From b3aca47a956826116930a59e482953cacf78830a Mon Sep 17 00:00:00 2001 From: Sam Bull Date: Sat, 21 Feb 2026 00:17:11 +0000 Subject: [PATCH] Fix multipart injection (#12104) (#12110) CVE: CVE-2026-34514 Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06] (cherry picked from commit dab9e879be5606682a39b9dd378900eba0afd1a4) Co-authored-by: mingi jung (cherry picked from commit 9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06) Signed-off-by: Darsh Kelaiya --- aiohttp/formdata.py | 5 +++++ tests/test_formdata.py | 16 +++++++++++----- 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/aiohttp/formdata.py b/aiohttp/formdata.py index 2b75b3de7..c14ada176 100644 --- a/aiohttp/formdata.py +++ b/aiohttp/formdata.py @@ -79,6 +79,11 @@ class FormData: raise TypeError( "content_type must be an instance of str. " "Got: %s" % content_type ) + if "\r" in content_type or "\n" in content_type: + raise ValueError( + "Newline or carriage return detected in headers. " + "Potential header injection attack." + ) headers[hdrs.CONTENT_TYPE] = content_type self._is_multipart = True if content_transfer_encoding is not None: diff --git a/tests/test_formdata.py b/tests/test_formdata.py index 4bb8aa075..9e331515c 100644 --- a/tests/test_formdata.py +++ b/tests/test_formdata.py @@ -46,12 +46,18 @@ def test_invalid_formdata_params2() -> None: FormData("as") # 2-char str is not allowed -def test_invalid_formdata_content_type() -> None: +@pytest.mark.parametrize("val", (0, 0.1, {}, [], b"foo")) +def test_invalid_type_formdata_content_type(val: object) -> None: form = FormData() - invalid_vals = [0, 0.1, {}, [], b"foo"] - for invalid_val in invalid_vals: - with pytest.raises(TypeError): - form.add_field("foo", "bar", content_type=invalid_val) + with pytest.raises(TypeError): + form.add_field("foo", "bar", content_type=val) # type: ignore[arg-type] + + +@pytest.mark.parametrize("val", ("\r", "\n", "a\ra\n", "a\na\r")) +def test_invalid_value_formdata_content_type(val: str) -> None: + form = FormData() + with pytest.raises(ValueError): + form.add_field("foo", "bar", content_type=val) def test_invalid_formdata_filename() -> None: -- 2.44.4