From 32677f2adfd907420c078dda6b79225c6f4ebce0 Mon Sep 17 00:00:00 2001 From: Sam Bull Date: Sat, 3 Jan 2026 00:02:45 +0000 Subject: [PATCH] Reject non-ascii characters in some headers (#11886) (#11902) (cherry picked from commit 5affd64f86d28a16a8f8e6fea2d217c99bf7831f) --- aiohttp/_http_parser.pyx | 6 +++--- aiohttp/http_parser.py | 16 +++++++++------- tests/test_http_parser.py | 31 ++++++++++++++++++++++++++++++- 3 files changed, 42 insertions(+), 11 deletions(-) Index: aiohttp-3.11.16/aiohttp/_http_parser.pyx =================================================================== --- aiohttp-3.11.16.orig/aiohttp/_http_parser.pyx +++ aiohttp-3.11.16/aiohttp/_http_parser.pyx @@ -421,7 +421,8 @@ cdef class HttpParser: headers = CIMultiDictProxy(CIMultiDict(self._headers)) if self._cparser.type == cparser.HTTP_REQUEST: - allowed = upgrade and headers.get("upgrade", "").lower() in ALLOWED_UPGRADES + h_upg = headers.get("upgrade", "") + allowed = upgrade and h_upg.isascii() and h_upg.lower() in ALLOWED_UPGRADES if allowed or self._cparser.method == cparser.HTTP_CONNECT: self._upgraded = True else: @@ -436,8 +437,7 @@ cdef class HttpParser: enc = self._content_encoding if enc is not None: self._content_encoding = None - enc = enc.lower() - if enc in ('gzip', 'deflate', 'br'): + if enc.isascii() and enc.lower() in ("gzip", "deflate", "br"): encoding = enc if self._cparser.type == cparser.HTTP_REQUEST: Index: aiohttp-3.11.16/aiohttp/http_parser.py =================================================================== --- aiohttp-3.11.16.orig/aiohttp/http_parser.py +++ aiohttp-3.11.16/aiohttp/http_parser.py @@ -238,7 +238,9 @@ class HeadersParser: def _is_supported_upgrade(headers: CIMultiDictProxy[str]) -> bool: """Check if the upgrade header is supported.""" - return headers.get(hdrs.UPGRADE, "").lower() in {"tcp", "websocket"} + u = headers.get(hdrs.UPGRADE, "") + # .lower() can transform non-ascii characters. + return u.isascii() and u.lower() in {"tcp", "websocket"} class HttpParser(abc.ABC, Generic[_MsgT]): @@ -544,8 +546,7 @@ class HttpParser(abc.ABC, Generic[_MsgT] # encoding enc = headers.get(hdrs.CONTENT_ENCODING) if enc: - enc = enc.lower() - if enc in ("gzip", "deflate", "br"): + if enc.isascii() and enc.lower() in ("gzip", "deflate", "br"): encoding = enc # chunking @@ -663,7 +664,9 @@ class HttpRequestParser(HttpParser[RawRe ) def _is_chunked_te(self, te: str) -> bool: - if te.rsplit(",", maxsplit=1)[-1].strip(" \t").lower() == "chunked": + te = te.rsplit(",", maxsplit=1)[-1].strip(" \t") + # .lower() transforms some non-ascii chars, so must check first. + if te.isascii() and te.lower() == "chunked": return True # https://www.rfc-editor.org/rfc/rfc9112#section-6.3-2.4.3 raise BadHttpMessage("Request has invalid `Transfer-Encoding`") Index: aiohttp-3.11.16/tests/test_http_parser.py =================================================================== --- aiohttp-3.11.16.orig/tests/test_http_parser.py +++ aiohttp-3.11.16/tests/test_http_parser.py @@ -496,7 +496,21 @@ def test_request_chunked(parser) -> None assert isinstance(payload, streams.StreamReader) -def test_request_te_chunked_with_content_length(parser: Any) -> None: +def test_te_header_non_ascii(parser: HttpRequestParser) -> None: + # K = Kelvin sign, not valid ascii. + text = "GET /test HTTP/1.1\r\nTransfer-Encoding: chunKed\r\n\r\n" + with pytest.raises(http_exceptions.BadHttpMessage): + parser.feed_data(text.encode()) + + +def test_upgrade_header_non_ascii(parser: HttpRequestParser) -> None: + # K = Kelvin sign, not valid ascii. + text = "GET /test HTTP/1.1\r\nUpgrade: websocKet\r\n\r\n" + messages, upgrade, tail = parser.feed_data(text.encode()) + assert not upgrade + + +def test_request_te_chunked_with_content_length(parser: HttpRequestParser) -> None: text = ( b"GET /test HTTP/1.1\r\n" b"content-length: 1234\r\n" @@ -586,6 +600,15 @@ def test_compression_brotli(parser) -> N assert msg.compression == "br" +def test_compression_non_ascii(parser: HttpRequestParser) -> None: + enc = "deflate".encode() # "fl".upper() == "FL" + text = b"GET /test HTTP/1.1\r\ncontent-encoding: " + enc + b"\r\n\r\n" + messages, upgrade, tail = parser.feed_data(text) + msg = messages[0][0] + # Non-ascii input should not evaluate to a valid encoding scheme. + assert msg.compression is None + + def test_compression_unknown(parser) -> None: text = b"GET /test HTTP/1.1\r\ncontent-encoding: compress\r\n\r\n" messages, upgrade, tail = parser.feed_data(text)