From a8ea4a13b9691357fdc7796506b0c85566ed1985 Mon Sep 17 00:00:00 2001 From: "patchback[bot]" <45432694+patchback[bot]@users.noreply.github.com> Date: Thu, 28 May 2026 23:57:41 +0100 Subject: [PATCH] [PR #12719/879d48d1 backport][3.14] Reject invalid bytes in multipart/payload headers (#12720) **This is a backport of PR #12719 as merged into master (879d48d1619b9bc3662037afcb8bfa790a205e9b).** CVE: CVE-2026-50269 Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8] Backport Changes: - Backported the pure-Python http_writer._safe_header() control-character validation from prerequisite commit 1e3ecd48ec423c1fcc729c98adff31172faae1ef because aiohttp 3.9.5 rejects only CR/LF and the upstream CVE regression test also requires NUL rejection. - Adapted the prerequisite regression coverage to test _safe_header() directly using the aiohttp 3.9.5 test layout. Omitted its C serializer, threat-model, changelog, and broader serializer-test changes because Payload._binary_headers invokes the pure-Python helper directly. Co-authored-by: Sam Bull (cherry picked from commit 1e3ecd48ec423c1fcc729c98adff31172faae1ef) (cherry picked from commit bf88077ebb14f4c29924b8e8904cba20c55c28b8) Signed-off-by: Darsh Kelaiya --- CHANGES/12706.bugfix.rst | 1 + aiohttp/http_writer.py | 10 ++++++++-- aiohttp/payload.py | 8 +++++--- tests/test_http_writer.py | 19 +++++++++++++++++++ tests/test_payload.py | 15 +++++++++++++++ 5 files changed, 48 insertions(+), 5 deletions(-) create mode 100644 CHANGES/12706.bugfix.rst diff --git a/CHANGES/12706.bugfix.rst b/CHANGES/12706.bugfix.rst new file mode 100644 index 000000000..9248585f9 --- /dev/null +++ b/CHANGES/12706.bugfix.rst @@ -0,0 +1 @@ +Fixed invalid bytes being allowed in multipart/payload headers -- by :user:`Dreamsorcerer`. diff --git a/aiohttp/http_writer.py b/aiohttp/http_writer.py index 37cdc06e6..9573768f6 100644 --- a/aiohttp/http_writer.py +++ b/aiohttp/http_writer.py @@ -1,6 +1,7 @@ """Http related parsers and protocol.""" import asyncio +import re import zlib from typing import Any, Awaitable, Callable, NamedTuple, Optional, Union # noqa @@ -171,10 +172,15 @@ class StreamWriter(AbstractStreamWriter): await self._protocol._drain_helper() +# https://www.rfc-editor.org/info/rfc9110/#section-5.5-5 +# https://www.rfc-editor.org/info/rfc9112/#section-4-3 +_FORBIDDEN_HEADER_CHARS_RE = re.compile(r"[\x00-\x08\x0a-\x1f\x7f]") + + def _safe_header(string: str) -> str: - if "\r" in string or "\n" in string: + if _FORBIDDEN_HEADER_CHARS_RE.search(string) is not None: raise ValueError( - "Newline or carriage return detected in headers. " + "Forbidden control character detected in headers. " "Potential header injection attack." ) return string diff --git a/aiohttp/payload.py b/aiohttp/payload.py index 6593b05c6..77caf520c 100644 --- a/aiohttp/payload.py +++ b/aiohttp/payload.py @@ -33,6 +33,7 @@ from .helpers import ( parse_mimetype, sentinel, ) +from .http_writer import _safe_header from .streams import StreamReader from .typedefs import JSONEncoder, _CIMultiDict @@ -180,9 +181,10 @@ class Payload(ABC): @property def _binary_headers(self) -> bytes: return ( - "".join([k + ": " + v + "\r\n" for k, v in self.headers.items()]).encode( - "utf-8" - ) + "".join( + _safe_header(k) + ": " + _safe_header(v) + "\r\n" + for k, v in self.headers.items() + ).encode("utf-8") + b"\r\n" ) diff --git a/tests/test_http_writer.py b/tests/test_http_writer.py index 5649f32f7..62d112cad 100644 --- a/tests/test_http_writer.py +++ b/tests/test_http_writer.py @@ -6,6 +6,7 @@ import pytest from multidict import CIMultiDict from aiohttp import http +from aiohttp.http_writer import _safe_header from aiohttp.test_utils import make_mocked_coro @@ -264,6 +265,24 @@ async def test_drain_no_transport(protocol, transport, loop) -> None: assert not protocol._drain_helper.called +@pytest.mark.parametrize( + "char", + [chr(c) for c in (*range(0x00, 0x09), *range(0x0A, 0x20), 0x7F)], +) +def test_safe_header_rejects_forbidden_control_chars(char: str) -> None: + with pytest.raises( + ValueError, + match="Forbidden control character detected in headers", + ): + _safe_header(f"value{char}") + + +def test_safe_header_allows_htab() -> None: + value = "text/plain\tcharset=utf-8" + + assert _safe_header(value) == value + + async def test_write_headers_prevents_injection(protocol, transport, loop) -> None: msg = http.StreamWriter(protocol, loop) status_line = "HTTP/1.1 200 OK" diff --git a/tests/test_payload.py b/tests/test_payload.py index c8681cb5e..52ace65fd 100644 --- a/tests/test_payload.py +++ b/tests/test_payload.py @@ -54,6 +54,21 @@ def test_payload_content_type() -> None: assert p.content_type == "application/json" +@pytest.mark.parametrize("bad_byte", ("\r", "\n", "\x00")) +def test_binary_headers_reject_injection_in_value(bad_byte: str) -> None: + p = Payload("test", headers={"X-Custom": f"value{bad_byte}Injected: bad"}) + with pytest.raises(ValueError, match="header injection"): + p._binary_headers + + +@pytest.mark.parametrize("bad_byte", ("\r", "\n", "\x00")) +def test_binary_headers_reject_injection_in_name(bad_byte: str) -> None: + p = Payload("test") + p.headers[f"X-Custom{bad_byte}Injected"] = "value" + with pytest.raises(ValueError, match="header injection"): + p._binary_headers + + def test_bytes_payload_default_content_type() -> None: p = payload.BytesPayload(b"data") assert p.content_type == "application/octet-stream" -- 2.35.6