From: Martin Panter <vadmium+py@gmail.com>
Date: Sun, 3 Apr 2016 00:45:46 +0000 (+0000)
Subject: Issue #26586: Handle excessive header fields in http.server, by Xiang Zhang
X-Git-Tag: v3.6.0a1~277^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=acc03195b0609490a4e5f8b1d9eb504c22c6526e;p=python

Issue #26586: Handle excessive header fields in http.server, by Xiang Zhang
---

diff --git a/Lib/http/server.py b/Lib/http/server.py
index e1b71abf37..fac4d9db39 100644
--- a/Lib/http/server.py
+++ b/Lib/http/server.py
@@ -337,6 +337,13 @@ class BaseHTTPRequestHandler(socketserver.StreamRequestHandler):
                 HTTPStatus.BAD_REQUEST,
                 "Line too long")
             return False
+        except http.client.HTTPException as err:
+            self.send_error(
+                HTTPStatus.REQUEST_HEADER_FIELDS_TOO_LARGE,
+                "Too many headers",
+                str(err)
+            )
+            return False
 
         conntype = self.headers.get('Connection', "")
         if conntype.lower() == 'close':
diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
index d4c8eabd42..b71fa5e851 100644
--- a/Lib/test/test_httpservers.py
+++ b/Lib/test/test_httpservers.py
@@ -858,6 +858,13 @@ class BaseHTTPRequestHandlerTestCase(unittest.TestCase):
         self.assertFalse(self.handler.get_called)
         self.assertEqual(self.handler.requestline, 'GET / HTTP/1.1')
 
+    def test_too_many_headers(self):
+        result = self.send_typical_request(
+            b'GET / HTTP/1.1\r\n' + b'X-Foo: bar\r\n' * 101 + b'\r\n')
+        self.assertEqual(result[0], b'HTTP/1.1 431 Too many headers\r\n')
+        self.assertFalse(self.handler.get_called)
+        self.assertEqual(self.handler.requestline, 'GET / HTTP/1.1')
+
     def test_close_connection(self):
         # handle_one_request() should be repeatedly called until
         # it sets close_connection
diff --git a/Misc/NEWS b/Misc/NEWS
index e2e37a4064..9682b409d1 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -99,6 +99,10 @@ Core and Builtins
 Library
 -------
 
+- Issue #26586: In http.server, respond with "413 Request header fields too
+  large" if there are too many header fields to parse, rather than killing
+  the connection and raising an unhandled exception.  Patch by Xiang Zhang.
+
 - Issue #22854: Change BufferedReader.writable() and
   BufferedWriter.readable() to always return False.