Issue #10714: Limit length of incoming request in http.server to 65536 bytes

for security reasons.  Initial patch by Ross Lagerwall.

diff --git a/Lib/http/server.py b/Lib/http/server.py
index 214071084bc41faa9431fab2f286d7df6b307466..f1538f40f9a43f20b99ad0c921bc3f49d9cc6f9e 100644 (file)
--- a/Lib/http/server.py
+++ b/Lib/http/server.py
@@ -358,7 +358,13 @@ class BaseHTTPRequestHandler(socketserver.StreamRequestHandler):
 
         """
         try:
-            self.raw_requestline = self.rfile.readline()
+            self.raw_requestline = self.rfile.readline(65537)
+            if len(self.raw_requestline) > 65536:
+                self.requestline = ''
+                self.request_version = ''
+                self.command = ''
+                self.send_error(414)
+                return
             if not self.raw_requestline:
                 self.close_connection = 1
                 return

diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
index b03637cd722665bdae6c5a0af427da420eb0f801..85b5ec496daa508b35380e636d73ddc48463d8e2 100644 (file)
--- a/Lib/test/test_httpservers.py
+++ b/Lib/test/test_httpservers.py
@@ -566,6 +566,12 @@ class BaseHTTPRequestHandlerTestCase(unittest.TestCase):
         self.assertEqual(sum(r == b'Connection: close\r\n' for r in result[1:-1]), 1)
         self.handler = usual_handler        # Restore to avoid breaking any subsequent tests.
 
+    def test_request_length(self):
+        # Issue #10714: huge request lines are discarded, to avoid Denial
+        # of Service attacks.
+        result = self.send_typical_request(b'GET ' + b'x' * 65537)
+        self.assertEqual(result[0], b'HTTP/1.1 414 Request-URI Too Long\r\n')
+        self.assertFalse(self.handler.get_called)
 
 class SimpleHTTPRequestHandlerTestCase(unittest.TestCase):
     """ Test url parsing """

diff --git a/Misc/ACKS b/Misc/ACKS
index 29afd595de1f21d3b89cd07aebfb12e637fd956e..eaf98a3299f47610f35a8e0d249493e519d907dd 100644 (file)
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -476,6 +476,7 @@ Andrej Krpic
 Ivan Krstić
 Andrew Kuchling
 Vladimir Kushnir
+Ross Lagerwall
 Cameron Laird
 Jean-Baptiste "Jiba" Lamy
 Torsten Landschoff

diff --git a/Misc/NEWS b/Misc/NEWS
index aa6f350fff797026ce779d88a8d09788a3691de1..d171e168a43df4f6e6471711df92d0a8f84c3246 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -20,6 +20,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #10714: Limit length of incoming request in http.server to 65536 bytes
+  for security reasons.  Initial patch by Ross Lagerwall.
+
 - Issue #9558: Fix distutils.command.build_ext with VS 8.0.
 
 - Issue #10667: Fast path for collections.Counter().