Skip to content

public security bugs #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 9 commits into
base: master
Choose a base branch
from
Open

public security bugs #4

wants to merge 9 commits into from

Conversation

pajod
Copy link
Owner

@pajod pajod commented Apr 8, 2025 •
edited
Loading

This contains only publicly documented security-sensitive parser issues in Gunicorn 23.0.0

This PR is meant to simplify testing patches and gather feedback on edge cases until decisions are made upstream.

pajod added 7 commits April 7, 2025 16:32
@pajod
update docs
4bb0f06
@pajod
CI: remove CPython 3.7 (EoL)
8064aa0
@pajod
HTTP/1.0 - ignore Expect: 100-continue
0c724ac
@pajod
refuse CONNECT method
4a7a83e 
Has special syntax and meaning for proxies, neither of which we fully
implement, possibly confusing proxies.
@pajod
stop silently dropping T-E header parts
772222c 
being strict about how to parse the T-E header (if in doubt, refuse)
avoids security implications of non-compliant HTTP proxies
@pajod
refuse confusing control chars in chunk-ext & url
9d27f4f 
as python url parser is not strict, something inside the url might be
sufficient for framing disagreements with HTTP proxies
@pajod
UNFINISHED: refuse conflicting host names
d2033b0 
demand case-insensitive match of duplicate headers,
 or host header sent in url with absolute-form target

UNFINISHED:
This patch is not compliant with
https://datatracker.ietf.org/doc/html/rfc9112#section-3.2.2-6

"When a proxy receives a request with an absolute-form of request-target, the proxy MUST ignore the received Host header field (if any) and instead replace it with the host information of the request-target."
@pajod pajod force-pushed the gunicorn23-security branch from 38b728b to d2033b0 Compare April 8, 2025 16:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@pajod