Daphne allows invalid characters within header names

[kenballus]

Daphne allows invalid characters within header names

[kenballus]

Of particular note is that \x00, \t, and are permitted, which have historically been sources of exploitable parsing discrepancies between origin servers and gateway servers.

[carltongibson]

@kenballus thanks for the report. Are you up for making a PR here?

[carltongibson]

h11 gives a regex for a header name here:

https://github.com/python-hyper/h11/blob/a2c68948accadc3876dffcf979d98002e4a4ed27/h11/_abnf.py#L10-L21C1

That's then validated when parsing the headers here: https://github.com/python-hyper/h11/blob/a2c68948accadc3876dffcf979d98002e4a4ed27/h11/_headers.py#L163

Gunicorn does similar here https://github.com/benoitc/gunicorn/blob/cf55d2cec277f220ebd605989ce78ad1bb553c46/gunicorn/http/message.py#L92-L93 (but matching bad headers, with what looks like a more complex regex.)

We'd handle that in the http and ws protocols:

daphne/daphne/http_protocol.py

Lines 147 to 158 in 993efe6

	# Sanitize and decode headers, potentially extracting root path
	self.clean_headers = []
	self.root_path = self.server.root_path
	for name, values in self.requestHeaders.getAllRawHeaders():
	# Prevent CVE-2015-0219
	if b"_" in name:
	continue
	for value in values:
	if name.lower() == b"daphne-root-path":
	self.root_path = unquote(value.decode("ascii"))
	else:
	self.clean_headers.append((name.lower(), value))

daphne/daphne/ws_protocol.py

Lines 37 to 44 in 993efe6

	# Sanitize and decode headers
	self.clean_headers = []
	for name, value in request.headers.items():
	name = name.encode("ascii")
	# Prevent CVE-2015-0219
	if b"_" in name:
	continue
	self.clean_headers.append((name.lower(), value.encode("latin1")))

Need to investigate whether this should be handled by twisted. https://github.com/twisted/twisted/blob/446ee139189440e890b26a29af256e9b9d0e8eba/src/twisted/web/http_headers.py

[carltongibson]

h11 test examples for no weird characters in names are here:

https://github.com/python-hyper/h11/blob/a2c68948accadc3876dffcf979d98002e4a4ed27/h11/tests/test_headers.py#L24-L35

[carltongibson]

Should be addressed by #500.