Skip to content

Conversation

@gpshead
Copy link
Member

(cherry picked from commit f7fceed)

…pythonGH-143917) * Add 'test.support' fixture for C0 control characters * pythongh-143916: Reject control characters in wsgiref.headers.Headers (cherry picked from commit f7fceed)
@gpsheadgpshead added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes labels Jan 17, 2026
@gpsheadgpshead changed the title [3.13] gh-143916: Reject control characters in wsgiref.headers.Headers[3.13] gh-143916: Reject control characters in wsgiref.headers.Headers (GH-143917)Jan 17, 2026
@bedevere-appbedevere-appbot added the type-security A security issue label Jan 17, 2026
@gpsheadgpshead enabled auto-merge (squash) January 17, 2026 18:04
@gpsheadgpshead merged commit 22e4d55 into python:3.13Jan 17, 2026
45 of 46 checks passed
@miss-islington-app
Copy link

Thanks @gpshead for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12.
🐍🍒⛏🤖

@miss-islington-app
Copy link

Sorry, @gpshead, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 22e4d55285cee52bc4dbe061324e5f30bd4dee58 3.12 

@miss-islington-app
Copy link

Sorry, @gpshead, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 22e4d55285cee52bc4dbe061324e5f30bd4dee58 3.11 

@miss-islington-app
Copy link

Sorry, @gpshead, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 22e4d55285cee52bc4dbe061324e5f30bd4dee58 3.10 

@bedevere-app
Copy link

GH-143974 is a backport of this pull request to the 3.12 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.12 only security fixes label Jan 17, 2026
gpshead added a commit to gpshead/cpython that referenced this pull request Jan 17, 2026
…Headers (pythonGH-143917) (pythonGH-143973) pythongh-143916: Reject control characters in wsgiref.headers.Headers (pythonGH-143917) * Add 'test.support' fixture for C0 control characters * pythongh-143916: Reject control characters in wsgiref.headers.Headers (cherry picked from commit f7fceed) (cherry picked from commit 22e4d55) Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com> Co-authored-by: Seth Michael Larson <seth@python.org>
gpshead added a commit to gpshead/cpython that referenced this pull request Jan 17, 2026
…Headers (pythonGH-143917) (pythonGH-143973) pythongh-143916: Reject control characters in wsgiref.headers.Headers (pythonGH-143917) * Add 'test.support' fixture for C0 control characters * pythongh-143916: Reject control characters in wsgiref.headers.Headers (cherry picked from commit f7fceed) (cherry picked from commit 22e4d55) Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com> Co-authored-by: Seth Michael Larson <seth@python.org>
@bedevere-app
Copy link

GH-143975 is a backport of this pull request to the 3.11 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.11 only security fixes label Jan 17, 2026
gpshead added a commit to gpshead/cpython that referenced this pull request Jan 17, 2026
…Headers (pythonGH-143917) (pythonGH-143973) pythongh-143916: Reject control characters in wsgiref.headers.Headers (pythonGH-143917) * Add 'test.support' fixture for C0 control characters * pythongh-143916: Reject control characters in wsgiref.headers.Headers (cherry picked from commit f7fceed) (cherry picked from commit 22e4d55) Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com> Co-authored-by: Seth Michael Larson <seth@python.org>
@bedevere-app
Copy link

GH-143976 is a backport of this pull request to the 3.10 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.10 only security fixes label Jan 17, 2026
Yhg1s pushed a commit that referenced this pull request Jan 19, 2026
GH-143917) (GH-143973) (#143974) * Add 'test.support' fixture for C0 control characters * gh-143916: Reject control characters in wsgiref.headers.Headers (cherry picked from commit f7fceed) (cherry picked from commit 22e4d55) Co-authored-by: Seth Michael Larson <seth@python.org>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

type-securityA security issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@gpshead@sethmlarson