Skip to content

gh-144370: Disallow usage of control characters in status, headers and values for security #144371

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
benediktjohannes wants to merge 3 commits into
base: main
Choose a base branch
from
+11 −5
Open

gh-144370: Disallow usage of control characters in status, headers and values for security #144371

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3b0169b
Disallow usage of control characters in status, headers and values fo…
benediktjohannes Jan 31, 2026
9414df2
Add missing import of "re"
benediktjohannes Jan 31, 2026
49ddbca
📜🤖 Added by blurb_it.
blurb-it[bot] Jan 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 10 additions & 5 deletions Lib/wsgiref/handlers.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
from .util import FileWrapper, guess_scheme, is_hop_by_hop
from .headers import Headers

import sys, os, time
import sys, os, time, re

__all__ = [
'BaseHandler', 'SimpleHandler', 'BaseCGIHandler', 'CGIHandler',
Expand All @@ -16,6 +16,9 @@
"Jan", "Feb", "Mar", "Apr", "May", "Jun",
"Jul", "Aug", "Sep", "Oct", "Nov", "Dec"]

_name_disallowed = re.compile(r'[\x00-\x1F\x7F]')
_value_disallowed = re.compile(r'[\x00-\x08\x0A-\x1F\x7F]')
Copy link
Member

@vstinner vstinner Feb 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would prefer to wait until PR gh-144118 is merged, and then get these regexs from wsgiref.headers (line 4).


def format_date_time(timestamp):
year, month, day, hh, mm, ss, wd, y, z = time.gmtime(timestamp)
return "%s, %02d %3s %4d %02d:%02d:%02d GMT" % (
Expand Down Expand Up @@ -237,13 +240,13 @@ def start_response(self, status, headers,exc_info=None):

self.status = status
self.headers = self.headers_class(headers)
status = self._convert_string_type(status, "Status")
status = self._convert_string_type(status, "Status", name=False)
self._validate_status(status)

if __debug__:
for name, val in headers:
name = self._convert_string_type(name, "Header name")
val = self._convert_string_type(val, "Header value")
name = self._convert_string_type(name, "Header name", name=True)
val = self._convert_string_type(val, "Header value", name=False)
assert not is_hop_by_hop(name),\
f"Hop-by-hop header, '{name}: {val}', not allowed"

Expand All @@ -257,9 +260,11 @@ def _validate_status(self, status):
if status[3] != " ":
raise AssertionError("Status message must have a space after code")

def _convert_string_type(self, value, title):
def _convert_string_type(self, value, title, *, name=True):
Copy link
Member

@vstinner vstinner Feb 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It may be safer to always require the name parameter:

Suggested change
def _convert_string_type(self, value, title, *, name=True):
def _convert_string_type(self, value, title, *, name):

"""Convert/check value type."""
if type(value) is str:
if (_name_disallowed if name else _value_disallowed).search(value):
Copy link
Member

@vstinner vstinner Feb 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nitpick: I would prefer to write this code on two lines for better readability:

Suggested change
if (_name_disallowed if name else _value_disallowed).search(value):
regex = (_name_disallowed_re if name else _value_disallowed_re)
if regex.search(value):

raise ValueError("Control characters not allowed in headers and values")
return value
raise AssertionError(
"{0} must be of type str (got {1})".format(title, repr(value))
Expand Down
1 change: 1 addition & 0 deletions Misc/NEWS.d/next/Security/2026-01-31-21-56-54.gh-issue-144370.fp9m8t.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Disallow usage of control characters in status, headers and values in ``Lib/wsgiref/handlers.py`` for security. Patch by Benedikt Johannes.
Loading