Mailman 3 July 2020 - Python-checkins

bpo-37703: improve asyncio.gather documentation regarding cancellation (GH-15312)
by Vinay Sharma July 20, 2020

July 20, 2020

https://github.com/python/cpython/commit/d42528a3a2c7d79fd2e6c9f2a02f3ce12d… commit: d42528a3a2c7d79fd2e6c9f2a02f3ce12d44c8cc branch: master author: Vinay Sharma <vinay04sharma(a)icloud.com> committer: GitHub <noreply(a)github.com> date: 2020-07-20T01:42:57-07:00 summary: bpo-37703: improve asyncio.gather documentation regarding cancellation (GH-15312) These changes updates the doc to comprehensively mention the behaviour of gather.cancel() Automerge-Triggered-By: @asvetlov files: A Misc/NEWS.d/next/Documentation/2019-08-16-20-25-42.bpo-37703.Qm_l_H.rst M Doc/library/asyncio-task.rst M Lib/asyncio/tasks.py diff --git a/Doc/library/asyncio-task.rst b/Doc/library/asyncio-task.rst index bac99b7950444..99f012540d989 100644 --- a/Doc/library/asyncio-task.rst +++ b/Doc/library/asyncio-task.rst @@ -387,6 +387,14 @@ Running Tasks Concurrently # Task C: Compute factorial(4)... # Task C: factorial(4) = 24 + .. note:: + If *return_exceptions* is False, cancelling gather() after it + has been marked done won't cancel any submitted awaitables. + For instance, gather can be marked done after propagating an + exception to the caller, therefore, calling ``gather.cancel()`` + after catching an exception (raised by one of the awaitables) from + gather won't cancel any other awaitables. + .. versionchanged:: 3.7 If the *gather* itself is cancelled, the cancellation is propagated regardless of *return_exceptions*. diff --git a/Lib/asyncio/tasks.py b/Lib/asyncio/tasks.py index 5e0692ef7778a..c37f0e1387980 100644 --- a/Lib/asyncio/tasks.py +++ b/Lib/asyncio/tasks.py @@ -729,6 +729,13 @@ def gather(*coros_or_futures, loop=None, return_exceptions=False): the outer Future is *not* cancelled in this case. (This is to prevent the cancellation of one child to cause other children to be cancelled.) + + If *return_exceptions* is False, cancelling gather() after it + has been marked done won't cancel any submitted awaitables. + For instance, gather can be marked done after propagating an + exception to the caller, therefore, calling ``gather.cancel()`` + after catching an exception (raised by one of the awaitables) from + gather won't cancel any other awaitables. """ if not coros_or_futures: if loop is None: diff --git a/Misc/NEWS.d/next/Documentation/2019-08-16-20-25-42.bpo-37703.Qm_l_H.rst b/Misc/NEWS.d/next/Documentation/2019-08-16-20-25-42.bpo-37703.Qm_l_H.rst new file mode 100644 index 0000000000000..a1a1c354b1688 --- /dev/null +++ b/Misc/NEWS.d/next/Documentation/2019-08-16-20-25-42.bpo-37703.Qm_l_H.rst @@ -0,0 +1,2 @@ +Updated Documentation to comprehensively elaborate on the behaviour of +gather.cancel()

1 0

Doc: fix import of asdl.py when called from outside Doc/. (GH-21529)
by Julien Palard July 20, 2020

July 20, 2020

https://github.com/python/cpython/commit/7f03445d01d5ece41c2ceef7254002e08e… commit: 7f03445d01d5ece41c2ceef7254002e08e8ab5a5 branch: master author: Julien Palard <julien(a)palard.fr> committer: GitHub <noreply(a)github.com> date: 2020-07-20T09:48:40+02:00 summary: Doc: fix import of asdl.py when called from outside Doc/. (GH-21529) files: M Doc/tools/extensions/asdl_highlight.py diff --git a/Doc/tools/extensions/asdl_highlight.py b/Doc/tools/extensions/asdl_highlight.py index 7d2ef011c1b76..b1989e5395707 100644 --- a/Doc/tools/extensions/asdl_highlight.py +++ b/Doc/tools/extensions/asdl_highlight.py @@ -1,6 +1,9 @@ import os import sys -sys.path.append(os.path.abspath("../Parser/")) +from pathlib import Path + +CPYTHON_ROOT = Path(__file__).resolve().parent.parent.parent.parent +sys.path.append(str(CPYTHON_ROOT / "Parser")) from pygments.lexer import RegexLexer, bygroups, include, words from pygments.token import (Comment, Generic, Keyword, Name, Operator,

1 0

bpo-40741: Update macOS installer to use SQLite 3.32.3 (GH-20979)
by Miss Islington (bot) July 20, 2020

July 20, 2020

https://github.com/python/cpython/commit/892fc8d328c65f7fd076b10c94380eccf7… commit: 892fc8d328c65f7fd076b10c94380eccf7427422 branch: 3.8 author: Miss Islington (bot) <31488909+miss-islington(a)users.noreply.github.com> committer: GitHub <noreply(a)github.com> date: 2020-07-19T23:37:57-07:00 summary: bpo-40741: Update macOS installer to use SQLite 3.32.3 (GH-20979) (cherry picked from commit 7cf1cb36ecafabff363790d245f809d3894fbbaf) Co-authored-by: Erlend Egeberg Aasland <erlend.aasland(a)innova.no> files: A Misc/NEWS.d/next/macOS/2020-06-19-14-19-08.bpo-40741.L7yTbm.rst M Mac/BuildScript/build-installer.py diff --git a/Mac/BuildScript/build-installer.py b/Mac/BuildScript/build-installer.py index 4fab4882efaeb..a58b922ce30b8 100755 --- a/Mac/BuildScript/build-installer.py +++ b/Mac/BuildScript/build-installer.py @@ -307,9 +307,9 @@ def library_recipes(): ), ), dict( - name="SQLite 3.32.2", - url="https://sqlite.org/2020/sqlite-autoconf-3320200.tar.gz", - checksum='eb498918a33159cdf8104997aad29e83', + name="SQLite 3.32.3", + url="https://sqlite.org/2020/sqlite-autoconf-3320300.tar.gz", + checksum='2e3911a3c15e85c2f2d040154bbe5ce3', extra_cflags=('-Os ' '-DSQLITE_ENABLE_FTS5 ' '-DSQLITE_ENABLE_FTS4 ' diff --git a/Misc/NEWS.d/next/macOS/2020-06-19-14-19-08.bpo-40741.L7yTbm.rst b/Misc/NEWS.d/next/macOS/2020-06-19-14-19-08.bpo-40741.L7yTbm.rst new file mode 100644 index 0000000000000..78a21b76c2fe4 --- /dev/null +++ b/Misc/NEWS.d/next/macOS/2020-06-19-14-19-08.bpo-40741.L7yTbm.rst @@ -0,0 +1 @@ +Update macOS installer to use SQLite 3.32.3.

1 0

bpo-40741: Update macOS installer to use SQLite 3.32.3 (GH-20979)
by Erlend Egeberg Aasland July 20, 2020

July 20, 2020

https://github.com/python/cpython/commit/7cf1cb36ecafabff363790d245f809d389… commit: 7cf1cb36ecafabff363790d245f809d3894fbbaf branch: master author: Erlend Egeberg Aasland <erlend.aasland(a)innova.no> committer: GitHub <noreply(a)github.com> date: 2020-07-20T02:19:18-04:00 summary: bpo-40741: Update macOS installer to use SQLite 3.32.3 (GH-20979) files: A Misc/NEWS.d/next/macOS/2020-06-19-14-19-08.bpo-40741.L7yTbm.rst M Mac/BuildScript/build-installer.py diff --git a/Mac/BuildScript/build-installer.py b/Mac/BuildScript/build-installer.py index 4fab4882efaeb..a58b922ce30b8 100755 --- a/Mac/BuildScript/build-installer.py +++ b/Mac/BuildScript/build-installer.py @@ -307,9 +307,9 @@ def library_recipes(): ), ), dict( - name="SQLite 3.32.2", - url="https://sqlite.org/2020/sqlite-autoconf-3320200.tar.gz", - checksum='eb498918a33159cdf8104997aad29e83', + name="SQLite 3.32.3", + url="https://sqlite.org/2020/sqlite-autoconf-3320300.tar.gz", + checksum='2e3911a3c15e85c2f2d040154bbe5ce3', extra_cflags=('-Os ' '-DSQLITE_ENABLE_FTS5 ' '-DSQLITE_ENABLE_FTS4 ' diff --git a/Misc/NEWS.d/next/macOS/2020-06-19-14-19-08.bpo-40741.L7yTbm.rst b/Misc/NEWS.d/next/macOS/2020-06-19-14-19-08.bpo-40741.L7yTbm.rst new file mode 100644 index 0000000000000..78a21b76c2fe4 --- /dev/null +++ b/Misc/NEWS.d/next/macOS/2020-06-19-14-19-08.bpo-40741.L7yTbm.rst @@ -0,0 +1 @@ +Update macOS installer to use SQLite 3.32.3.

1 0

bpo-41338: Fix DeprecationWarning in tests (GH-21542)
by Inada Naoki July 20, 2020

July 20, 2020

https://github.com/python/cpython/commit/902356a7b0564e2c9659aaec56211de4d3… commit: 902356a7b0564e2c9659aaec56211de4d37109d0 branch: master author: Inada Naoki <songofacandy(a)gmail.com> committer: GitHub <noreply(a)github.com> date: 2020-07-20T12:02:50+09:00 summary: bpo-41338: Fix DeprecationWarning in tests (GH-21542) files: M Lib/test/test_capi.py M Lib/test/test_csv.py M Lib/test/test_decimal.py diff --git a/Lib/test/test_capi.py b/Lib/test/test_capi.py index 55027c9cbcd43..892cc74ec3915 100644 --- a/Lib/test/test_capi.py +++ b/Lib/test/test_capi.py @@ -19,6 +19,7 @@ from test.support import MISSING_C_DOCSTRINGS from test.support import import_helper from test.support import threading_helper +from test.support import warnings_helper from test.support.script_helper import assert_python_failure, assert_python_ok try: import _posixsubprocess @@ -700,6 +701,11 @@ class Test_testcapi(unittest.TestCase): for name in dir(_testcapi) if name.startswith('test_') and not name.endswith('_code')) + # Suppress warning from PyUnicode_FromUnicode(). + @warnings_helper.ignore_warnings(category=DeprecationWarning) + def test_widechar(self): + _testcapi.test_widechar() + class Test_testinternalcapi(unittest.TestCase): locals().update((name, getattr(_testinternalcapi, name)) diff --git a/Lib/test/test_csv.py b/Lib/test/test_csv.py index a92870c24a1b4..38160220853ea 100644 --- a/Lib/test/test_csv.py +++ b/Lib/test/test_csv.py @@ -10,6 +10,7 @@ import gc import pickle from test import support +from test.support import warnings_helper from itertools import permutations from textwrap import dedent from collections import OrderedDict @@ -251,6 +252,7 @@ def test_writerows_errors(self): @support.cpython_only @support.requires_legacy_unicode_capi + @warnings_helper.ignore_warnings(category=DeprecationWarning) def test_writerows_legacy_strings(self): import _testcapi c = _testcapi.unicode_legacy_string('a') diff --git a/Lib/test/test_decimal.py b/Lib/test/test_decimal.py index 9dbae449fb61d..5d0992a66e6ce 100644 --- a/Lib/test/test_decimal.py +++ b/Lib/test/test_decimal.py @@ -38,6 +38,7 @@ from test.support import (TestFailed, run_with_locale, cpython_only) from test.support.import_helper import import_fresh_module +from test.support import warnings_helper import random import inspect import threading @@ -584,6 +585,7 @@ def test_explicit_from_string(self): @cpython_only @requires_legacy_unicode_capi + @warnings_helper.ignore_warnings(category=DeprecationWarning) def test_from_legacy_strings(self): import _testcapi Decimal = self.decimal.Decimal @@ -2820,6 +2822,7 @@ def test_none_args(self): @cpython_only @requires_legacy_unicode_capi + @warnings_helper.ignore_warnings(category=DeprecationWarning) def test_from_legacy_strings(self): import _testcapi c = self.decimal.Context()

1 0

bpo-38169: Increase code coverage for SharedMemory and ShareableList (GH-16139)
by Vinay Sharma July 19, 2020

July 19, 2020

https://github.com/python/cpython/commit/bfd0fbdc1352534b3c91b46dbae4285f52… commit: bfd0fbdc1352534b3c91b46dbae4285f5220acf4 branch: master author: Vinay Sharma <vinay04sharma(a)icloud.com> committer: GitHub <noreply(a)github.com> date: 2020-07-19T22:35:52+09:00 summary: bpo-38169: Increase code coverage for SharedMemory and ShareableList (GH-16139) files: A Misc/NEWS.d/next/Tests/2019-09-14-13-20-27.bpo-38169.hurq4B.rst M Lib/test/_test_multiprocessing.py diff --git a/Lib/test/_test_multiprocessing.py b/Lib/test/_test_multiprocessing.py index 6b4679f82da73..bde102ae2e051 100644 --- a/Lib/test/_test_multiprocessing.py +++ b/Lib/test/_test_multiprocessing.py @@ -3768,6 +3768,18 @@ def test_shared_memory_basics(self): self.assertGreaterEqual(sms.size, 512) self.assertGreaterEqual(len(sms.buf), sms.size) + # Verify __repr__ + self.assertIn(sms.name, str(sms)) + self.assertIn(str(sms.size), str(sms)) + + # Test pickling + sms.buf[0:6] = b'pickle' + pickled_sms = pickle.dumps(sms) + sms2 = pickle.loads(pickled_sms) + self.assertEqual(sms.name, sms2.name) + self.assertEqual(sms.size, sms2.size) + self.assertEqual(bytes(sms.buf[0:6]), bytes(sms2.buf[0:6]), b'pickle') + # Modify contents of shared memory segment through memoryview. sms.buf[0] = 42 self.assertEqual(sms.buf[0], 42) @@ -3975,6 +3987,23 @@ def test_shared_memory_ShareableList_basics(self): ) self.addCleanup(sl.shm.unlink) + # Verify __repr__ + self.assertIn(sl.shm.name, str(sl)) + self.assertIn(str(list(sl)), str(sl)) + + # Index Out of Range (get) + with self.assertRaises(IndexError): + sl[7] + + # Index Out of Range (set) + with self.assertRaises(IndexError): + sl[7] = 2 + + # Assign value without format change (str -> str) + current_format = sl._get_packing_format(0) + sl[0] = 'howdy' + self.assertEqual(current_format, sl._get_packing_format(0)) + # Verify attributes are readable. self.assertEqual(sl.format, '8s8sdqxxxxxx?xxxxxxxx?q') diff --git a/Misc/NEWS.d/next/Tests/2019-09-14-13-20-27.bpo-38169.hurq4B.rst b/Misc/NEWS.d/next/Tests/2019-09-14-13-20-27.bpo-38169.hurq4B.rst new file mode 100644 index 0000000000000..3972b9d440a87 --- /dev/null +++ b/Misc/NEWS.d/next/Tests/2019-09-14-13-20-27.bpo-38169.hurq4B.rst @@ -0,0 +1 @@ +Increase code coverage for SharedMemory and ShareableList

1 0

bpo-41205: Document Decimal power 0 to the 0 (GH-21386)
by Miss Islington (bot) July 19, 2020

July 19, 2020

https://github.com/python/cpython/commit/dac8a3a15647d016842e2ae7284cefa27c… commit: dac8a3a15647d016842e2ae7284cefa27ce5e838 branch: 3.8 author: Miss Islington (bot) <31488909+miss-islington(a)users.noreply.github.com> committer: GitHub <noreply(a)github.com> date: 2020-07-19T04:10:47-07:00 summary: bpo-41205: Document Decimal power 0 to the 0 (GH-21386) Co-authored-by: Mark Dickinson <dickinsm(a)gmail.com> (cherry picked from commit 10e466448f67850ed7bb2e2a4e7f017f2b050cad) Co-authored-by: Srinivas Reddy Thatiparthy (శ్రీనివాస్ రెడ్డి తాటిపర్తి) <thatiparthysreenivas(a)gmail.com> files: M Doc/library/decimal.rst diff --git a/Doc/library/decimal.rst b/Doc/library/decimal.rst index 8169bd358c701..38173f18ca660 100644 --- a/Doc/library/decimal.rst +++ b/Doc/library/decimal.rst @@ -1357,6 +1357,9 @@ In addition to the three supplied contexts, new contexts can be created with the The rounding mode of the context is used. Results are always correctly-rounded in the Python version. + ``Decimal(0) ** Decimal(0)`` results in ``InvalidOperation``, and if ``InvalidOperation`` + is not trapped, then results in ``Decimal('NaN')``. + .. versionchanged:: 3.3 The C module computes :meth:`power` in terms of the correctly-rounded :meth:`exp` and :meth:`ln` functions. The result is well-defined but

1 0

bpo-41205: Document Decimal power 0 to the 0 (GH-21386)
by Srinivas Reddy Thatiparthy (శ్రీనివాస్ రెడ ్డి తాటిపర్తి) July 19, 2020

July 19, 2020

https://github.com/python/cpython/commit/10e466448f67850ed7bb2e2a4e7f017f2b… commit: 10e466448f67850ed7bb2e2a4e7f017f2b050cad branch: master author: Srinivas Reddy Thatiparthy (శ్రీనివాస్ రెడ్డి తాటిపర్తి) <thatiparthysreenivas(a)gmail.com> committer: GitHub <noreply(a)github.com> date: 2020-07-19T13:03:43+02:00 summary: bpo-41205: Document Decimal power 0 to the 0 (GH-21386) Co-authored-by: Mark Dickinson <dickinsm(a)gmail.com> files: M Doc/library/decimal.rst diff --git a/Doc/library/decimal.rst b/Doc/library/decimal.rst index 38ad04177c5e8..e194649e30d85 100644 --- a/Doc/library/decimal.rst +++ b/Doc/library/decimal.rst @@ -1357,6 +1357,9 @@ In addition to the three supplied contexts, new contexts can be created with the The rounding mode of the context is used. Results are always correctly-rounded in the Python version. + ``Decimal(0) ** Decimal(0)`` results in ``InvalidOperation``, and if ``InvalidOperation`` + is not trapped, then results in ``Decimal('NaN')``. + .. versionchanged:: 3.3 The C module computes :meth:`power` in terms of the correctly-rounded :meth:`exp` and :meth:`ln` functions. The result is well-defined but

1 0

bpo-39603: Prevent header injection in http methods (GH-18485) (GH-21539)
by Miss Islington (bot) July 19, 2020

July 19, 2020

https://github.com/python/cpython/commit/f02de961b9f19a5db0ead56305fe0057a7… commit: f02de961b9f19a5db0ead56305fe0057a78787ae branch: 3.6 author: Miss Islington (bot) <31488909+miss-islington(a)users.noreply.github.com> committer: GitHub <noreply(a)github.com> date: 2020-07-19T05:28:45-04:00 summary: bpo-39603: Prevent header injection in http methods (GH-18485) (GH-21539) reject control chars in http method in http.client.putrequest to prevent http header injection (cherry picked from commit 8ca8a2e8fb068863c1138f07e3098478ef8be12e) Co-authored-by: AMIR <31338382+amiremohamadi(a)users.noreply.github.com> files: A Misc/NEWS.d/next/Security/2020-02-12-14-17-39.bpo-39603.Gt3RSg.rst M Lib/http/client.py M Lib/test/test_httplib.py diff --git a/Lib/http/client.py b/Lib/http/client.py index c0ac7db6f40a0..53581eca20587 100644 --- a/Lib/http/client.py +++ b/Lib/http/client.py @@ -151,6 +151,10 @@ # _is_allowed_url_pchars_re = re.compile(r"^[/!$&'()*+,;=:@%a-zA-Z0-9._~-]+$") # We are more lenient for assumed real world compatibility purposes. +# These characters are not allowed within HTTP method names +# to prevent http header injection. +_contains_disallowed_method_pchar_re = re.compile('[\x00-\x1f]') + # We always set the Content-Length header for these methods because some # servers will otherwise respond with a 411 _METHODS_EXPECTING_BODY = {'PATCH', 'POST', 'PUT'} @@ -1119,6 +1123,8 @@ def putrequest(self, method, url, skip_host=False, else: raise CannotSendRequest(self.__state) + self._validate_method(method) + # Save the method for use later in the response phase self._method = method @@ -1209,6 +1215,15 @@ def _encode_request(self, request): # ASCII also helps prevent CVE-2019-9740. return request.encode('ascii') + def _validate_method(self, method): + """Validate a method name for putrequest.""" + # prevent http header injection + match = _contains_disallowed_method_pchar_re.search(method) + if match: + raise ValueError( + f"method can't contain control characters. {method!r} " + f"(found at least {match.group()!r})") + def _validate_path(self, url): """Validate a url for putrequest.""" # Prevent CVE-2019-9740. diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py index fcd9231666ede..03e049b13fd21 100644 --- a/Lib/test/test_httplib.py +++ b/Lib/test/test_httplib.py @@ -359,6 +359,28 @@ def test_headers_debuglevel(self): self.assertEqual(lines[2], "header: Second: val") +class HttpMethodTests(TestCase): + def test_invalid_method_names(self): + methods = ( + 'GET\r', + 'POST\n', + 'PUT\n\r', + 'POST\nValue', + 'POST\nHOST:abc', + 'GET\nrHost:abc\n', + 'POST\rRemainder:\r', + 'GET\rHOST:\n', + '\nPUT' + ) + + for method in methods: + with self.assertRaisesRegex( + ValueError, "method can't contain control characters"): + conn = client.HTTPConnection('example.com') + conn.sock = FakeSocket(None) + conn.request(method=method, url="/") + + class TransferEncodingTest(TestCase): expected_body = b"It's just a flesh wound" diff --git a/Misc/NEWS.d/next/Security/2020-02-12-14-17-39.bpo-39603.Gt3RSg.rst b/Misc/NEWS.d/next/Security/2020-02-12-14-17-39.bpo-39603.Gt3RSg.rst new file mode 100644 index 0000000000000..990affc3edd9d --- /dev/null +++ b/Misc/NEWS.d/next/Security/2020-02-12-14-17-39.bpo-39603.Gt3RSg.rst @@ -0,0 +1,2 @@ +Prevent http header injection by rejecting control characters in +http.client.putrequest(...).

1 0

bpo-39603: Prevent header injection in http methods (GH-18485) (GH-21538)
by Miss Islington (bot) July 19, 2020

July 19, 2020

https://github.com/python/cpython/commit/ca75fec1ed358f7324272608ca952b2d82… commit: ca75fec1ed358f7324272608ca952b2d8226d11a branch: 3.7 author: Miss Islington (bot) <31488909+miss-islington(a)users.noreply.github.com> committer: GitHub <noreply(a)github.com> date: 2020-07-19T05:27:35-04:00 summary: bpo-39603: Prevent header injection in http methods (GH-18485) (GH-21538) reject control chars in http method in http.client.putrequest to prevent http header injection (cherry picked from commit 8ca8a2e8fb068863c1138f07e3098478ef8be12e) Co-authored-by: AMIR <31338382+amiremohamadi(a)users.noreply.github.com> files: A Misc/NEWS.d/next/Security/2020-02-12-14-17-39.bpo-39603.Gt3RSg.rst M Lib/http/client.py M Lib/test/test_httplib.py diff --git a/Lib/http/client.py b/Lib/http/client.py index 09c57af865ee0..04cd8f7d84986 100644 --- a/Lib/http/client.py +++ b/Lib/http/client.py @@ -150,6 +150,10 @@ # _is_allowed_url_pchars_re = re.compile(r"^[/!$&'()*+,;=:@%a-zA-Z0-9._~-]+$") # We are more lenient for assumed real world compatibility purposes. +# These characters are not allowed within HTTP method names +# to prevent http header injection. +_contains_disallowed_method_pchar_re = re.compile('[\x00-\x1f]') + # We always set the Content-Length header for these methods because some # servers will otherwise respond with a 411 _METHODS_EXPECTING_BODY = {'PATCH', 'POST', 'PUT'} @@ -1109,6 +1113,8 @@ def putrequest(self, method, url, skip_host=False, else: raise CannotSendRequest(self.__state) + self._validate_method(method) + # Save the method for use later in the response phase self._method = method @@ -1199,6 +1205,15 @@ def _encode_request(self, request): # ASCII also helps prevent CVE-2019-9740. return request.encode('ascii') + def _validate_method(self, method): + """Validate a method name for putrequest.""" + # prevent http header injection + match = _contains_disallowed_method_pchar_re.search(method) + if match: + raise ValueError( + f"method can't contain control characters. {method!r} " + f"(found at least {match.group()!r})") + def _validate_path(self, url): """Validate a url for putrequest.""" # Prevent CVE-2019-9740. diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py index 891393ab869e6..3fa0691d3ad8f 100644 --- a/Lib/test/test_httplib.py +++ b/Lib/test/test_httplib.py @@ -363,6 +363,28 @@ def test_headers_debuglevel(self): self.assertEqual(lines[3], "header: Second: val2") +class HttpMethodTests(TestCase): + def test_invalid_method_names(self): + methods = ( + 'GET\r', + 'POST\n', + 'PUT\n\r', + 'POST\nValue', + 'POST\nHOST:abc', + 'GET\nrHost:abc\n', + 'POST\rRemainder:\r', + 'GET\rHOST:\n', + '\nPUT' + ) + + for method in methods: + with self.assertRaisesRegex( + ValueError, "method can't contain control characters"): + conn = client.HTTPConnection('example.com') + conn.sock = FakeSocket(None) + conn.request(method=method, url="/") + + class TransferEncodingTest(TestCase): expected_body = b"It's just a flesh wound" diff --git a/Misc/NEWS.d/next/Security/2020-02-12-14-17-39.bpo-39603.Gt3RSg.rst b/Misc/NEWS.d/next/Security/2020-02-12-14-17-39.bpo-39603.Gt3RSg.rst new file mode 100644 index 0000000000000..990affc3edd9d --- /dev/null +++ b/Misc/NEWS.d/next/Security/2020-02-12-14-17-39.bpo-39603.Gt3RSg.rst @@ -0,0 +1,2 @@ +Prevent http header injection by rejecting control characters in +http.client.putrequest(...).

1 0