Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

pywsgi treats invalid HTTP method as a format string #1708

Closed
sgrimm opened this issue Nov 26, 2020 · 1 comment · Fixed by #1714 or locustio/locust#2023
Closed

pywsgi treats invalid HTTP method as a format string #1708

sgrimm opened this issue Nov 26, 2020 · 1 comment · Fixed by #1714 or locustio/locust#2023

Comments

@sgrimm
Copy link

sgrimm commented Nov 26, 2020

  • gevent version: 20.9.0
  • Python version: cPython 3.8.5
  • Operating System: BalenaOS (Debian Linux 10.4 Linux 5.4.58 aarch64)

Description:

A client sent an HTTPS request to a WSGIServer that didn't have SSL enabled. The server was unable to cleanly log the usual error message about an invalid HTTP method because the HTTPS data happened to include a percent sign.

Traceback (most recent call last):
  File "/usr/local/lib/python3.8/site-packages/gevent/pywsgi.py", line 666, in handle_one_request
    if not self.read_request(self.requestline):
  File "/usr/local/lib/python3.8/site-packages/gevent/pywsgi.py", line 523, in read_request
    raise _InvalidClientRequest('Invalid http version: %r' % (raw_requestline,))
gevent.pywsgi._InvalidClientRequest: Invalid http version: '\x16\x03\x01\x02\x00\x01\x00\x01ü\x03\x03Î2\x11"\x18³\x1cðb\x06%]\\Á_ãçÎl½\x7fä³\x9a\x9d\x93k«o{&\xad aÏ\x06KhÛ\x80ÕÐTu¹0ÿ\n'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.8/site-packages/gevent/pywsgi.py", line 569, in log_error
    message = msg % args
TypeError: not enough arguments for format string

What I've run:

Assuming there's a non-HTTPS WSGIServer running on port 5000, the extra exception is easy to reproduce:

echo '%' | nc localhost 5000
jamadden added a commit that referenced this issue Dec 4, 2020
…nt requests.

Specifically, those that contain a spurious % in the request line.

Test this, explicitly asserting both the returned status code and that we don't print a traceback.

Fixes #1708.
@jamadden
Copy link
Member

jamadden commented Dec 4, 2020

Thanks for the report.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants