mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-09-02 04:20:18 +00:00
Darsh Kelaiya
6de7cbdd5b
This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8 [2] https://github.com/advisories/GHSA-m6qw-4cw2-hm4m Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
82 lines
2.9 KiB
Diff
82 lines
2.9 KiB
Diff
From 7fb9ddce2c1a376ef46f9ec2195e5d75db60c227 Mon Sep 17 00:00:00 2001
|
|
From: "patchback[bot]" <45432694+patchback[bot]@users.noreply.github.com>
|
|
Date: Thu, 28 May 2026 23:57:41 +0100
|
|
Subject: [PATCH] [PR #12719/879d48d1 backport][3.14] Reject invalid bytes in
|
|
multipart/payload headers (#12720)
|
|
|
|
**This is a backport of PR #12719 as merged into master
|
|
(879d48d1619b9bc3662037afcb8bfa790a205e9b).**
|
|
|
|
CVE: CVE-2026-50269
|
|
Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8]
|
|
|
|
Co-authored-by: Sam Bull <git@sambull.org>
|
|
(cherry picked from commit bf88077ebb14f4c29924b8e8904cba20c55c28b8)
|
|
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
|
|
---
|
|
CHANGES/12706.bugfix.rst | 1 +
|
|
aiohttp/payload.py | 8 +++++---
|
|
tests/test_payload.py | 15 +++++++++++++++
|
|
3 files changed, 21 insertions(+), 3 deletions(-)
|
|
create mode 100644 CHANGES/12706.bugfix.rst
|
|
|
|
diff --git a/CHANGES/12706.bugfix.rst b/CHANGES/12706.bugfix.rst
|
|
new file mode 100644
|
|
index 000000000..9248585f9
|
|
--- /dev/null
|
|
+++ b/CHANGES/12706.bugfix.rst
|
|
@@ -0,0 +1 @@
|
|
+Fixed invalid bytes being allowed in multipart/payload headers -- by :user:`Dreamsorcerer`.
|
|
diff --git a/aiohttp/payload.py b/aiohttp/payload.py
|
|
index 5b88fa094..23d127056 100644
|
|
--- a/aiohttp/payload.py
|
|
+++ b/aiohttp/payload.py
|
|
@@ -35,6 +35,7 @@ from .helpers import (
|
|
parse_mimetype,
|
|
sentinel,
|
|
)
|
|
+from .http_writer import _safe_header
|
|
from .streams import StreamReader
|
|
from .typedefs import JSONEncoder, _CIMultiDict
|
|
|
|
@@ -209,9 +210,10 @@ class Payload(ABC):
|
|
@property
|
|
def _binary_headers(self) -> bytes:
|
|
return (
|
|
- "".join([k + ": " + v + "\r\n" for k, v in self.headers.items()]).encode(
|
|
- "utf-8"
|
|
- )
|
|
+ "".join(
|
|
+ _safe_header(k) + ": " + _safe_header(v) + "\r\n"
|
|
+ for k, v in self.headers.items()
|
|
+ ).encode("utf-8")
|
|
+ b"\r\n"
|
|
)
|
|
|
|
diff --git a/tests/test_payload.py b/tests/test_payload.py
|
|
index 9aa97b20d..b60aa7e7c 100644
|
|
--- a/tests/test_payload.py
|
|
+++ b/tests/test_payload.py
|
|
@@ -101,6 +101,21 @@ def test_payload_content_type() -> None:
|
|
assert p.content_type == "application/json"
|
|
|
|
|
|
+@pytest.mark.parametrize("bad_byte", ("\r", "\n", "\x00"))
|
|
+def test_binary_headers_reject_injection_in_value(bad_byte: str) -> None:
|
|
+ p = Payload("test", headers={"X-Custom": f"value{bad_byte}Injected: bad"})
|
|
+ with pytest.raises(ValueError, match="header injection"):
|
|
+ p._binary_headers
|
|
+
|
|
+
|
|
+@pytest.mark.parametrize("bad_byte", ("\r", "\n", "\x00"))
|
|
+def test_binary_headers_reject_injection_in_name(bad_byte: str) -> None:
|
|
+ p = Payload("test")
|
|
+ p.headers[f"X-Custom{bad_byte}Injected"] = "value"
|
|
+ with pytest.raises(ValueError, match="header injection"):
|
|
+ p._binary_headers
|
|
+
|
|
+
|
|
def test_bytes_payload_default_content_type() -> None:
|
|
p = payload.BytesPayload(b"data")
|
|
assert p.content_type == "application/octet-stream"
|