Fix #138: validate HTTP headers.

tornadoweb · Aug 23, 2014 · 187b4b7 · 187b4b7
1 parent 5582dd3
commit 187b4b7
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/cyclone/httpserver.py b/cyclone/httpserver.py
@@ -155,12 +155,16 @@ def _on_headers(self, data):
             if not version.startswith("HTTP/"):
                 raise _BadRequestException(
                     "Malformed HTTP version in HTTP Request-Line")
-            headers = httputil.HTTPHeaders.parse(data[eol:])
+            try:
+                headers = httputil.HTTPHeaders.parse(data[eol:])
+                content_length = int(headers.get("Content-Length", 0))
+            except ValueError:
+                raise _BadRequestException(
+                    "Malformed HTTP headers")
             self._request = HTTPRequest(
                 connection=self, method=method, uri=uri, version=version,
                 headers=headers, remote_ip=self._remote_ip)
 
-            content_length = int(headers.get("Content-Length", 0))
             if content_length:
                 if headers.get("Expect") == "100-continue":
                     self.transport.write("HTTP/1.1 100 (Continue)\r\n\r\n")