mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-04-25 17:54:37 +00:00
Code Issues 32 Releases Wiki Activity

Fixed #20889 -- Prevented email.Header from inserting newlines

Browse Source 
Passed large maxlinelen to email.Header to prevent newlines from being
inserted into value returned by _convert_to_charset

Thanks mjl at laubach.at for the report.
This commit is contained in:
Daniel Boeve 2013-09-06 18:47:08 +00:00 committed by Tim Graham
parent aeed2cf3b2
commit 6dca603abb
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
django/http/response.py
View File

@ -2,6 +2,7 @@ from __future__ import unicode_literals
import datetime import datetime
import time import time
import sys
from email.header import Header from email.header import Header
try: try:
from urllib.parse import urlparse from urllib.parse import urlparse
@ -160,7 +161,7 @@ class HttpResponseBase(six.Iterator):
except UnicodeError as e: except UnicodeError as e:
if mime_encode: if mime_encode:
# Wrapping in str() is a workaround for #12422 under Python 2. # Wrapping in str() is a workaround for #12422 under Python 2.
value = str(Header(value, 'utf-8').encode()) value = str(Header(value, 'utf-8', maxlinelen=sys.maxsize).encode())
else: else:
e.reason += ', HTTP response headers must be in %s format' % charset e.reason += ', HTTP response headers must be in %s format' % charset
raise raise

7
tests/httpwrappers/tests.py
View File

@ -290,6 +290,13 @@ class HttpResponseTests(unittest.TestCase):
self.assertRaises(UnicodeError, r.__setitem__, 'føø', 'bar') self.assertRaises(UnicodeError, r.__setitem__, 'føø', 'bar')
self.assertRaises(UnicodeError, r.__setitem__, 'føø'.encode('utf-8'), 'bar') self.assertRaises(UnicodeError, r.__setitem__, 'føø'.encode('utf-8'), 'bar')
def test_long_line(self):
# Bug #20889: long lines trigger newlines to be added to headers
# (which is not allowed due to bug #10188)
h = HttpResponse()
f = 'zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz a\xcc\x88'.encode('latin-1')
f = f.decode('utf-8')
h['Content-Disposition'] = u'attachment; filename="%s"' % f
def test_newlines_in_headers(self): def test_newlines_in_headers(self):
# Bug #10188: Do not allow newlines in headers (CR or LF) # Bug #10188: Do not allow newlines in headers (CR or LF)