[
https://issues.apache.org/jira/browse/THRIFT-6266?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jens Geyer resolved THRIFT-6266.
--------------------------------
Fix Version/s: 0.25.0
Assignee: Jens Geyer
Resolution: Fixed
> Python: THttpServer accepts Content-Length values that are not valid HTTP
> numbers
> ---------------------------------------------------------------------------------
>
> Key: THRIFT-6266
> URL: https://issues.apache.org/jira/browse/THRIFT-6266
> Project: Thrift
> Issue Type: Bug
> Components: Python - Library
> Reporter: Jens Geyer
> Assignee: Jens Geyer
> Priority: Minor
> Fix For: 0.25.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> {{lib/py/src/server/THttpServer.py}} parses the header with a bare {{int()}}
> ({{:100}}):
> {code:python}
> length = self.headers['Content-Length']
> ...
> length = int(length)
> ...
> self.send_error(400, "Invalid Content-Length")
> {code}
> The field's grammar in RFC 9110 is one or more digits, and Python's {{int()}}
> accepts more than that:
> * a leading sign ({{+12}});
> * PEP 515 underscores ({{1_2}});
> * whitespace other than spaces and tabs around the number, such as a no-break
> space, a vertical tab or a form feed.
> Each of these is read as a length of 12, and the request is served. A peer
> and this server can therefore disagree about whether a message is well formed.
> Spaces and tabs around the value are a different case. They are not part of
> the field value (RFC 9110 section 5.5), so {{" 12 "}} is a valid length of 12.
> The D binding answered the same question for its HTTP transport in "Read HTTP
> header names and wire numbers against their grammars".
> h2. Suggested fix
> Strip spaces and tabs, then require what remains to consist of digits only.
> That means a full match of {{[0-9]+}}: a pattern ending in {{$}} would also
> accept a trailing newline. Otherwise, send the 400 that is already prepared
> for the malformed case.
> _Drafted with AI assistance (Claude Opus 5); reviewed and filed by Jens
> Geyer._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
