New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[3.3][security] bpo-22928: Disabled HTTP header injections in http.client #2861

Closed
wants to merge 1 commit into
base: 3.3
from

Conversation

Projects
None yet
3 participants
@vstinner
Member

vstinner commented Jul 25, 2017

Original patch by Demian Brecht.

Changed for the 3.3 backport:

  • remove subTest() from change
  • _is_legal_header_name regex: replace .fullmatch with .match, but
    add \A at start and \Z at end of the regex

(cherry picked from commit a112a8a)

https://bugs.python.org/issue22928

Issue #22928: Disabled HTTP header injections in http.client.
Original patch by Demian Brecht.

Changed for the 3.3 backport:

* remove subTest() from change
* _is_legal_header_name regex: replace .fullmatch with .match, but
  add \A at start and \Z at end of the regex

(cherry picked from commit a112a8a)

@vstinner vstinner changed the title from [3.3][security] Issue #22928: Disabled HTTP header injections in http.client. to [3.3][security] bpo-22928: Disabled HTTP header injections in http.client Jul 25, 2017

@vstinner

This comment has been minimized.

Show comment
Hide comment
@vstinner

vstinner Jul 25, 2017

Member

About the CI: test_pty failed once, but passed when run again.

It seems like on 3.3, if a test fails once, the overall test suite is considered as failed, even if the test pass when run again. On all other branches, regrtest would succeed in that case.

Member

vstinner commented Jul 25, 2017

About the CI: test_pty failed once, but passed when run again.

It seems like on 3.3, if a test fails once, the overall test suite is considered as failed, even if the test pass when run again. On all other branches, regrtest would succeed in that case.

@vstinner

This comment has been minimized.

Show comment
Hide comment
@vstinner

vstinner Jul 25, 2017

Member

I scheduled a new Travis CI run and now all tests fail (test_pty didn't fail).

Member

vstinner commented Jul 25, 2017

I scheduled a new Travis CI run and now all tests fail (test_pty didn't fail).

@vstinner

This comment has been minimized.

Show comment
Hide comment
@vstinner

vstinner Jul 25, 2017

Member

Oh, @serhiy-storchaka proposed almost the same PR a few days ago: PR #2817. I will close this one, once @serhiy-storchaka updated his PR with my suggestions.

Member

vstinner commented Jul 25, 2017

Oh, @serhiy-storchaka proposed almost the same PR a few days ago: PR #2817. I will close this one, once @serhiy-storchaka updated his PR with my suggestions.

@vstinner

This comment has been minimized.

Show comment
Hide comment
@vstinner

vstinner Jul 25, 2017

Member

Abandonned in favor of @serhiy-storchaka PR #2817 which now LGTM.

Member

vstinner commented Jul 25, 2017

Abandonned in favor of @serhiy-storchaka PR #2817 which now LGTM.

@vstinner vstinner closed this Jul 25, 2017

@vstinner vstinner deleted the vstinner:http_injection33 branch Jul 25, 2017

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment