public security bugs - #4
Open
pajod wants to merge 9 commits into
Open
Conversation
Has special syntax and meaning for proxies, neither of which we fully implement, possibly confusing proxies.
being strict about how to parse the T-E header (if in doubt, refuse) avoids security implications of non-compliant HTTP proxies
as python url parser is not strict, something inside the url might be sufficient for framing disagreements with HTTP proxies
demand case-insensitive match of duplicate headers, or host header sent in url with absolute-form target UNFINISHED: This patch is not compliant with https://datatracker.ietf.org/doc/html/rfc9112#section-3.2.2-6 "When a proxy receives a request with an absolute-form of request-target, the proxy MUST ignore the received Host header field (if any) and instead replace it with the host information of the request-target."
pajod
force-pushed
the
gunicorn23-security
branch
from
April 8, 2025 16:33
38b728b to
d2033b0
Compare
pajod
pushed a commit
that referenced
this pull request
Jun 10, 2026
gunicorn_h1c 0.6.4 ships the RFC 9110/9112 hardening added in h1c #4, benoitc#6, and benoitc#7: control chars in header values, request-target form/method pairing, and forbidden trailer field-names. All the corresponding fixtures now pass against the C parser, so their python_only markers are removed. The CL list form fixture stays marked — the C parser does not yet reject Content-Length: "5, 5".
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This contains only publicly documented security-sensitive parser issues in Gunicorn 23.0.0
This PR is meant to simplify testing patches and gather feedback on edge cases until decisions are made upstream.
missing URL validation for CONNECT method
ignoring invalid whitespace in transfer-coding
transfer-codings benoitc/gunicorn#3364NUL in URLs
pretending to support additional T-E
wrong host when using absolute-form or multiple host headers
accepting requests lacking a host header
SERVER_NAME/SERVER_PORTinvalid controls in chunk extensions
25.3.0informational responses to HTTP/1.0 requests25.0.0