jingrow/gunicorn
1
0
Fork 0
mirror of https://github.com/frappe/gunicorn.git synced 2026-07-07 21:21:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3602 from benoitc/test/rfc9112-cl-list-form-fixture

Browse Source 
test: codify rejection of Content-Length list form (RFC 9112 §6.3)
This commit is contained in:
Benoit Chesneau 2026-04-19 23:30:15 +02:00 committed by GitHub
commit a635b957c5
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
tests/requests/invalid/rfc9112_smuggle_cl_list_form_01.http Normal file
View File

@ -0,0 +1,5 @@
POST /p HTTP/1.1\r\n
Host: example.com\r\n
Content-Length: 5, 5\r\n
\r\n
hello

12
tests/requests/invalid/rfc9112_smuggle_cl_list_form_01.py Normal file
View File

@ -0,0 +1,12 @@
#
# This file is part of gunicorn released under the MIT license.
# See the NOTICE for more information.
# RFC 9112 section 6.3 allows Content-Length list form when all values
# match, but gunicorn takes the safer strict view and rejects any list
# form outright to avoid proxy/origin desync. PortSwigger HTTP Desync,
# CL list variant.
from gunicorn.http.errors import InvalidHeader
request = InvalidHeader
# The C parser (gunicorn_h1c) does not yet enforce this rule.
python_only = True