[Django] #30737: Incorrectly encoded headers can yield uncaught UnicodeDecodeError

classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|

[Django] #30737: Incorrectly encoded headers can yield uncaught UnicodeDecodeError

Django
#30737: Incorrectly encoded headers can yield uncaught UnicodeDecodeError
-----------------------------------------+------------------------
               Reporter:  Mark Gordon    |          Owner:  nobody
                   Type:  Bug            |         Status:  new
              Component:  Uncategorized  |        Version:  2.2
               Severity:  Normal         |       Keywords:
           Triage Stage:  Unreviewed     |      Has patch:  0
    Needs documentation:  0              |    Needs tests:  0
Patch needs improvement:  0              |  Easy pickings:  1
                  UI/UX:  0              |
-----------------------------------------+------------------------
 Sending a post with a Content-Type header that contains non-ascii
 characters will cause a UnicodeDecodeError to be raised and uncaught
 resulting in a 500 error rather than handling the issue and giving a 400
 as would be appropriate.

 Make such an erronous request with something like:

 {{{
 curl -d '' -H 'Content-Type: application/€' http://django-server/
 }}}

 Raises the below exception/stack trace

 {{{

 UnicodeDecodeError: 'ascii' codec can't decode byte 0xe2 in position 12:
 ordinal not in range(128)
 (15 additional frame(s) were not displayed)
 ...
   File "rest_framework/request.py", line 427, in POST
     self._load_data_and_files()
   File "rest_framework/request.py", line 275, in _load_data_and_files
     self._data, self._files = self._parse()
   File "rest_framework/request.py", line 337, in _parse
     if media_type and is_form_media_type(media_type):
   File "rest_framework/request.py", line 32, in is_form_media_type
     base_media_type, params =
 parse_header(media_type.encode(HTTP_HEADER_ENCODING))
   File "django/http/multipartparser.py", line 652, in parse_header
     key = plist.pop(0).lower().decode('ascii')
 }}}

--
Ticket URL: <https://code.djangoproject.com/ticket/30737>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

--
You received this message because you are subscribed to the Google Groups "Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To view this discussion on the web visit https://groups.google.com/d/msgid/django-updates/049.ee0590b1402d101eed8825fad23c8a32%40djangoproject.com.
Reply | Threaded
Open this post in threaded view
|

Re: [Django] #30737: Incorrectly encoded headers can yield uncaught UnicodeDecodeError

Django
#30737: Incorrectly encoded headers can yield uncaught UnicodeDecodeError
-------------------------------+--------------------------------------
     Reporter:  Mark Gordon    |                    Owner:  nobody
         Type:  Bug            |                   Status:  closed
    Component:  HTTP handling  |                  Version:  master
     Severity:  Normal         |               Resolution:  invalid
     Keywords:                 |             Triage Stage:  Unreviewed
    Has patch:  0              |      Needs documentation:  0
  Needs tests:  0              |  Patch needs improvement:  0
Easy pickings:  0              |                    UI/UX:  0
-------------------------------+--------------------------------------
Changes (by felixxm):

 * status:  new => closed
 * resolution:   => invalid
 * version:  2.2 => master
 * component:  Uncategorized => HTTP handling
 * easy:  1 => 0


Comment:

 Thanks for this report, however `parse_header` is a part of internal API
 that expects an ASCII-encoded bytes (see
 [https://github.com/django/django/blob/a44d80f88e22eda24dacef48e368895ebea96635/django/http/multipartparser.py#L70-L73
 an example]). You can raise an issue in DRF if you think that there is any
 in the way how they handle/use it.

 Closing per TicketClosingReasons/UseSupportChannels.

--
Ticket URL: <https://code.djangoproject.com/ticket/30737#comment:1>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

--
You received this message because you are subscribed to the Google Groups "Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To view this discussion on the web visit https://groups.google.com/d/msgid/django-updates/064.85378cc42be5e74357ea9007ddc99e63%40djangoproject.com.