[issue37093] http.client aborts header parsing upon encountering non-ASCII header names

Change by Dong-hee Na : -- nosy: +corona10 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue37093] http.client aborts header parsing upon encountering non-ASCII header names

Tim Burke added the comment: Note that because http.server uses http.client to parse headers [0], this can pose a request-smuggling vector depending on how you've designed your system. For example, you might have a storage system with a user-facing HTTP server that is in charge of *

[issue37093] http.client aborts header parsing upon encountering non-ASCII header names

Change by Tim Burke : -- keywords: +patch pull_requests: +13672 stage: test needed -> patch review pull_request: https://github.com/python/cpython/pull/13788 ___ Python tracker

[issue37093] http.client aborts header parsing upon encountering non-ASCII header names

Change by SilentGhost : -- components: +Library (Lib) nosy: +barry, maxking, r.david.murray stage: -> test needed type: -> behavior versions: -Python 3.5, Python 3.6 ___ Python tracker

[issue37093] http.client aborts header parsing upon encountering non-ASCII header names

New submission from Tim Burke : First, spin up a fairly trivial http server: import wsgiref.simple_server def app(environ, start_response): start_response('200 OK', [ ('Some-Canonical', 'headers'), ('sOme-CRAzY', 'hEaDERs'),