From owner-svn-ports-all@freebsd.org Sun Nov 27 16:52:26 2016 Return-Path: Delivered-To: svn-ports-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 792D7C5892C; Sun, 27 Nov 2016 16:52:26 +0000 (UTC) (envelope-from brnrd@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 3A2B518DB; Sun, 27 Nov 2016 16:52:26 +0000 (UTC) (envelope-from brnrd@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id uARGqP96086583; Sun, 27 Nov 2016 16:52:25 GMT (envelope-from brnrd@FreeBSD.org) Received: (from brnrd@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id uARGqP7h086580; Sun, 27 Nov 2016 16:52:25 GMT (envelope-from brnrd@FreeBSD.org) Message-Id: <201611271652.uARGqP7h086580@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: brnrd set sender to brnrd@FreeBSD.org using -f From: Bernard Spil Date: Sun, 27 Nov 2016 16:52:25 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r427246 - in head/lang/python33: . files X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 27 Nov 2016 16:52:26 -0000 Author: brnrd Date: Sun Nov 27 16:52:25 2016 New Revision: 427246 URL: https://svnweb.freebsd.org/changeset/ports/427246 Log: lang/python33: Fix HTTP Header injection vulnerability - Backport of upstream fix for 3.4/3.5 PR: 210539 Submitted by: Vladimir Krstulja Reported by: Vladimir Krstulja Reviewed by: robak, brnrd MFH: 2016Q4 Security: CVE-2016-5699 Security: a61374fc-3a4d-11e6-a671-60a44ce6887b Differential Revision: D7107 Added: head/lang/python33/files/patch-Lib_http_client.py (contents, props changed) head/lang/python33/files/patch-Lib_test_test__httplib.py (contents, props changed) Modified: head/lang/python33/Makefile Modified: head/lang/python33/Makefile ============================================================================== --- head/lang/python33/Makefile Sun Nov 27 16:43:30 2016 (r427245) +++ head/lang/python33/Makefile Sun Nov 27 16:52:25 2016 (r427246) @@ -2,7 +2,7 @@ PORTNAME= python33 PORTVERSION= ${PYTHON_PORTVERSION} -PORTREVISION= 5 +PORTREVISION= 6 CATEGORIES= lang python ipv6 MASTER_SITES= PYTHON/ftp/python/${PORTVERSION} DISTNAME= Python-${PORTVERSION} Added: head/lang/python33/files/patch-Lib_http_client.py ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/lang/python33/files/patch-Lib_http_client.py Sun Nov 27 16:52:25 2016 (r427246) @@ -0,0 +1,76 @@ +Based on and adapted for Python 3.3: https://hg.python.org/cpython/rev/bf3e1c9b80e9 +# HG changeset patch +# User Serhiy Storchaka +# Date 1426151616 -7200 +# Node ID bf3e1c9b80e995311ba932e42200f076e03034c0 +# Parent 2b4a04c3681b1210529eb8a224cc007a0b92a890 +Issue #22928: Disabled HTTP header injections in http.client. +Original patch by Demian Brecht. + +--- Lib/http/client.py.orig 2016-06-30 21:29:02 UTC ++++ Lib/http/client.py +@@ -70,6 +70,7 @@ import email.parser + import email.message + import io + import os ++import re + import socket + import collections + from urllib.parse import urlsplit +@@ -216,6 +217,35 @@ MAXAMOUNT = 1048576 + _MAXLINE = 65536 + _MAXHEADERS = 100 + ++# Header name/value ABNF (http://tools.ietf.org/html/rfc7230#section-3.2) ++# ++# VCHAR = %x21-7E ++# obs-text = %x80-FF ++# header-field = field-name ":" OWS field-value OWS ++# field-name = token ++# field-value = *( field-content / obs-fold ) ++# field-content = field-vchar [ 1*( SP / HTAB ) field-vchar ] ++# field-vchar = VCHAR / obs-text ++# ++# obs-fold = CRLF 1*( SP / HTAB ) ++# ; obsolete line folding ++# ; see Section 3.2.4 ++ ++# token = 1*tchar ++# ++# tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" ++# / "+" / "-" / "." / "^" / "_" / "`" / "|" / "~" ++# / DIGIT / ALPHA ++# ; any VCHAR, except delimiters ++# ++# VCHAR defined in http://tools.ietf.org/html/rfc5234#appendix-B.1 ++ ++# the patterns for both name and value are more leniant than RFC ++# definitions to allow for backwards compatibility ++_is_legal_header_name = re.compile(rb'^[^:\s][^:\r\n]*$').match ++_is_illegal_header_value = re.compile(rb'\n(?![ \t])|\r(?![ \t\n])').search ++ ++ + + class HTTPMessage(email.message.Message): + # XXX The only usage of this method is in +@@ -1035,12 +1065,20 @@ class HTTPConnection: + + if hasattr(header, 'encode'): + header = header.encode('ascii') ++ ++ if not _is_legal_header_name(header): ++ raise ValueError('Invalid header name %r' % (header,)) ++ + values = list(values) + for i, one_value in enumerate(values): + if hasattr(one_value, 'encode'): + values[i] = one_value.encode('latin-1') + elif isinstance(one_value, int): + values[i] = str(one_value).encode('ascii') ++ ++ if _is_illegal_header_value(values[i]): ++ raise ValueError('Invalid header value %r' % (values[i],)) ++ + value = b'\r\n\t'.join(values) + header = header + b': ' + value + self._output(header) Added: head/lang/python33/files/patch-Lib_test_test__httplib.py ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/lang/python33/files/patch-Lib_test_test__httplib.py Sun Nov 27 16:52:25 2016 (r427246) @@ -0,0 +1,80 @@ +Based on and adapted for Python 3.3: https://hg.python.org/cpython/rev/bf3e1c9b80e9 +# HG changeset patch +# User Serhiy Storchaka +# Date 1426151616 -7200 +# Node ID bf3e1c9b80e995311ba932e42200f076e03034c0 +# Parent 2b4a04c3681b1210529eb8a224cc007a0b92a890 +Issue #22928: Disabled HTTP header injections in http.client. +Original patch by Demian Brecht. + +--- Lib/test/test_httplib.py.orig 2016-06-30 21:31:29 UTC ++++ Lib/test/test_httplib.py +@@ -134,6 +134,33 @@ class HeaderTests(TestCase): + conn.putheader('Content-length', 42) + self.assertIn(b'Content-length: 42', conn._buffer) + ++ conn.putheader('Foo', ' bar ') ++ self.assertIn(b'Foo: bar ', conn._buffer) ++ conn.putheader('Bar', '\tbaz\t') ++ self.assertIn(b'Bar: \tbaz\t', conn._buffer) ++ conn.putheader('Authorization', 'Bearer mytoken') ++ self.assertIn(b'Authorization: Bearer mytoken', conn._buffer) ++ conn.putheader('IterHeader', 'IterA', 'IterB') ++ self.assertIn(b'IterHeader: IterA\r\n\tIterB', conn._buffer) ++ conn.putheader('LatinHeader', b'\xFF') ++ self.assertIn(b'LatinHeader: \xFF', conn._buffer) ++ conn.putheader('Utf8Header', b'\xc3\x80') ++ self.assertIn(b'Utf8Header: \xc3\x80', conn._buffer) ++ conn.putheader('C1-Control', b'next\x85line') ++ self.assertIn(b'C1-Control: next\x85line', conn._buffer) ++ conn.putheader('Embedded-Fold-Space', 'is\r\n allowed') ++ self.assertIn(b'Embedded-Fold-Space: is\r\n allowed', conn._buffer) ++ conn.putheader('Embedded-Fold-Tab', 'is\r\n\tallowed') ++ self.assertIn(b'Embedded-Fold-Tab: is\r\n\tallowed', conn._buffer) ++ conn.putheader('Key Space', 'value') ++ self.assertIn(b'Key Space: value', conn._buffer) ++ conn.putheader('KeySpace ', 'value') ++ self.assertIn(b'KeySpace : value', conn._buffer) ++ conn.putheader(b'Nonbreak\xa0Space', 'value') ++ self.assertIn(b'Nonbreak\xa0Space: value', conn._buffer) ++ conn.putheader(b'\xa0NonbreakSpace', 'value') ++ self.assertIn(b'\xa0NonbreakSpace: value', conn._buffer) ++ + def test_ipv6host_header(self): + # Default host header on IPv6 transaction should wrapped by [] if + # its actual IPv6 address +@@ -153,6 +180,34 @@ class HeaderTests(TestCase): + conn.request('GET', '/foo') + self.assertTrue(sock.data.startswith(expected)) + ++ def test_invalid_headers(self): ++ conn = client.HTTPConnection('example.com') ++ conn.sock = FakeSocket('') ++ conn.putrequest('GET', '/') ++ ++ # http://tools.ietf.org/html/rfc7230#section-3.2.4, whitespace is no ++ # longer allowed in header names ++ cases = ( ++ (b'Invalid\r\nName', b'ValidValue'), ++ (b'Invalid\rName', b'ValidValue'), ++ (b'Invalid\nName', b'ValidValue'), ++ (b'\r\nInvalidName', b'ValidValue'), ++ (b'\rInvalidName', b'ValidValue'), ++ (b'\nInvalidName', b'ValidValue'), ++ (b' InvalidName', b'ValidValue'), ++ (b'\tInvalidName', b'ValidValue'), ++ (b'Invalid:Name', b'ValidValue'), ++ (b':InvalidName', b'ValidValue'), ++ (b'ValidName', b'Invalid\r\nValue'), ++ (b'ValidName', b'Invalid\rValue'), ++ (b'ValidName', b'Invalid\nValue'), ++ (b'ValidName', b'InvalidValue\r\n'), ++ (b'ValidName', b'InvalidValue\r'), ++ (b'ValidName', b'InvalidValue\n'), ++ ) ++ for name, value in cases: ++ with self.assertRaisesRegex(ValueError, 'Invalid header'): ++ conn.putheader(name, value) + + class BasicTest(TestCase): + def test_status_lines(self):