gh-144370: Disallow usage of control characters in status in `Lib/wsgiref/handlers.py` for security#144371

Merged

vstinner merged 65 commits into

python:mainfrom

benediktjohannes:patch-4

Mar 6, 2026

Commits on Jan 31, 2026

Disallow usage of control characters in status, headers and values for security
benediktjohannes
authored
3b0169b
Copy full SHA for 3b0169b
Add missing import of "re"
benediktjohannes
authored
9414df2
Copy full SHA for 9414df2
📜🤖 Added by blurb_it.
blurb-it[bot]
authored
49ddbca
Copy full SHA for 49ddbca

Commits on Feb 4, 2026

Update Lib/wsgiref/handlers.py
Show description for 5dd863b

benediktjohannes
and
vstinner
authored
5dd863b
Copy full SHA for 5dd863b
Update Lib/wsgiref/handlers.py
Show description for 3daaa72

benediktjohannes
and
vstinner
authored
3daaa72
Copy full SHA for 3daaa72
Update handlers.py
benediktjohannes
authored
8b149df
Copy full SHA for 8b149df
Update test_wsgiref.py
benediktjohannes
authored
010fd50
Copy full SHA for 010fd50
Update test_wsgiref.py
benediktjohannes
authored
8c9a691
Copy full SHA for 8c9a691
Update test_wsgiref.py
Show description for f301791
benediktjohannes
authored
f301791
Copy full SHA for f301791
Update test_wsgiref.py
benediktjohannes
authored
e3b78a0
Copy full SHA for e3b78a0
Test whether if statement is reachable
benediktjohannes
authored
24cfb00
Copy full SHA for 24cfb00
Update test_wsgiref.py
benediktjohannes
authored
75a89b8
Copy full SHA for 75a89b8
Update test_wsgiref.py
benediktjohannes
authored
e322666
Copy full SHA for e322666
Update test_wsgiref.py
benediktjohannes
authored
d731520
Copy full SHA for d731520
Update test_wsgiref.py
benediktjohannes
authored
c039ef2
Copy full SHA for c039ef2
Update test_wsgiref.py
benediktjohannes
authored
edb54a2
Copy full SHA for edb54a2
Update test_wsgiref.py
benediktjohannes
authored
b491245
Copy full SHA for b491245
Update test_wsgiref.py
benediktjohannes
authored
379937e
Copy full SHA for 379937e
Use more strict name=True for status because it shouldn't IMO include HTAB at all
benediktjohannes
authored
db12d86
Copy full SHA for db12d86
Change it back at first to see if test passes (and then change it back again and change test)
benediktjohannes
authored
f206bf3
Copy full SHA for f206bf3

Commits on Feb 6, 2026

Test if assertRaise raises an error that there is a mistake if no error is raised (this actually makes sense)
benediktjohannes
authored
b899f69
Copy full SHA for b899f69
this is just a temporary check as described above
benediktjohannes
authored
2d1b890
Copy full SHA for 2d1b890
Change this back
benediktjohannes
authored
df5cfdf
Copy full SHA for df5cfdf
Update handlers.py
benediktjohannes
authored
fb527db
Copy full SHA for fb527db
Remove this because I use the more strict one for status without the HTAB because it seems to me to have no use case in status
benediktjohannes
authored
e84de9a
Copy full SHA for e84de9a
Remove f"keys"
benediktjohannes
authored
95701e4
Copy full SHA for 95701e4
Add string again without keys
benediktjohannes
authored
82d7f7a
Copy full SHA for 82d7f7a
Update handlers.py
benediktjohannes
authored
76d011e
Copy full SHA for 76d011e
Update handlers.py
benediktjohannes
authored
5a4448b
Copy full SHA for 5a4448b
Update 2026-01-31-21-56-54.gh-issue-144370.fp9m8t.rst
benediktjohannes
authored
ecff2b9
Copy full SHA for ecff2b9

Commits on Feb 12, 2026

Merge branch 'python:main' into patch-4
benediktjohannes
authored
eaa3d98
Copy full SHA for eaa3d98
Use regexes out of headers
benediktjohannes
authored
8dc51e7
Copy full SHA for 8dc51e7
Remove unused regexes
benediktjohannes
authored
aec77f0
Copy full SHA for aec77f0

Commits on Feb 13, 2026

Update Lib/wsgiref/handlers.py
Show description for c7b66c4

benediktjohannes
and
vstinner
authored
c7b66c4
Copy full SHA for c7b66c4
Update Misc/NEWS.d/next/Security/2026-01-31-21-56-54.gh-issue-144370.fp9m8t.rst
Show description for e763355

benediktjohannes
and
vstinner
authored
e763355
Copy full SHA for e763355
Change this to injections because it's not only header injection, but also status injection
benediktjohannes
authored
4975676
Copy full SHA for 4975676
Update 2026-01-31-21-56-54.gh-issue-144370.fp9m8t.rst
benediktjohannes
authored
ab34b36
Copy full SHA for ab34b36
Update 2026-01-31-21-56-54.gh-issue-144370.fp9m8t.rst
benediktjohannes
authored
f0a59ef
Copy full SHA for f0a59ef
Added Seth Michael Larson to ACKS
benediktjohannes
authored
e369b59
Copy full SHA for e369b59
Merge branch 'python:main' into patch-4
benediktjohannes
authored
8ffdc16
Copy full SHA for 8ffdc16
Update handlers.py
benediktjohannes
authored
d952a16
Copy full SHA for d952a16
Update handlers.py
benediktjohannes
authored
c0e05d0
Copy full SHA for c0e05d0
Update handlers.py
benediktjohannes
authored
76b7444
Copy full SHA for 76b7444

Commits on Feb 14, 2026

Merge branch 'python:main' into patch-4
benediktjohannes
authored
6b40a8b
Copy full SHA for 6b40a8b
Update handlers.py
benediktjohannes
authored
dd791e7
Copy full SHA for dd791e7
Update 2026-01-31-21-56-54.gh-issue-144370.fp9m8t.rst
benediktjohannes
authored
adb3742
Copy full SHA for adb3742
Update Lib/test/test_wsgiref.py
Show description for 2ecd9be

benediktjohannes
and
vstinner
authored
2ecd9be
Copy full SHA for 2ecd9be
Apply suggestion from @vstinner
Show description for 0a1dd00

benediktjohannes
and
vstinner
authored
0a1dd00
Copy full SHA for 0a1dd00
Merge branch 'python:main' into patch-4
benediktjohannes
authored
1b62b1a
Copy full SHA for 1b62b1a
More usual wording
benediktjohannes
authored
3f15031
Copy full SHA for 3f15031
We use "headers" (plural) in header.py, so we use "statuses" (plural) also in this case
benediktjohannes
authored
19916ba
Copy full SHA for 19916ba
Update handlers.py
benediktjohannes
authored
43d4da8
Copy full SHA for 43d4da8
Update handlers.py
benediktjohannes
authored
d7deb29
Copy full SHA for d7deb29

Commits on Feb 15, 2026

Merge branch 'python:main' into patch-4
benediktjohannes
authored
1488055
Copy full SHA for 1488055

Commits on Feb 16, 2026

Merge branch 'python:main' into patch-4
benediktjohannes
authored
499679c
Copy full SHA for 499679c
Update handlers.py
benediktjohannes
authored
6b13a3e
Copy full SHA for 6b13a3e
Add tests for headers
benediktjohannes
authored
c5cfc3f
Copy full SHA for c5cfc3f
Update handlers.py
benediktjohannes
authored
3a404e1
Copy full SHA for 3a404e1
Update test_wsgiref.py
benediktjohannes
authored
35d0327
Copy full SHA for 35d0327
Update test_wsgiref.py
benediktjohannes
authored
8642a38
Copy full SHA for 8642a38
Update test_wsgiref.py
benediktjohannes
authored
673cbc1
Copy full SHA for 673cbc1
Update Lib/wsgiref/handlers.py
Show description for 563de46

benediktjohannes
and
vstinner
authored
563de46
Copy full SHA for 563de46
Update Lib/test/test_wsgiref.py
Show description for d016dbe

benediktjohannes
and
vstinner
authored
d016dbe
Copy full SHA for d016dbe
Update 2026-01-31-21-56-54.gh-issue-144370.fp9m8t.rst
benediktjohannes
authored
8dd1536
Copy full SHA for 8dd1536
Update Misc/NEWS.d/next/Security/2026-01-31-21-56-54.gh-issue-144370.fp9m8t.rst
Show description for bc7fb3f

benediktjohannes
and
vstinner
authored
bc7fb3f
Copy full SHA for bc7fb3f