mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-11-07 13:44:50 +00:00
python3-aiohttp: fix CVE-2026-50269
This patch applies the reviewed upstream fix shown in [1]. For aiohttp 3.9.5, it also backports the required header validation from prerequisite commit [2]. The advisory identifying the fix is referenced in [3]. [1] https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8 [2] https://github.com/aio-libs/aiohttp/commit/1e3ecd48ec423c1fcc729c98adff31172faae1ef [3] https://nvd.nist.gov/vuln/detail/CVE-2026-50269 Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Darsh Kelaiya authored and 
Anuj Mittal committed
1 parent
84c7554df6
commit
8e776e0477
2 files changed
+167
No files matched your search
@@ -0,0 +1,166 @@
|
||||
From a8ea4a13b9691357fdc7796506b0c85566ed1985 Mon Sep 17 00:00:00 2001
|
||||
From: "patchback[bot]" <45432694+patchback[bot]@users.noreply.github.com>
|
||||
Date: Thu, 28 May 2026 23:57:41 +0100
|
||||
Subject: [PATCH] [PR #12719/879d48d1 backport][3.14] Reject invalid bytes in
|
||||
multipart/payload headers (#12720)
|
||||
|
||||
**This is a backport of PR #12719 as merged into master
|
||||
(879d48d1619b9bc3662037afcb8bfa790a205e9b).**
|
||||
|
||||
CVE: CVE-2026-50269
|
||||
Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8]
|
||||
|
||||
Backport Changes:
|
||||
- Backported the pure-Python http_writer._safe_header()
|
||||
control-character validation from prerequisite commit
|
||||
1e3ecd48ec423c1fcc729c98adff31172faae1ef because aiohttp
|
||||
3.9.5 rejects only CR/LF and the upstream CVE regression test
|
||||
also requires NUL rejection.
|
||||
- Adapted the prerequisite regression coverage to test _safe_header()
|
||||
directly using the aiohttp 3.9.5 test layout. Omitted its C
|
||||
serializer, threat-model, changelog, and broader serializer-test
|
||||
changes because Payload._binary_headers invokes the pure-Python
|
||||
helper directly.
|
||||
|
||||
Co-authored-by: Sam Bull <git@sambull.org>
|
||||
(cherry picked from commit 1e3ecd48ec423c1fcc729c98adff31172faae1ef)
|
||||
(cherry picked from commit bf88077ebb14f4c29924b8e8904cba20c55c28b8)
|
||||
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
|
||||
---
|
||||
CHANGES/12706.bugfix.rst | 1 +
|
||||
aiohttp/http_writer.py | 10 ++++++++--
|
||||
aiohttp/payload.py | 8 +++++---
|
||||
tests/test_http_writer.py | 19 +++++++++++++++++++
|
||||
tests/test_payload.py | 15 +++++++++++++++
|
||||
5 files changed, 48 insertions(+), 5 deletions(-)
|
||||
create mode 100644 CHANGES/12706.bugfix.rst
|
||||
|
||||
diff --git a/CHANGES/12706.bugfix.rst b/CHANGES/12706.bugfix.rst
|
||||
new file mode 100644
|
||||
index 000000000..9248585f9
|
||||
--- /dev/null
|
||||
+++ b/CHANGES/12706.bugfix.rst
|
||||
@@ -0,0 +1 @@
|
||||
+Fixed invalid bytes being allowed in multipart/payload headers -- by :user:`Dreamsorcerer`.
|
||||
diff --git a/aiohttp/http_writer.py b/aiohttp/http_writer.py
|
||||
index 37cdc06e6..9573768f6 100644
|
||||
--- a/aiohttp/http_writer.py
|
||||
+++ b/aiohttp/http_writer.py
|
||||
@@ -1,6 +1,7 @@
|
||||
"""Http related parsers and protocol."""
|
||||
|
||||
import asyncio
|
||||
+import re
|
||||
import zlib
|
||||
from typing import Any, Awaitable, Callable, NamedTuple, Optional, Union # noqa
|
||||
|
||||
@@ -171,10 +172,15 @@ class StreamWriter(AbstractStreamWriter):
|
||||
await self._protocol._drain_helper()
|
||||
|
||||
|
||||
+# https://www.rfc-editor.org/info/rfc9110/#section-5.5-5
|
||||
+# https://www.rfc-editor.org/info/rfc9112/#section-4-3
|
||||
+_FORBIDDEN_HEADER_CHARS_RE = re.compile(r"[\x00-\x08\x0a-\x1f\x7f]")
|
||||
+
|
||||
+
|
||||
def _safe_header(string: str) -> str:
|
||||
- if "\r" in string or "\n" in string:
|
||||
+ if _FORBIDDEN_HEADER_CHARS_RE.search(string) is not None:
|
||||
raise ValueError(
|
||||
- "Newline or carriage return detected in headers. "
|
||||
+ "Forbidden control character detected in headers. "
|
||||
"Potential header injection attack."
|
||||
)
|
||||
return string
|
||||
diff --git a/aiohttp/payload.py b/aiohttp/payload.py
|
||||
index 6593b05c6..77caf520c 100644
|
||||
--- a/aiohttp/payload.py
|
||||
+++ b/aiohttp/payload.py
|
||||
@@ -33,6 +33,7 @@ from .helpers import (
|
||||
parse_mimetype,
|
||||
sentinel,
|
||||
)
|
||||
+from .http_writer import _safe_header
|
||||
from .streams import StreamReader
|
||||
from .typedefs import JSONEncoder, _CIMultiDict
|
||||
|
||||
@@ -180,9 +181,10 @@ class Payload(ABC):
|
||||
@property
|
||||
def _binary_headers(self) -> bytes:
|
||||
return (
|
||||
- "".join([k + ": " + v + "\r\n" for k, v in self.headers.items()]).encode(
|
||||
- "utf-8"
|
||||
- )
|
||||
+ "".join(
|
||||
+ _safe_header(k) + ": " + _safe_header(v) + "\r\n"
|
||||
+ for k, v in self.headers.items()
|
||||
+ ).encode("utf-8")
|
||||
+ b"\r\n"
|
||||
)
|
||||
|
||||
diff --git a/tests/test_http_writer.py b/tests/test_http_writer.py
|
||||
index 5649f32f7..62d112cad 100644
|
||||
--- a/tests/test_http_writer.py
|
||||
+++ b/tests/test_http_writer.py
|
||||
@@ -6,6 +6,7 @@ import pytest
|
||||
from multidict import CIMultiDict
|
||||
|
||||
from aiohttp import http
|
||||
+from aiohttp.http_writer import _safe_header
|
||||
from aiohttp.test_utils import make_mocked_coro
|
||||
|
||||
|
||||
@@ -264,6 +265,24 @@ async def test_drain_no_transport(protocol, transport, loop) -> None:
|
||||
assert not protocol._drain_helper.called
|
||||
|
||||
|
||||
+@pytest.mark.parametrize(
|
||||
+ "char",
|
||||
+ [chr(c) for c in (*range(0x00, 0x09), *range(0x0A, 0x20), 0x7F)],
|
||||
+)
|
||||
+def test_safe_header_rejects_forbidden_control_chars(char: str) -> None:
|
||||
+ with pytest.raises(
|
||||
+ ValueError,
|
||||
+ match="Forbidden control character detected in headers",
|
||||
+ ):
|
||||
+ _safe_header(f"value{char}")
|
||||
+
|
||||
+
|
||||
+def test_safe_header_allows_htab() -> None:
|
||||
+ value = "text/plain\tcharset=utf-8"
|
||||
+
|
||||
+ assert _safe_header(value) == value
|
||||
+
|
||||
+
|
||||
async def test_write_headers_prevents_injection(protocol, transport, loop) -> None:
|
||||
msg = http.StreamWriter(protocol, loop)
|
||||
status_line = "HTTP/1.1 200 OK"
|
||||
diff --git a/tests/test_payload.py b/tests/test_payload.py
|
||||
index c8681cb5e..52ace65fd 100644
|
||||
--- a/tests/test_payload.py
|
||||
+++ b/tests/test_payload.py
|
||||
@@ -54,6 +54,21 @@ def test_payload_content_type() -> None:
|
||||
assert p.content_type == "application/json"
|
||||
|
||||
|
||||
+@pytest.mark.parametrize("bad_byte", ("\r", "\n", "\x00"))
|
||||
+def test_binary_headers_reject_injection_in_value(bad_byte: str) -> None:
|
||||
+ p = Payload("test", headers={"X-Custom": f"value{bad_byte}Injected: bad"})
|
||||
+ with pytest.raises(ValueError, match="header injection"):
|
||||
+ p._binary_headers
|
||||
+
|
||||
+
|
||||
+@pytest.mark.parametrize("bad_byte", ("\r", "\n", "\x00"))
|
||||
+def test_binary_headers_reject_injection_in_name(bad_byte: str) -> None:
|
||||
+ p = Payload("test")
|
||||
+ p.headers[f"X-Custom{bad_byte}Injected"] = "value"
|
||||
+ with pytest.raises(ValueError, match="header injection"):
|
||||
+ p._binary_headers
|
||||
+
|
||||
+
|
||||
def test_bytes_payload_default_content_type() -> None:
|
||||
p = payload.BytesPayload(b"data")
|
||||
assert p.content_type == "application/octet-stream"
|
||||
--
|
||||
2.35.6
|
||||
|
||||
Reference in new issue
Block a user