r5478 - trunk/wooly/python/wooly
tmckay at fedoraproject.org
tmckay at fedoraproject.org
Wed Sep 26 19:16:24 UTC 2012
Author: tmckay
Date: 2012-09-26 19:16:23 +0000 (Wed, 26 Sep 2012)
New Revision: 5478
Modified:
trunk/wooly/python/wooly/server.py
Log:
Reject LF characters in response headers
BZ831244
Modified: trunk/wooly/python/wooly/server.py
===================================================================
--- trunk/wooly/python/wooly/server.py 2012-09-26 19:14:21 UTC (rev 5477)
+++ trunk/wooly/python/wooly/server.py 2012-09-26 19:16:23 UTC (rev 5478)
@@ -170,6 +170,14 @@
for header in session.marshal_cookies(secure_cookies):
headers.append(("Set-Cookie", header))
+ # Make sure that we have no headers containing LF characters
+ # which could be a result of a response splitting attempt.
+ for header in headers:
+ if "\n" in header[1]:
+ log.error("Response header contains LF (#), %s:%s" % \
+ (header[0], header[1].replace("\n", "#")))
+ raise Exception("Unexpected LF in response header")
+
return status, headers, content
def adapt_request_to_session(self, env, session):
More information about the cumin-developers
mailing list