Skip to content

gh-146211: Reject CR/LF in HTTP tunnel request headers#146212

Merged
sethmlarson merged 6 commits intopython:mainfrom
sethmlarson:http-client-proxy-tunnel
Apr 10, 2026
Merged

gh-146211: Reject CR/LF in HTTP tunnel request headers#146212
sethmlarson merged 6 commits intopython:mainfrom
sethmlarson:http-client-proxy-tunnel

Conversation

@sethmlarson
Copy link
Copy Markdown
Contributor

@sethmlarson sethmlarson commented Mar 20, 2026 •
edited by bedevere-app bot
Loading

@sethmlarson sethmlarson added the type-security A security issue label Mar 20, 2026
@bedevere-app bedevere-app bot mentioned this pull request Mar 20, 2026
Open
@sethmlarson
Copy link
Copy Markdown
Contributor Author

sethmlarson commented Mar 20, 2026

(Android failure looks unrelated? https://github.com/python/cpython/actions/runs/23347514549/job/67916875598?pr=146212)

@sethmlarson sethmlarson requested a review from ambv March 25, 2026 22:19
illia-v
illia-v reviewed Apr 3, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@illia-v illia-v left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍🏻
I left one minor suggestion about the _tunnel_host error message

@sethmlarson
Copy link
Copy Markdown
Contributor Author

sethmlarson commented Apr 10, 2026

I'm going to move forward with a merge, as I'm not sure there are folks who have looked at http.client more recently than @illia-v and I.

@sethmlarson sethmlarson merged commit 05ed7ce into python:main Apr 10, 2026
54 checks passed
@sethmlarson sethmlarson deleted the http-client-proxy-tunnel branch April 10, 2026 15:21
@sethmlarson sethmlarson added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Apr 10, 2026
@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 10, 2026

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 10, 2026

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 10, 2026

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 10, 2026

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 10, 2026

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 10, 2026

Sorry, @sethmlarson, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69 3.10

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 10, 2026
@sethmlarson @illia-v @miss-islington
pythongh-146211: Reject CR/LF in HTTP tunnel request headers (pythonG…
9e0d321 
…H-146212)

(cherry picked from commit 05ed7ce)

Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 10, 2026

GH-148341 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.12 only security fixes label Apr 10, 2026
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 10, 2026
@sethmlarson @illia-v @miss-islington
pythongh-146211: Reject CR/LF in HTTP tunnel request headers (pythonG…
afdd351 
…H-146212)

(cherry picked from commit 05ed7ce)

Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 10, 2026

GH-148342 is a backport of this pull request to the 3.14 branch.

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 10, 2026

Sorry, @sethmlarson, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69 3.11

@bedevere-app bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Apr 10, 2026
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 10, 2026

GH-148343 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Apr 10, 2026
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 10, 2026
@sethmlarson @illia-v @miss-islington
pythongh-146211: Reject CR/LF in HTTP tunnel request headers (pythonG…
c3f2505 
…H-146212)

(cherry picked from commit 05ed7ce)

Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Apr 10, 2026
@sethmlarson @illia-v
[3.10] pythongh-146211: Reject CR/LF in HTTP tunnel request headers (p…
fb7005a 
…ythonGH-146212)

(cherry picked from commit 05ed7ce)

Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 10, 2026

GH-148350 is a backport of this pull request to the 3.10 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.10 only security fixes label Apr 10, 2026
sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Apr 10, 2026
@sethmlarson @illia-v
[3.11] pythongh-146211: Reject CR/LF in HTTP tunnel request headers (p…
0431983 
…ythonGH-146212)

(cherry picked from commit 05ed7ce)

Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 10, 2026

GH-148351 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.11 only security fixes label Apr 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@serhiy-storchaka serhiy-storchaka Awaiting requested review from serhiy-storchaka

@ambv ambv Awaiting requested review from ambv

1 more reviewer

@illia-v illia-v illia-v left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@sethmlarson sethmlarson

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@sethmlarson @illia-v