From 54c820feb3f8a7c75d35769504de19a3fdcf04cc Mon Sep 17 00:00:00 2001 From: Jeff Brooks Date: Thu, 10 Oct 2019 10:41:22 -0500 Subject: [PATCH 1/2] Ensure header value is string before conducting regex search on it. --- gunicorn/http/wsgi.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/gunicorn/http/wsgi.py b/gunicorn/http/wsgi.py index 32e7a2acc..b786bc095 100644 --- a/gunicorn/http/wsgi.py +++ b/gunicorn/http/wsgi.py @@ -253,10 +253,12 @@ def process_headers(self, headers): if HEADER_RE.search(name): raise InvalidHeaderName('%r' % name) + value = str(value) + if HEADER_VALUE_RE.search(value): raise InvalidHeader('%r' % value) - value = str(value).strip() + value = value.strip() lname = name.lower().strip() if lname == "content-length": self.response_length = int(value) From ad6ed3f4c835eb6a86ba61dadfd3896ddcbb48e3 Mon Sep 17 00:00:00 2001 From: Jeff Brooks Date: Tue, 15 Oct 2019 09:03:44 -0500 Subject: [PATCH 2/2] Implement check and exception for str type on value in Response process_headers method. --- gunicorn/http/wsgi.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/gunicorn/http/wsgi.py b/gunicorn/http/wsgi.py index b786bc095..3524471fc 100644 --- a/gunicorn/http/wsgi.py +++ b/gunicorn/http/wsgi.py @@ -253,7 +253,8 @@ def process_headers(self, headers): if HEADER_RE.search(name): raise InvalidHeaderName('%r' % name) - value = str(value) + if not isinstance(value, str): + raise TypeError('%r is not a string' % value) if HEADER_VALUE_RE.search(value): raise InvalidHeader('%r' % value)