Validate outgoing request methods #85

Activity

1. sigmavirus24 commented on Jun 5, 2019

   

   sigmavirus24

   on Jun 5, 2019

   More actions

   I wonder if there's a need to provide an escape hatch as well for projects like pathod that might be using h11 to do non-standard things.
2. jbbqqf commented on May 22, 2026

   

   jbbqqf

   on May 22, 2026

   More actions

   Hi! Triaging older issues — I think this one has shipped and can be closed.

   Evidence:

   • PR #141 "Ensure request method is a valid token", merged 2022-01-19 (commit 8195361), added method validation on the outgoing Request.
   • On current master, h11/_events.py:121 calls validate(method_re, self.method, "Illegal method characters"), where method_re is built from the RFC token ABNF in h11/_abnf.py:82.
   • Reproducer (current master, commit 62c5068):

     import h11
     h11.Request(method='GET\r\nFoo: bar', target='/', headers=[('Host', 'foo')])
     # raises h11.LocalProtocolError: Illegal method characters

   CRLF injection in the method is rejected, which is the original CVE-class concern this issue tracked. The "escape hatch" question from the follow-up comment didn't get traction; if anyone bumps into a real need for it, a separate issue would probably be cleaner.

   If I'm wrong about the coverage and there's a method-validation gap I missed, point me at the case and I'll dig further. Otherwise would you mind closing this out?

   ---

   Disclosure: I drafted this comment with help from Claude Code while triaging stale issues; the file references, PR link, and reproducer above were verified manually against current master.