Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

[3.13] gh-143916: Reject control characters in wsgiref.headers.Headers (GH-143917)#143973

Merged
gpshead merged 1 commit into
python:3.13python/cpython:3.13from
gpshead:backport-f7fceed-3.13gpshead/cpython:backport-f7fceed-3.13Copy head branch name to clipboard
Jan 17, 2026
Merged

[3.13] gh-143916: Reject control characters in wsgiref.headers.Headers (GH-143917)#143973
gpshead merged 1 commit into
python:3.13python/cpython:3.13from
gpshead:backport-f7fceed-3.13gpshead/cpython:backport-f7fceed-3.13Copy head branch name to clipboard

Conversation

@gpshead

@gpshead gpshead commented Jan 17, 2026

Copy link
Copy Markdown
Member

(cherry picked from commit f7fceed)

…pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
@gpshead gpshead added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes labels Jan 17, 2026
@gpshead gpshead changed the title [3.13] gh-143916: Reject control characters in wsgiref.headers.Headers [3.13] gh-143916: Reject control characters in wsgiref.headers.Headers (GH-143917) Jan 17, 2026
@bedevere-app bedevere-app Bot added the type-security A security issue label Jan 17, 2026
@gpshead gpshead enabled auto-merge (squash) January 17, 2026 18:04
@gpshead gpshead merged commit 22e4d55 into python:3.13 Jan 17, 2026
45 of 46 checks passed
@miss-islington-app

Copy link
Copy Markdown

Thanks @gpshead for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12.
🐍🍒⛏🤖

@miss-islington-app

Copy link
Copy Markdown

Sorry, @gpshead, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 22e4d55285cee52bc4dbe061324e5f30bd4dee58 3.12

@miss-islington-app

Copy link
Copy Markdown

Sorry, @gpshead, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 22e4d55285cee52bc4dbe061324e5f30bd4dee58 3.11

@miss-islington-app

Copy link
Copy Markdown

Sorry, @gpshead, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 22e4d55285cee52bc4dbe061324e5f30bd4dee58 3.10

@bedevere-app

bedevere-app Bot commented Jan 17, 2026

Copy link
Copy Markdown

GH-143974 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Jan 17, 2026
gpshead added a commit to gpshead/cpython that referenced this pull request Jan 17, 2026
…Headers (pythonGH-143917) (pythonGH-143973)

pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
(cherry picked from commit 22e4d55)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
Co-authored-by: Seth Michael Larson <seth@python.org>
gpshead added a commit to gpshead/cpython that referenced this pull request Jan 17, 2026
…Headers (pythonGH-143917) (pythonGH-143973)

pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
(cherry picked from commit 22e4d55)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
Co-authored-by: Seth Michael Larson <seth@python.org>
@bedevere-app

bedevere-app Bot commented Jan 17, 2026

Copy link
Copy Markdown

GH-143975 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Jan 17, 2026
gpshead added a commit to gpshead/cpython that referenced this pull request Jan 17, 2026
…Headers (pythonGH-143917) (pythonGH-143973)

pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
(cherry picked from commit 22e4d55)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
Co-authored-by: Seth Michael Larson <seth@python.org>
@bedevere-app

bedevere-app Bot commented Jan 17, 2026

Copy link
Copy Markdown

GH-143976 is a backport of this pull request to the 3.10 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.10 only security fixes label Jan 17, 2026
Yhg1s pushed a commit that referenced this pull request Jan 19, 2026
GH-143917) (GH-143973) (#143974)

* Add 'test.support' fixture for C0 control characters
* gh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
(cherry picked from commit 22e4d55)

Co-authored-by: Seth Michael Larson <seth@python.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

type-security A security issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

Morty Proxy This is a proxified and sanitized view of the page, visit original site.