Skip to content

Respond 400 instead of 500 when first header field line starts with SP or HTAB#729

Open
kenballus wants to merge 3 commits into
cherrypy:mainfrom
kenballus:main
Open

Respond 400 instead of 500 when first header field line starts with SP or HTAB#729
kenballus wants to merge 3 commits into
cherrypy:mainfrom
kenballus:main

Conversation

@kenballus

@kenballus kenballus commented Jul 6, 2024

Copy link
Copy Markdown

What kind of change does this PR introduce?

  • 🐞 bug fix
  • 🐣 feature
  • 📋 docs update
  • 📋 tests/coverage improvement
  • 📋 refactoring
  • 💥 other

📋 What is the related issue number (starting with #)
#728

What is the current behavior? (You can also link to an open issue here)
Cheroot responds 500 when it receives a request in which the first header field line starts with SP or HTAB, due to an UnboundLocalError.

What is the new behavior (if this is a feature change)?
It responds 400 instead.

📋 Contribution checklist:

(If you're a first-timer, check out
this guide on making great pull requests)

  • I wrote descriptive pull request text above
  • I think the code is well written
  • I wrote good commit messages
  • I have squashed related commits together after
    the changes have been approved
  • Unit tests for the changes exist
  • Integration tests for the changes exist (if applicable)
  • I used the same coding conventions as the rest of the project
  • The new code doesn't generate linter offenses
  • Documentation reflects the changes
  • The PR relates to only one subject with a clear title
    and description in grammatically correct, complete sentences

This change is Reviewable

@kenballus kenballus force-pushed the main branch 2 times, most recently from bd642f1 to 3fa1439 Compare July 6, 2024 22:19
@codecov

codecov Bot commented Jul 6, 2024

Copy link
Copy Markdown

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 83.67%. Comparing base (1ff20b1) to head (3fa1439).

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #729      +/-   ##
==========================================
+ Coverage   83.65%   83.67%   +0.02%     
==========================================
  Files          28       28              
  Lines        4166     4178      +12     
==========================================
+ Hits         3485     3496      +11     
- Misses        681      682       +1     

@kenballus kenballus force-pushed the main branch 2 times, most recently from 94d81bb to 6778ce9 Compare July 6, 2024 22:26
Prevent unhandled exception in header parsing that results in 500
responses when the first received header begins with whitespace.
Comment thread cheroot/server.py
Comment thread docs/conf.py
r"https://github\.com"
r"/python/cpython/blob/c39b52f/Lib/poplib\.py#user-content-L297-L302",
r"^https://matrix\.to/#", # these render fully on front-end from anchors
r'https://github\.com' r'/python/cpython/blob/c39b52f/Lib/poplib\.py#L297-L302',

Check warning

Code scanning / CodeQL

Implicit string concatenation in a list

Implicit string concatenation. Maybe missing a comma?
Comment thread docs/conf.py

@avinashkamat48-design avinashkamat48-design left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The functional change here is hard to review because the PR also reformats a large part of the project from double quotes to single quotes. The title describes a specific HTTP parser behavior change, but the diff includes 30+ files and roughly 1.5k lines of formatting churn, which makes it easy to miss the actual 400-vs-500 logic and creates avoidable merge/blame noise. Could the formatting-only changes be split out or reverted in this PR so the behavioral fix and its tests are reviewable on their own?

@kenballus

Copy link
Copy Markdown
Author

The functional change here is hard to review because the PR also reformats a large part of the project from double quotes to single quotes. The title describes a specific HTTP parser behavior change, but the diff includes 30+ files and roughly 1.5k lines of formatting churn, which makes it easy to miss the actual 400-vs-500 logic and creates avoidable merge/blame noise. Could the formatting-only changes be split out or reverted in this PR so the behavioral fix and its tests are reviewable on their own?

I didn't do this; it's the CI. My original change was just a simple patch, but this commit, which was automatically generated by the CI, added all this bs on top.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants