Prevent header spoofing via underscore/dash conflation

See https://www.djangoproject.com/weblog/2015/jan/13/security/
zopefoundation · Jun 18, 2019 · cf1374d · cf1374d
1 parent e0d83b0
commit cf1374d
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/ZServer/HTTPServer.py b/src/ZServer/HTTPServer.py
@@ -235,7 +235,7 @@ def get_environment(self, request,
             value=value.strip()
             if h2ehas(key) and value:
                 env[h2eget(key)]=value
-            else:
+            elif "_" not in key:
                 key='HTTP_%s' % ("_".join(key.split( "-"))).upper()
                 if value and not env_has(key):
                     env[key]=value