Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Header values allow newlines #6724

Closed
1 task done
Alainx277 opened this issue Apr 28, 2022 · 1 comment
Closed
1 task done

Header values allow newlines #6724

Alainx277 opened this issue Apr 28, 2022 · 1 comment
Labels

Comments

@Alainx277
Copy link

Alainx277 commented Apr 28, 2022

Describe the bug

When setting a header on a request, the header value can contain a newline (also with CR LF). This is not allowed in the HTTP specification and prematurely ends the request.

To Reproduce

  1. Listen on a local port with netcat or similar
    nc -l 45328
  2. Open a python async repl
    python -m asyncio
  3. Enter the following
import aiohttp
headers = { "test": "with newline\n" }
async with aiohttp.ClientSession() as session:
  await session.post("http://localhost:45328", data=b"test payload", headers=headers)
  1. Observe that the output from netcat shows an empty line in the middle of the request

Expected behavior

I expect an error to be raised because the header value is not allowed.

Logs/tracebacks

REPL:

> python -m asyncio
asyncio REPL 3.9.9
[Clang 13.0.0 (clang-1300.0.29.3)] on darwin
Use "await" directly instead of "asyncio.run()".
Type "help", "copyright", "credits" or "license" for more information.
>>> import asyncio
>>> import aiohttp
>>> headers = { "test": "with newline\n" }
>>> async with aiohttp.ClientSession() as session:
...     await session.post("http://localhost:45328", data=b"test payload", headers=headers)

Netcat:

> nc -l 45328
POST / HTTP/1.1
Host: localhost:45328
test: with newline

Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Python/3.9 aiohttp/3.7.4.post0
Content-Length: 12
Content-Type: application/octet-stream

test payload%

Python Version

Python 3.9.9

aiohttp Version

Name: aiohttp
Version: 3.7.4.post0

multidict Version

Name: multidict
Version: 5.2.0

yarl Version

Name: yarl
Version: 1.7.2

OS

macOS

Related component

Client

Additional context

No response

Code of Conduct

  • I agree to follow the aio-libs Code of Conduct
@Alainx277 Alainx277 added the bug label Apr 28, 2022
@Dreamsorcerer
Copy link
Member

Duplicate: #4818
Upgrade to latest release.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants