Reject NUL bytes in HTTP request lines

cheroot/server.py

@@ -802,6 +802,12 @@ def read_request_line(self):  # noqa: C901  # FIXME
 
         try:
             method, uri, req_protocol = request_line.strip().split(SPACE, 2)
+            if b'\x00' in request_line:
+                self.simple_response(
+                    '400 Bad Request',
+                    'Malformed Request-Line',
+                )
+                return False
             if not req_protocol.startswith(b'HTTP/'):
                 self.simple_response(
                     '400 Bad Request',

cheroot/test/test_core.py

@@ -420,6 +420,17 @@ def test_garbage_in(test_client):
             raise
 
 
+def test_null_byte_in_request_line(test_client):
+    """Check that NUL bytes in the request line return Bad Request."""
+    c = test_client.get_connection()
+    c._output(b'GET /\x00 HTTP/1.1')
+    c._send_output()
+    response = _get_http_response(c, method='GET')
+    response.begin()
+    assert response.status == HTTP_BAD_REQUEST
+    c.close()
+
+
 class CloseController:
     """Controller for testing the close callback."""