Skip to content

Conversation

@gpshead
Copy link
Member

@gpshead gpshead commented Jan 17, 2026

(cherry picked from commit f7fceed)

…pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
@gpshead gpshead added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes labels Jan 17, 2026
@gpshead gpshead changed the title [3.13] gh-143916: Reject control characters in wsgiref.headers.Headers [3.13] gh-143916: Reject control characters in wsgiref.headers.Headers (GH-143917) Jan 17, 2026
@bedevere-app bedevere-app bot added the type-security A security issue label Jan 17, 2026
@gpshead gpshead enabled auto-merge (squash) January 17, 2026 18:04
@gpshead gpshead merged commit 22e4d55 into python:3.13 Jan 17, 2026
45 of 46 checks passed
@miss-islington-app
Copy link

Thanks @gpshead for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12.
🐍🍒⛏🤖

@miss-islington-app
Copy link

Sorry, @gpshead, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 22e4d55285cee52bc4dbe061324e5f30bd4dee58 3.12

@miss-islington-app
Copy link

Sorry, @gpshead, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 22e4d55285cee52bc4dbe061324e5f30bd4dee58 3.11

@miss-islington-app
Copy link

Sorry, @gpshead, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 22e4d55285cee52bc4dbe061324e5f30bd4dee58 3.10

@bedevere-app
Copy link

bedevere-app bot commented Jan 17, 2026

GH-143974 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.12 only security fixes label Jan 17, 2026
gpshead added a commit to gpshead/cpython that referenced this pull request Jan 17, 2026
…Headers (pythonGH-143917) (pythonGH-143973)

pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
(cherry picked from commit 22e4d55)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
Co-authored-by: Seth Michael Larson <seth@python.org>
gpshead added a commit to gpshead/cpython that referenced this pull request Jan 17, 2026
…Headers (pythonGH-143917) (pythonGH-143973)

pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
(cherry picked from commit 22e4d55)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
Co-authored-by: Seth Michael Larson <seth@python.org>
@bedevere-app
Copy link

bedevere-app bot commented Jan 17, 2026

GH-143975 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.11 only security fixes label Jan 17, 2026
gpshead added a commit to gpshead/cpython that referenced this pull request Jan 17, 2026
…Headers (pythonGH-143917) (pythonGH-143973)

pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
(cherry picked from commit 22e4d55)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
Co-authored-by: Seth Michael Larson <seth@python.org>
@bedevere-app
Copy link

bedevere-app bot commented Jan 17, 2026

GH-143976 is a backport of this pull request to the 3.10 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.10 only security fixes label Jan 17, 2026
Yhg1s pushed a commit that referenced this pull request Jan 19, 2026
GH-143917) (GH-143973) (#143974)

* Add 'test.support' fixture for C0 control characters
* gh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
(cherry picked from commit 22e4d55)

Co-authored-by: Seth Michael Larson <seth@python.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

type-security A security issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants