mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-09-09 18:50:13 +00:00
Darsh Kelaiya
b024b3d0d2
This patch applies the reviewed upstream fix commits shown in [1] and [2]. The advisory identifying the fix is referenced in [3]. [1] https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06 [2] https://github.com/aio-libs/aiohttp/commit/dab9e879be5606682a39b9dd378900eba0afd1a4 [3] https://nvd.nist.gov/vuln/detail/CVE-2026-34514 Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
66 lines
2.5 KiB
Diff
66 lines
2.5 KiB
Diff
From b3aca47a956826116930a59e482953cacf78830a Mon Sep 17 00:00:00 2001
|
|
From: Sam Bull <git@sambull.org>
|
|
Date: Sat, 21 Feb 2026 00:17:11 +0000
|
|
Subject: [PATCH] Fix multipart injection (#12104) (#12110)
|
|
|
|
CVE: CVE-2026-34514
|
|
Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06]
|
|
|
|
(cherry picked from commit dab9e879be5606682a39b9dd378900eba0afd1a4)
|
|
|
|
Co-authored-by: mingi jung <mingijung.grape@gmail.com>
|
|
(cherry picked from commit 9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06)
|
|
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
|
|
---
|
|
aiohttp/formdata.py | 5 +++++
|
|
tests/test_formdata.py | 16 +++++++++++-----
|
|
2 files changed, 16 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/aiohttp/formdata.py b/aiohttp/formdata.py
|
|
index 2b75b3de7..c14ada176 100644
|
|
--- a/aiohttp/formdata.py
|
|
+++ b/aiohttp/formdata.py
|
|
@@ -79,6 +79,11 @@ class FormData:
|
|
raise TypeError(
|
|
"content_type must be an instance of str. " "Got: %s" % content_type
|
|
)
|
|
+ if "\r" in content_type or "\n" in content_type:
|
|
+ raise ValueError(
|
|
+ "Newline or carriage return detected in headers. "
|
|
+ "Potential header injection attack."
|
|
+ )
|
|
headers[hdrs.CONTENT_TYPE] = content_type
|
|
self._is_multipart = True
|
|
if content_transfer_encoding is not None:
|
|
diff --git a/tests/test_formdata.py b/tests/test_formdata.py
|
|
index 4bb8aa075..9e331515c 100644
|
|
--- a/tests/test_formdata.py
|
|
+++ b/tests/test_formdata.py
|
|
@@ -46,12 +46,18 @@ def test_invalid_formdata_params2() -> None:
|
|
FormData("as") # 2-char str is not allowed
|
|
|
|
|
|
-def test_invalid_formdata_content_type() -> None:
|
|
+@pytest.mark.parametrize("val", (0, 0.1, {}, [], b"foo"))
|
|
+def test_invalid_type_formdata_content_type(val: object) -> None:
|
|
form = FormData()
|
|
- invalid_vals = [0, 0.1, {}, [], b"foo"]
|
|
- for invalid_val in invalid_vals:
|
|
- with pytest.raises(TypeError):
|
|
- form.add_field("foo", "bar", content_type=invalid_val)
|
|
+ with pytest.raises(TypeError):
|
|
+ form.add_field("foo", "bar", content_type=val) # type: ignore[arg-type]
|
|
+
|
|
+
|
|
+@pytest.mark.parametrize("val", ("\r", "\n", "a\ra\n", "a\na\r"))
|
|
+def test_invalid_value_formdata_content_type(val: str) -> None:
|
|
+ form = FormData()
|
|
+ with pytest.raises(ValueError):
|
|
+ form.add_field("foo", "bar", content_type=val)
|
|
|
|
|
|
def test_invalid_formdata_filename() -> None:
|
|
--
|
|
2.44.4
|
|
|