Anonymous committed a097832

Fixed #10188: prevent newlines in HTTP headers. Thanks, bthomas.

Comments (0)

Files changed (3)


         cookiedict[key] = c.get(key).value
     return cookiedict
+class BadHeaderError(ValueError):
+    pass
 class HttpResponse(object):
     """A basic HTTP response, with content and dictionary-accessed headers."""
     def _convert_to_ascii(self, *values):
         """Converts all values to ascii strings."""
         for value in values:
+            if '\n' in value or '\r' in value:
+                raise BadHeaderError("Header values can't contain newlines (got %r)" % (value))
             if isinstance(value, unicode):
                     yield value.encode('us-ascii')


     >>> response = HttpResponse()
     >>> response['Pragma'] = 'no-cache'
+.. versionadded:: 1.1
+HTTP headers cannot contain newlines. An attempt to set a header containing a
+newline character (CR or LF) will raise ``BadHeaderError``
 Telling the browser to treat the response as a file attachment


 UnicodeEncodeError: ..., HTTP response headers must be in US-ASCII format
+# Bug #10188: Do not allow newlines in headers (CR or LF)
+>>> r['test\\rstr'] = 'test'
+Traceback (most recent call last):
+BadHeaderError: Header values can't contain newlines (got 'test\\rstr')
+>>> r['test\\nstr'] = 'test'
+Traceback (most recent call last):
+BadHeaderError: Header values can't contain newlines (got 'test\\nstr')
 # Regression test for #8278: QueryDict.update(QueryDict)