r5478 - trunk/wooly/python/wooly

tmckay at fedoraproject.org tmckay at fedoraproject.org
Wed Sep 26 19:16:24 UTC 2012


Author: tmckay
Date: 2012-09-26 19:16:23 +0000 (Wed, 26 Sep 2012)
New Revision: 5478

Modified:
   trunk/wooly/python/wooly/server.py
Log:
Reject LF characters in response headers
BZ831244


Modified: trunk/wooly/python/wooly/server.py
===================================================================
--- trunk/wooly/python/wooly/server.py	2012-09-26 19:14:21 UTC (rev 5477)
+++ trunk/wooly/python/wooly/server.py	2012-09-26 19:16:23 UTC (rev 5478)
@@ -170,6 +170,14 @@
         for header in session.marshal_cookies(secure_cookies):
             headers.append(("Set-Cookie", header))
 
+        # Make sure that we have no headers containing LF characters
+        # which could be a result of a response splitting attempt.
+        for header in headers:
+            if "\n" in header[1]:
+                log.error("Response header contains LF (#), %s:%s" % \
+                         (header[0], header[1].replace("\n", "#"))) 
+                raise Exception("Unexpected LF in response header")
+
         return status, headers, content
 
     def adapt_request_to_session(self, env, session):



More information about the cumin-developers mailing list