Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bpo-44022: Fix http client infinite line reading (DoS) after a http 100 #25916

Merged
merged 7 commits into from
May 5, 2021
Merged

bpo-44022: Fix http client infinite line reading (DoS) after a http 100 #25916

merged 7 commits into from
May 5, 2021

Conversation

gen-xu
Copy link
Contributor

@gen-xu gen-xu commented May 5, 2021 •
edited
Loading

@the-knights-who-say-ni
Copy link

Hello, and thanks for your contribution!

I'm a bot set up to make sure that the project can legally accept this contribution by verifying everyone involved has signed the PSF contributor agreement (CLA).

Recognized GitHub username

We couldn't find a bugs.python.org (b.p.o) account corresponding to the following GitHub usernames:

@gen-nimble

This might be simply due to a missing "GitHub Name" entry in one's b.p.o account settings. This is necessary for legal reasons before we can look at this contribution. Please follow the steps outlined in the CPython devguide to rectify this issue.

CLA Missing

Our records indicate the following people have not signed the CLA:

@gen-xu

For legal reasons we need all the people listed to sign the CLA before we can look at your contribution. Please follow the steps outlined in the CPython devguide to rectify this issue.

If you have recently signed the CLA, please wait at least one business day
before our records are updated.

You can check yourself to see if the CLA has been received.

Thanks again for the contribution, we look forward to reviewing it!

@gen-xu gen-xu changed the title bpo-44022: Fix httplib client deny of service with total header size check after 100. bpo-44022: Fix httplib client deny of service with total header size check after http 100. May 5, 2021
gpshead
gpshead requested changes May 5, 2021
View reviewed changes
Lib/http/client.py Outdated Show resolved Hide resolved
@bedevere-bot
Copy link

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

@gpshead gpshead added needs backport to 3.9 only security fixes needs backport to 3.10 only security fixes type-bug An unexpected behavior, bug, or error labels May 5, 2021
@gpshead gpshead changed the title bpo-44022: Fix httplib client deny of service with total header size check after http 100. bpo-44022: Fix http client infinite line reading (DoS) after a http 100 May 5, 2021
@gpshead gpshead self-assigned this May 5, 2021
@gen-xu
Copy link
Contributor Author

gen-xu commented May 5, 2021

I have made the requested changes; please review again

@bedevere-bot
Copy link

Thanks for making the requested changes!

@gpshead: please review the changes made to this pull request.

@bedevere-bot bedevere-bot requested a review from gpshead May 5, 2021 21:20
gpshead
gpshead approved these changes May 5, 2021
View reviewed changes
Copy link
Member

@gpshead gpshead left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I made a few minor edit updates to the PR. Now we wait for the CI testing runs to finish. :)

@gpshead gpshead merged commit 47895e3 into python:main May 5, 2021
@miss-islington
Copy link
Contributor

Thanks @gen-xu for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.6, 3.7, 3.8, 3.9.
🐍🍒⛏🤖

@bedevere-bot
Copy link

GH-25931 is a backport of this pull request to the 3.10 branch.

@bedevere-bot bedevere-bot removed the needs backport to 3.10 only security fixes label May 5, 2021
@bedevere-bot
Copy link

GH-25932 is a backport of this pull request to the 3.9 branch.

@bedevere-bot bedevere-bot removed the needs backport to 3.9 only security fixes label May 5, 2021
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request May 5, 2021
@gen-xu @miss-islington
bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 1…
96a983c 
…00 Continue (pythonGH-25916)

Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response.

Co-authored-by: Gregory P. Smith <greg@krypto.org>
(cherry picked from commit 47895e3)

Co-authored-by: Gen Xu <xgbarry@gmail.com>
@bedevere-bot
Copy link

GH-25933 is a backport of this pull request to the 3.8 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request May 5, 2021
@gen-xu @miss-islington
bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 1…
e75b6a2 
…00 Continue (pythonGH-25916)

Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response.

Co-authored-by: Gregory P. Smith <greg@krypto.org>
(cherry picked from commit 47895e3)

Co-authored-by: Gen Xu <xgbarry@gmail.com>
@bedevere-bot
Copy link

GH-25934 is a backport of this pull request to the 3.7 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request May 5, 2021
@gen-xu @miss-islington
bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 1…
f7fb35b 
…00 Continue (pythonGH-25916)

Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response.

Co-authored-by: Gregory P. Smith <greg@krypto.org>
(cherry picked from commit 47895e3)

Co-authored-by: Gen Xu <xgbarry@gmail.com>
@bedevere-bot
Copy link

GH-25935 is a backport of this pull request to the 3.6 branch.

miss-islington added a commit that referenced this pull request May 5, 2021
@miss-islington @gen-xu
bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 1…
ea93270 
…00 Continue (GH-25916)

Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response.

Co-authored-by: Gregory P. Smith <greg@krypto.org>
(cherry picked from commit 47895e3)

Co-authored-by: Gen Xu <xgbarry@gmail.com>
gpshead pushed a commit that referenced this pull request May 5, 2021
@miss-islington @gen-xu
bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 1…
60ba0b6 
…00 Continue (GH-25916) (GH-25931)

Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response.

Co-authored-by: Gregory P. Smith <greg@krypto.org>
(cherry picked from commit 47895e3)

Co-authored-by: Gen Xu <xgbarry@gmail.com>
ambv pushed a commit that referenced this pull request May 6, 2021
@miss-islington @gen-xu
bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 1…
f396864 
…00 Continue (GH-25916) (#25933)

Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response.

Co-authored-by: Gregory P. Smith <greg@krypto.org>
(cherry picked from commit 47895e3)

Co-authored-by: Gen Xu <xgbarry@gmail.com>
ned-deily pushed a commit that referenced this pull request May 6, 2021
@miss-islington @gen-xu
bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 1…
f68d2d6 
…00 Continue (GH-25916) (GH-25935)

Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response.

Co-authored-by: Gregory P. Smith <greg@krypto.org>
(cherry picked from commit 47895e3)

Co-authored-by: Gen Xu <xgbarry@gmail.com>
ned-deily pushed a commit that referenced this pull request May 6, 2021
@miss-islington @gen-xu
bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 1…
078b146 
…00 Continue (GH-25916) (GH-25934)

Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response.

Co-authored-by: Gregory P. Smith <greg@krypto.org>
(cherry picked from commit 47895e3)

Co-authored-by: Gen Xu <xgbarry@gmail.com>
gentoo-bot pushed a commit to gentoo/cpython that referenced this pull request Jun 19, 2021
@mgorny
Backport bpo-44022: Fix http client infinite line reading (DoS) after…
dae96ac 
… a HTTP 100 Continue (pythonGH-25916)

Backport the fix from the following commit:

    commit 47895e3
    Author: Gen Xu <xgbarry@gmail.com>
    Date:   2021-05-06 00:42:41 +0200

        bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 100 Continue (pythonGH-25916)

        Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response.

        Co-authored-by: Gregory P. Smith <greg@krypto.org>

Instead of reusing the header reading code, I have just added explicit
counter to avoid having to refactor the old code.

Plus the improved test from:

    commit e60ab84
    Author: Gregory P. Smith <greg@krypto.org>
    Date:   2021-06-03 05:43:38 +0200

        bpo-44022: Improve the regression test. (pythonGH-26503)

        It wasn't actually detecting the regression due to the
        assertion being too lenient.
@pablogsal pablogsal mentioned this pull request Jul 18, 2021
Closed
@easyteacher
Copy link

Can you apply for a CVE? I think this bug is still a little serious.

@ajakk
Copy link

ajakk commented Mar 5, 2022

Redhat issues CVEs for CPython (though I don't think this is actually documented anywhere. They've assigned CVE-2021-3737.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@gpshead gpshead gpshead approved these changes

Assignees

@gpshead gpshead

Labels
type-bug An unexpected behavior, bug, or error
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@gen-xu @the-knights-who-say-ni @bedevere-bot @miss-islington @easyteacher @ajakk @gpshead