Respond 400 instead of 500 when first header field line starts with SP or HTAB#729
Respond 400 instead of 500 when first header field line starts with SP or HTAB#729kenballus wants to merge 3 commits into
Conversation
bd642f1 to
3fa1439
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #729 +/- ##
==========================================
+ Coverage 83.65% 83.67% +0.02%
==========================================
Files 28 28
Lines 4166 4178 +12
==========================================
+ Hits 3485 3496 +11
- Misses 681 682 +1 |
94d81bb to
6778ce9
Compare
Prevent unhandled exception in header parsing that results in 500 responses when the first received header begins with whitespace.
for more information, see https://pre-commit.ci
| r"https://github\.com" | ||
| r"/python/cpython/blob/c39b52f/Lib/poplib\.py#user-content-L297-L302", | ||
| r"^https://matrix\.to/#", # these render fully on front-end from anchors | ||
| r'https://github\.com' r'/python/cpython/blob/c39b52f/Lib/poplib\.py#L297-L302', |
Check warning
Code scanning / CodeQL
Implicit string concatenation in a list
avinashkamat48-design
left a comment
There was a problem hiding this comment.
The functional change here is hard to review because the PR also reformats a large part of the project from double quotes to single quotes. The title describes a specific HTTP parser behavior change, but the diff includes 30+ files and roughly 1.5k lines of formatting churn, which makes it easy to miss the actual 400-vs-500 logic and creates avoidable merge/blame noise. Could the formatting-only changes be split out or reverted in this PR so the behavioral fix and its tests are reviewable on their own?
I didn't do this; it's the CI. My original change was just a simple patch, but this commit, which was automatically generated by the CI, added all this bs on top. |
❓ What kind of change does this PR introduce?
📋 What is the related issue number (starting with
#)#728
❓ What is the current behavior? (You can also link to an open issue here)
Cheroot responds 500 when it receives a request in which the first header field line starts with SP or HTAB, due to an
UnboundLocalError.❓ What is the new behavior (if this is a feature change)?
It responds 400 instead.
📋 Contribution checklist:
(If you're a first-timer, check out
this guide on making great pull requests)
the changes have been approved
and description in grammatically correct, complete sentences
This change is