gh-150752 started validating the Content-Length value against the
RFC 9112 grammar (1*DIGIT), but the compat32 header parser keeps
trailing SP/HTAB in the field value, so "Content-Length: 5 " is now
treated as a missing header. HTTPResponse then assumes that the
connection will close and read() blocks until the server closes it,
which never happens on a keep-alive connection.
RFC 9112, section 5.1 says that optional whitespace around a field
value is excluded by parsers. Strip SP/HTAB before the grammar check;
values such as "+5", "5_0" and "5 0" are still rejected.
RFC 9112 defines Content-Length as 1*DIGIT and chunk-size as 1*HEXDIG, but int() also accepts a sign, underscores, surrounding whitespace and an 0x prefix, so malformed framing values were parsed instead of rejected.
* Replace pwd[0] with pwd.pw_name
* Replace pwd[2] with pwd.pw_uid
* Replace grp[0] with grp.gr_name
* Replace grp[2] with grp.gr_gid
* Replace pwd[3] with pwd.pw_gid
Previously such error responses were sent in the bare HTTP/0.9 style,
without a status line and headers.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
http.client read chunked-response trailer lines and skipped interim (1xx)
responses in unbounded loops, so a server streaming either forever would
hang the client even with a socket timeout set (data keeps arriving, so
the timeout never fires).
Trailer lines are now limited to max_response_headers (100 by default)
and interim responses to 100; HTTPException is raised past either limit.
Follow-up to gh-88188 for CVE-2021-3737, which bounded header lines
within an interim response but not these two sibling loops.
---
This issue was reported to us via [GHSA-w4q2-g22w-6fr4](https://github.com/python/cpython/security/advisories/GHSA-w4q2-g22w-6fr4) and was determined not to be high enough severity to handle privately.
Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`.
Co-authored-by: Victor Stinner <vstinner@python.org>
Co-authored-by: Victor Stinner <victor.stinner@gmail.com>
Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
Update selected RFC 2822 references to RFC 5322
RFC 2822 was obsoleted by RFC 5322 in 2008. This updates references
to use the current standard in documentation, docstrings, and comments.
It preserves RFC 2822 references in legacy API components to maintain their
historical context.
RFC 822 → RFC 2822 → RFC 5322 progression is explained where relevant.
In some places specific sections of RFC are referenced where it seems helpful.
Scout rule was applied in some places and RFC mentions format was
normalized in doc strings and comments.
Remove 'response_class' from getresponse docstring.
This variable is not documented as part of the API in the standard
library documentation; it should be considered as an implementation
detail and as such should not be included in the doc string.
Closes#57665.
Prior to issue #120485 these servers did not allow port reuse, which
makes sense as the behavior of port reuse is surprising if you're not
expecting it. It's unclear to me why these services were switched to
allow port reuse, but I believe the desired behavior (unless subclasses
opt in) is to not allow port reuse.
See also: https://bugzilla.redhat.com/show_bug.cgi?id=2323170
* Always quote strings with non-ASCII characters.
* Allow some non-separator and non-control characters (like "." or "-")
be unquoted.
* Always quote strings that end with "\n".
* Use the fullmatch() method for clarity and optimization.
The `http.server` module now supports serving over HTTPS using the `http.server.HTTPSServer` class.
This functionality is also exposed by the command-line interface (`python -m http.server`) through the
`--tls-cert`, `--tls-key` and `--tls-password-file` options.
* Revert "gh-128982: Substitute regular expression in `http.cookiejar.join_header_words` for an efficient alternative (GH-128983)"
This reverts commit 56e1900681.
* Add tests
The parameter `amt` of `HTTPResponse.read()`, which could be a negative integer,
has not been handled before and led to waiting for the connection to close
for `keep-alive connections`. Now, this has been fixed, and passing negative values
to `HTTPResponse().read()` works the same as passing `None` value.
* Add support for 'partitioned' attribute in http.cookies
Co-authored-by: Giles Copp <gilesc@dropbox.com>
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
Co-authored-by: Gregory P. Smith [Google LLC] <greg@krypto.org>
Gregory P. Smith