Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cheroot incorrectly allows whitespace after HTTP versions #717

Open
1 of 3 tasks
kenballus opened this issue Jun 15, 2024 · 0 comments
Open
1 of 3 tasks

Cheroot incorrectly allows whitespace after HTTP versions #717

kenballus opened this issue Jun 15, 2024 · 0 comments
Labels
bug Something is broken triage

Comments

@kenballus
Copy link

❓ I'm submitting a ...

  • 🐞 bug report
  • 🐣 feature request
  • ❓ question about the decisions made in the repository

🐞 Describe the bug. What is the current behavior?
RFC 9112 defines the following grammar rule for request lines:

request-line = method SP request-target SP HTTP-version

Cheroot accepts whitespace after the HTTP-version, even though this is not allowed by the grammar rule above.

❓ What is the motivation / use case for changing the behavior?
RFC compliance.

πŸ’‘ To Reproduce

  1. Start a Cheroot server.
  2. Send it the following request:
GET / HTTP1.1 \r\n
Host: whatever\r\n
\r\n
  1. Observe that the server responds 200.

πŸ’‘ Expected behavior
The server should respond 400.

πŸ“‹ Environment

  • Cheroot version: 10.0.2.dev71+g1ff20b18
  • Python version: 3.11.9
  • OS: Linux 6.9.1
@kenballus kenballus added bug Something is broken triage labels Jun 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something is broken triage
Projects
None yet
Development

No branches or pull requests

1 participant