Skip to content

Cheroot incorrectly allows whitespace after HTTP versionsΒ #717

Open
@kenballus

Description

@kenballus

❓ I'm submitting a ...

  • 🐞 bug report
  • 🐣 feature request
  • ❓ question about the decisions made in the repository

🐞 Describe the bug. What is the current behavior?
RFC 9112 defines the following grammar rule for request lines:

request-line = method SP request-target SP HTTP-version

Cheroot accepts whitespace after the HTTP-version, even though this is not allowed by the grammar rule above.

❓ What is the motivation / use case for changing the behavior?
RFC compliance.

πŸ’‘ To Reproduce

  1. Start a Cheroot server.
  2. Send it the following request:
GET / HTTP1.1 \r\n
Host: whatever\r\n
\r\n
  1. Observe that the server responds 200.

πŸ’‘ Expected behavior
The server should respond 400.

πŸ“‹ Environment

  • Cheroot version: 10.0.2.dev71+g1ff20b18
  • Python version: 3.11.9
  • OS: Linux 6.9.1

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething is brokentriage

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions