Disallow usage of control characters in status, headers and values for security

Author: benediktjohannes

Lib/wsgiref/handlers.py

@@ -16,6 +16,9 @@
               "Jan", "Feb", "Mar", "Apr", "May", "Jun",
               "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"]
 
+_name_disallowed = re.compile(r'[\x00-\x1F\x7F]')
+_value_disallowed = re.compile(r'[\x00-\x08\x0A-\x1F\x7F]')
+
 def format_date_time(timestamp):
     year, month, day, hh, mm, ss, wd, y, z = time.gmtime(timestamp)
     return "%s, %02d %3s %4d %02d:%02d:%02d GMT" % (
@@ -237,13 +240,13 @@ def start_response(self, status, headers,exc_info=None):
 
         self.status = status
         self.headers = self.headers_class(headers)
-        status = self._convert_string_type(status, "Status")
+        status = self._convert_string_type(status, "Status", name=False)
         self._validate_status(status)
 
         if __debug__:
             for name, val in headers:
-                name = self._convert_string_type(name, "Header name")
-                val = self._convert_string_type(val, "Header value")
+                name = self._convert_string_type(name, "Header name", name=True)
+                val = self._convert_string_type(val, "Header value", name=False)
                 assert not is_hop_by_hop(name),\
                        f"Hop-by-hop header, '{name}: {val}', not allowed"
 
@@ -257,9 +260,11 @@ def _validate_status(self, status):
         if status[3] != " ":
             raise AssertionError("Status message must have a space after code")
 
-    def _convert_string_type(self, value, title):
+    def _convert_string_type(self, value, title, *, name=True):
         """Convert/check value type."""
         if type(value) is str:
+            if (_name_disallowed if name else _value_disallowed).search(value):
+                raise ValueError("Control characters not allowed in headers and values")
             return value
         raise AssertionError(
             "{0} must be of type str (got {1})".format(title, repr(value))