Skip to content

Commit 53476df

Browse files
Disallow arbitrary sequence types in version (#7835) (#7836)
(cherry picked from commit 1e86b77)
1 parent 9d712f2 commit 53476df

File tree

3 files changed

+20
-5
lines changed

3 files changed

+20
-5
lines changed

CHANGES/7835.bugfix

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Fixed arbitrary sequence types being allowed to inject headers via version parameter -- by :user:`Dreamsorcerer`

aiohttp/client_reqrep.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -706,8 +706,8 @@ async def send(self, conn: "Connection") -> "ClientResponse":
706706
self.headers[hdrs.CONNECTION] = connection
707707

708708
# status + headers
709-
status_line = "{0} {1} HTTP/{2[0]}.{2[1]}".format(
710-
self.method, path, self.version
709+
status_line = "{0} {1} HTTP/{v.major}.{v.minor}".format(
710+
self.method, path, v=self.version
711711
)
712712
await writer.write_headers(status_line, self.headers)
713713

tests/test_client_request.py

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
_gen_default_accept_encoding,
2222
_merge_ssl_params,
2323
)
24+
from aiohttp.http import HttpVersion
2425
from aiohttp.test_utils import make_mocked_coro
2526

2627

@@ -623,18 +624,18 @@ async def test_connection_header(loop, conn) -> None:
623624
req.headers.clear()
624625

625626
req.keep_alive.return_value = True
626-
req.version = (1, 1)
627+
req.version = HttpVersion(1, 1)
627628
req.headers.clear()
628629
await req.send(conn)
629630
assert req.headers.get("CONNECTION") is None
630631

631-
req.version = (1, 0)
632+
req.version = HttpVersion(1, 0)
632633
req.headers.clear()
633634
await req.send(conn)
634635
assert req.headers.get("CONNECTION") == "keep-alive"
635636

636637
req.keep_alive.return_value = False
637-
req.version = (1, 1)
638+
req.version = HttpVersion(1, 1)
638639
req.headers.clear()
639640
await req.send(conn)
640641
assert req.headers.get("CONNECTION") == "close"
@@ -1161,6 +1162,19 @@ async def gen():
11611162
resp.close()
11621163

11631164

1165+
async def test_bad_version(loop, conn) -> None:
1166+
req = ClientRequest(
1167+
"GET",
1168+
URL("http://python.org"),
1169+
loop=loop,
1170+
headers={"Connection": "Close"},
1171+
version=("1", "1\r\nInjected-Header: not allowed"),
1172+
)
1173+
1174+
with pytest.raises(AttributeError):
1175+
await req.send(conn)
1176+
1177+
11641178
async def test_custom_response_class(loop, conn) -> None:
11651179
class CustomResponse(ClientResponse):
11661180
def read(self, decode=False):

0 commit comments

Comments
 (0)