gnu/packages/patches/python-CVE-2020-26116.patch

   1 Fix CVE-2020-26116:
   2
   3 https://cve.circl.lu/cve/CVE-2020-26116
   4 https://bugs.python.org/issue39603
   5
   6 Taken from upstream (sans test and NEWS update):
   7 https://github.com/python/cpython/commit/668d321476d974c4f51476b33aaca870272523bf
   8
   9 diff --git a/Lib/http/client.py b/Lib/http/client.py
  10 --- a/Lib/http/client.py
  11 +++ b/Lib/http/client.py
  12 @@ -147,6 +147,10 @@
  13  #  _is_allowed_url_pchars_re = re.compile(r"^[/!$&'()*+,;=:@%a-zA-Z0-9._~-]+$")
  14  # We are more lenient for assumed real world compatibility purposes.
  15
  16 +# These characters are not allowed within HTTP method names
  17 +# to prevent http header injection.
  18 +_contains_disallowed_method_pchar_re = re.compile('[\x00-\x1f]')
  19 +
  20  # We always set the Content-Length header for these methods because some
  21  # servers will otherwise respond with a 411
  22  _METHODS_EXPECTING_BODY = {'PATCH', 'POST', 'PUT'}
  23 @@ -1087,6 +1091,8 @@ def putrequest(self, method, url, skip_host=False,
  24          else:
  25              raise CannotSendRequest(self.__state)
  26
  27 +        self._validate_method(method)
  28 +
  29          # Save the method for use later in the response phase
  30          self._method = method
  31
  32 @@ -1177,6 +1183,15 @@ def _encode_request(self, request):
  33          # ASCII also helps prevent CVE-2019-9740.
  34          return request.encode('ascii')
  35
  36 +    def _validate_method(self, method):
  37 +        """Validate a method name for putrequest."""
  38 +        # prevent http header injection
  39 +        match = _contains_disallowed_method_pchar_re.search(method)
  40 +        if match:
  41 +            raise ValueError(
  42 +                    f"method can't contain control characters. {method!r} "
  43 +                    f"(found at least {match.group()!r})")
  44 +
  45      def _validate_path(self, url):
  46          """Validate a url for putrequest."""
  47          # Prevent CVE-2019-9740.