jingrow/gunicorn
1
0
Fork 0
mirror of https://github.com/frappe/gunicorn.git synced 2026-07-01 18:21:30 +08:00
Code Issues Packages Projects Releases Wiki Activity
gunicorn/tests/requests/invalid
History
Benoit Chesneau 112d5353c1 fix: enforce proxy_allow_ips and tighten PROXY parsing in ASGI 
Three findings against the ASGI PROXY protocol path:

- High: an untrusted peer could send a PROXY v1/v2 header and have the
  client address surfaced to the app. _setup_callback_parser now passes
  proxy_protocol='off' to the parser when the peer is not in
  proxy_allow_ips. _effective_peername adds a defensive re-check.
- Medium: PROXY v1 TCP4/TCP6 addresses were copied as strings without
  validation. Validate with socket.inet_pton, mirroring the WSGI parser.
- Medium: PROXY v2 quietly mapped non-STREAM (DGRAM) protocols to
  UDP4/UDP6. gunicorn is an HTTP server; reject non-STREAM with
  InvalidProxyHeader, mirroring the WSGI parser.
2026-05-03 22:28:48 +02:00
..
001.http
Added more valid request tests.
2010-06-03 16:11:18 -04:00
001.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
002.http
Added more valid request tests.
2010-06-03 16:11:18 -04:00
002.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
003.http
RFC compliant request line and header parsing
2023-12-15 13:33:31 +01:00
003.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
003b.http
strict: header field validation: stop casefolding
2023-12-15 13:33:31 +01:00
003b.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
003c.http
strict: header field validation: stop casefolding
2023-12-15 13:33:31 +01:00
003c.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
004.http
Added more valid request tests.
2010-06-03 16:11:18 -04:00
004.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
005.http
Added more valid request tests.
2010-06-03 16:11:18 -04:00
005.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
006.http
check if Request Line is too large.
2012-02-20 09:56:06 +01:00
006.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
007.http
test number of headers fields and size.
2012-02-20 10:36:13 +01:00
007.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
008.http
fix multiple issues with request limit
2012-05-24 12:13:34 +02:00
008.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
009.http
test number of headers fields and size.
2012-02-20 10:36:13 +01:00
009.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
010.http
fix multiple issues with request limit
2012-05-24 12:13:34 +02:00
010.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
011.http
fix multiple issues with request limit
2012-05-24 12:13:34 +02:00
011.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
012.http
fix multiple issues with request limit
2012-05-24 12:13:34 +02:00
012.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
013.http
fix multiple issues with request limit
2012-05-24 12:13:34 +02:00
013.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
014.http
Check Content-Length header.
2012-09-27 19:14:40 +02:00
014.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
015.http
Check Content-Length header.
2012-09-27 19:14:40 +02:00
015.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
016.http
Do not strip leading slash from path (#1511)
2017-12-28 11:32:47 +03:00
016.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
017.http
Remove upper limit on max header size config (#1313)
2016-09-17 12:49:05 +03:00
017.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
018.http
Reject requests like "GET / HTTP/1a1"
2016-11-04 21:16:01 +03:00
018.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
019.http
Forbid contradictory secure scheme headers
2018-01-10 12:10:35 -08:00
019.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
020.http
Remove default strip of header name
2019-11-18 19:44:01 -05:00
020.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
021.http
Handle duplicate content-length
2019-11-18 21:16:12 -05:00
021.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
022.http
Updating Content-Length Handling
2023-05-30 20:42:13 -05:00
022.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
023.http
Updating Content-Length Handling
2023-05-30 20:42:13 -05:00
023.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
024.http
Updating Content-Length Handling
2023-05-30 20:42:13 -05:00
024.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
040.http
silently drop or refuse header names w/ underscore
2023-12-15 13:33:31 +01:00
040.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
chunked_01.http
fail-safe on unsupported request framing
2023-12-15 13:33:31 +01:00
chunked_01.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
chunked_02.http
fail-safe on unsupported request framing
2023-12-15 13:33:31 +01:00
chunked_02.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
chunked_03.http
fail-safe on unsupported request framing
2023-12-15 13:33:31 +01:00
chunked_03.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
chunked_04.http
fail-safe on unsupported request framing
2023-12-15 13:33:31 +01:00
chunked_04.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
chunked_05.http
fail-safe on unsupported request framing
2023-12-15 13:33:31 +01:00
chunked_05.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
chunked_06.http
fail-safe on unsupported request framing
2023-12-15 13:33:31 +01:00
chunked_06.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
chunked_07.http
silently drop or refuse header names w/ underscore
2023-12-15 13:33:31 +01:00
chunked_07.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
chunked_08.http
fail-safe on unsupported request framing
2023-12-15 13:33:31 +01:00
chunked_08.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
chunked_09.http
HTTP parser: stricter chunk-ext OBS handling
2023-12-17 17:46:56 +01:00
chunked_09.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
chunked_10.http
HTTP parser: stricter chunk-ext OBS handling
2023-12-17 17:46:56 +01:00
chunked_10.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
chunked_11.http
HTTP parser: stricter chunk-ext OBS handling
2023-12-17 17:46:56 +01:00
chunked_11.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
chunked_12.http
chunked encoding: example invalid requests
2024-07-31 19:21:07 +02:00
chunked_12.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
chunked_13.http
chunked encoding: example invalid requests
2024-07-31 19:21:07 +02:00
chunked_13.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
chunked_14.http
Integrate gunicorn_h1c 0.6.3 with InvalidChunkExtension support
2026-03-26 15:46:51 +01:00
chunked_14.py
Integrate gunicorn_h1c 0.6.3 with InvalidChunkExtension support
2026-03-26 15:46:51 +01:00
invalid_field_value_01.http
forbid lone CR/LF and NUL in headers
2024-07-31 01:28:30 +02:00
invalid_field_value_01.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
limit_header_default_01.http
Fix limit handling and add default max limit tests
2026-03-22 16:17:55 +01:00
limit_header_default_01.py
Fix limit handling and add default max limit tests
2026-03-22 16:17:55 +01:00
nonascii_01.http
fail-safe on unsupported request framing
2023-12-15 13:33:31 +01:00
nonascii_01.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
nonascii_02.http
fail-safe on unsupported request framing
2023-12-15 13:33:31 +01:00
nonascii_02.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
nonascii_03.http
strict HTTP header field name validation
2023-12-15 13:33:31 +01:00
nonascii_03.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
nonascii_04.http
fail-safe on unsupported request framing
2023-12-15 13:33:31 +01:00
nonascii_04.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
obs_fold_01.http
whitespace handling in header field values
2024-08-07 19:42:16 +02:00
obs_fold_01.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
pp_01.http
Implantation proxy protocol
2012-09-27 19:14:40 +02:00
pp_01.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
pp_02.http
Implantation proxy protocol
2012-09-27 19:14:40 +02:00
pp_02.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
pp_03.http
fix: enforce proxy_allow_ips and tighten PROXY parsing in ASGI
2026-05-03 22:28:48 +02:00
pp_03.py
fix: enforce proxy_allow_ips and tighten PROXY parsing in ASGI
2026-05-03 22:28:48 +02:00
prefix_01.http
fail-safe on unsupported request framing
2023-12-15 13:33:31 +01:00
prefix_01.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
prefix_02.http
fail-safe on unsupported request framing
2023-12-15 13:33:31 +01:00
prefix_02.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
prefix_03.http
fail-safe on unsupported request framing
2023-12-15 13:33:31 +01:00
prefix_03.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
prefix_04.http
fail-safe on unsupported request framing
2023-12-15 13:33:31 +01:00
prefix_04.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
prefix_05.http
fail-safe on unsupported request framing
2023-12-15 13:33:31 +01:00
prefix_05.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
prefix_06.http
strict HTTP version validation
2023-12-15 13:33:31 +01:00
prefix_06.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
rfc9110_field_value_ctl_bel_01.http
test: add failing fixtures for control chars in header value
2026-04-19 12:05:00 +02:00
rfc9110_field_value_ctl_bel_01.py
chore: require gunicorn_h1c >=0.6.4 and drop python_only markers
2026-04-19 23:40:58 +02:00
rfc9110_field_value_ctl_del_01.http
test: add failing fixtures for control chars in header value
2026-04-19 12:05:00 +02:00
rfc9110_field_value_ctl_del_01.py
chore: require gunicorn_h1c >=0.6.4 and drop python_only markers
2026-04-19 23:40:58 +02:00
rfc9110_trailer_forbidden_cl_01.http
test: add failing fixtures for forbidden trailer fields
2026-04-19 11:38:05 +02:00
rfc9110_trailer_forbidden_cl_01.py
chore: require gunicorn_h1c >=0.6.4 and drop python_only markers
2026-04-19 23:40:58 +02:00
rfc9110_trailer_forbidden_host_01.http
test: add failing fixtures for forbidden trailer fields
2026-04-19 11:38:05 +02:00
rfc9110_trailer_forbidden_host_01.py
chore: require gunicorn_h1c >=0.6.4 and drop python_only markers
2026-04-19 23:40:58 +02:00
rfc9110_trailer_forbidden_te_01.http
test: add failing fixtures for forbidden trailer fields
2026-04-19 11:38:05 +02:00
rfc9110_trailer_forbidden_te_01.py
chore: require gunicorn_h1c >=0.6.4 and drop python_only markers
2026-04-19 23:40:58 +02:00
rfc9112_chunked_size_minus_sign_01.http
test: codify chunked size/extension edge cases (RFC 9112 section 7.1)
2026-04-19 13:21:20 +02:00
rfc9112_chunked_size_minus_sign_01.py
test: codify chunked size/extension edge cases (RFC 9112 section 7.1)
2026-04-19 13:21:20 +02:00
rfc9112_chunked_size_plus_sign_01.http
test: codify chunked size/extension edge cases (RFC 9112 section 7.1)
2026-04-19 13:21:20 +02:00
rfc9112_chunked_size_plus_sign_01.py
test: codify chunked size/extension edge cases (RFC 9112 section 7.1)
2026-04-19 13:21:20 +02:00
rfc9112_smuggle_cl_list_form_01.http
test: codify rejection of Content-Length list form (RFC 9112 section 6.3)
2026-04-19 20:49:32 +02:00
rfc9112_smuggle_cl_list_form_01.py
chore: require gunicorn_h1c >=0.6.5 and drop last python_only marker
2026-04-20 07:29:47 +02:00
rfc9112_smuggle_cl_te_chunked_01.http
test: codify RFC 9112 request-target and TE/CL vectors (phase 1)
2026-04-19 09:52:15 +02:00
rfc9112_smuggle_cl_te_chunked_01.py
test: codify RFC 9112 request-target and TE/CL vectors (phase 1)
2026-04-19 09:52:15 +02:00
rfc9112_target_asterisk_non_options_01.http
test: add failing fixture for asterisk-form with non-OPTIONS method
2026-04-19 10:37:14 +02:00
rfc9112_target_asterisk_non_options_01.py
chore: require gunicorn_h1c >=0.6.4 and drop python_only markers
2026-04-19 23:40:58 +02:00
rfc9112_target_authority_non_connect_01.http
test: add failing fixture for authority-form with non-CONNECT method
2026-04-19 11:09:29 +02:00
rfc9112_target_authority_non_connect_01.py
chore: require gunicorn_h1c >=0.6.4 and drop python_only markers
2026-04-19 23:40:58 +02:00
rfc9112_target_relative_01.http
test: codify rejection of relative-reference request-target (RFC 9112 section 3.2)
2026-04-19 11:23:00 +02:00
rfc9112_target_relative_01.py
chore: require gunicorn_h1c >=0.6.4 and drop python_only markers
2026-04-19 23:40:58 +02:00
version_01.http
strict HTTP version validation
2023-12-15 13:33:31 +01:00
version_01.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00
version_02.http
strict HTTP version validation
2023-12-15 13:33:31 +01:00
version_02.py
chore: prepare release 25.0.2
2026-02-06 08:21:18 +01:00