comment has been minimized.

@serhiy-storchaka

serhiy-storchaka Jul 25, 2017

Author Member

No. match() always matches from the start.

@vstinner
Copy link
Member

vstinner left a comment

LGTM.

@ned-deily ned-deily merged commit 8e88f6b into python:3.3 Jul 26, 2017

2 checks passed

bedevere/issue-number Issue number 22928 found
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details

@serhiy-storchaka serhiy-storchaka deleted the serhiy-storchaka:backport-a112a8a-3.3 branch Aug 9, 2017

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment