From b7414e0fdb35d21612895cbb41f993808f755c40 Mon Sep 17 00:00:00 2001 From: Berker Peksag Date: Tue, 5 Aug 2014 07:15:57 +0300 Subject: [PATCH] Issue #16037: HTTPMessage.readheaders() raises an HTTPException when more than 100 headers are read. Patch by Jyrki Pulliainen and Daniel Eriksson. --- Lib/httplib.py | 6 ++++++ Lib/test/test_httplib.py | 7 +++++++ Misc/NEWS | 3 +++ 3 files changed, 16 insertions(+) diff --git a/Lib/httplib.py b/Lib/httplib.py index 5368cd9827..b2f6e5c3f5 100644 --- a/Lib/httplib.py +++ b/Lib/httplib.py @@ -215,6 +215,10 @@ MAXAMOUNT = 1048576 # maximal line length when calling readline(). _MAXLINE = 65536 +# maximum amount of headers accepted +_MAXHEADERS = 100 + + class HTTPMessage(mimetools.Message): def addheader(self, key, value): @@ -271,6 +275,8 @@ class HTTPMessage(mimetools.Message): elif self.seekable: tell = self.fp.tell while True: + if len(hlist) > _MAXHEADERS: + raise HTTPException("got more than %d headers" % _MAXHEADERS) if tell: try: startofline = tell() diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py index 72800e56ce..4b2a638a49 100644 --- a/Lib/test/test_httplib.py +++ b/Lib/test/test_httplib.py @@ -262,6 +262,13 @@ class BasicTest(TestCase): if resp.read() != "": self.fail("Did not expect response from HEAD request") + def test_too_many_headers(self): + headers = '\r\n'.join('Header%d: foo' % i for i in xrange(200)) + '\r\n' + text = ('HTTP/1.1 200 OK\r\n' + headers) + s = FakeSocket(text) + r = httplib.HTTPResponse(s) + self.assertRaises(httplib.HTTPException, r.begin) + def test_send_file(self): expected = 'GET /foo HTTP/1.1\r\nHost: example.com\r\n' \ 'Accept-Encoding: identity\r\nContent-Length:' diff --git a/Misc/NEWS b/Misc/NEWS index 27a632213c..1d9c9547fb 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -19,6 +19,9 @@ Core and Builtins Library ------- +- Issue #16037: HTTPMessage.readheaders() raises an HTTPException when more + than 100 headers are read. Patch by Jyrki Pulliainen and Daniel Eriksson. + - Issue #21580: Now Tkinter correctly handles binary "data" and "maskdata" configure options of tkinter.PhotoImage. -- 2.50.1