From fcd245fc878188f658a5a60e024dcf09dcff21d0 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com>
Date: Wed, 30 Sep 2020 14:57:37 +0200
Subject: [PATCH] 00354: CVE-2020-26116: HTTP request method CRLF injection in
 httplib

Reject control chars in HTTP method in httplib.putrequest to prevent
HTTP header injection

Backported from Python 3.5:
- https://bugs.python.org/issue39603
- https://github.com/python/cpython/pull/21946/files

Co-authored-by: AMIR <31338382+amiremohamadi@users.noreply.github.com>
---
 Lib/http/client.py                            | 17 ++++++++++++++
 Lib/test/test_httplib.py                      | 23 +++++++++++++++++++
 .../2020-02-12-14-17-39.bpo-39603.Gt3RSg.rst  |  2 ++
 3 files changed, 42 insertions(+)
 create mode 100644 Misc/NEWS.d/next/Security/2020-02-12-14-17-39.bpo-39603.Gt3RSg.rst

diff --git a/Lib/http/client.py b/Lib/http/client.py
index 1c69dcb5c73..e06f5d6f6c8 100644
--- a/Lib/http/client.py
+++ b/Lib/http/client.py
@@ -246,6 +246,10 @@ _MAXHEADERS = 100
 _is_legal_header_name = re.compile(rb'[^:\s][^:\r\n]*').fullmatch
 _is_illegal_header_value = re.compile(rb'\n(?![ \t])|\r(?![ \t\n])').search
 
+# These characters are not allowed within HTTP method names
+# to prevent http header injection.
+_contains_disallowed_method_pchar_re = re.compile('[\x00-\x1f]')
+
 # We always set the Content-Length header for these methods because some
 # servers will otherwise respond with a 411
 _METHODS_EXPECTING_BODY = {'PATCH', 'POST', 'PUT'}
@@ -1004,7 +1008,10 @@ class HTTPConnection:
         else:
             raise CannotSendRequest(self.__state)
 
+        self._validate_method(method)
+
         # Save the method we use, we need it later in the response phase
+
         self._method = method
         if not url:
             url = '/'
@@ -1089,6 +1096,16 @@ class HTTPConnection:
             # For HTTP/1.0, the server will assume "not chunked"
             pass
 
+    def _validate_method(self, method):
+        """Validate a method name for putrequest."""
+        # prevent http header injection
+        match = _contains_disallowed_method_pchar_re.search(method)
+        if match:
+            raise ValueError(
+                    "method can't contain control characters. %r "
+                    "(found at least %r)"
+                    % (method, match.group()))
+
     def putheader(self, header, *values):
         """Send a request header line to the server.
 
diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py
index df9a9e3cbda..78fe4be4fd3 100644
--- a/Lib/test/test_httplib.py
+++ b/Lib/test/test_httplib.py
@@ -274,6 +274,28 @@ class HeaderTests(TestCase):
                     conn.putheader(name, value)
 
 
+class HttpMethodTests(TestCase):
+    def test_invalid_method_names(self):
+        methods = (
+            'GET\r',
+            'POST\n',
+            'PUT\n\r',
+            'POST\nValue',
+            'POST\nHOST:abc',
+            'GET\nrHost:abc\n',
+            'POST\rRemainder:\r',
+            'GET\rHOST:\n',
+            '\nPUT'
+        )
+
+        for method in methods:
+            with self.assertRaisesRegex(
+                    ValueError, "method can't contain control characters"):
+                conn = client.HTTPConnection('example.com')
+                conn.sock = FakeSocket(None)
+                conn.request(method=method, url="/")
+
+
 class BasicTest(TestCase):
     def test_status_lines(self):
         # Test HTTP status lines
@@ -1227,6 +1249,7 @@ class TunnelTests(TestCase):
 @support.reap_threads
 def test_main(verbose=None):
     support.run_unittest(HeaderTests, OfflineTest, BasicTest, TimeoutTest,
+                         HttpMethodTests,
                          HTTPSTest, RequestBodyTest, SourceAddressTest,
                          HTTPResponseTest, TunnelTests)
 
diff --git a/Misc/NEWS.d/next/Security/2020-02-12-14-17-39.bpo-39603.Gt3RSg.rst b/Misc/NEWS.d/next/Security/2020-02-12-14-17-39.bpo-39603.Gt3RSg.rst
new file mode 100644
index 00000000000..990affc3edd
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2020-02-12-14-17-39.bpo-39603.Gt3RSg.rst
@@ -0,0 +1,2 @@
+Prevent http header injection by rejecting control characters in
+http.client.putrequest(...).
-- 
2.26.2