|
| 1 | +From 0996d783f844e08fd5713ca34192e87d1fec3b77 Mon Sep 17 00:00:00 2001 |
| 2 | +From: jykanase < [email protected]> |
| 3 | +Date: Mon, 3 Feb 2025 09:29:32 +0000 |
| 4 | +Subject: [PATCH] CVE-2023-46137 |
| 5 | + |
| 6 | +Source Link: https://github.com/twisted/twisted/pull/11979 |
| 7 | +--- |
| 8 | + src/twisted/web/http.py | 32 +++++++++++++++++++++++++++----- |
| 9 | + 1 file changed, 27 insertions(+), 5 deletions(-) |
| 10 | + |
| 11 | +diff --git a/src/twisted/web/http.py b/src/twisted/web/http.py |
| 12 | +index b80a55a..23f8817 100644 |
| 13 | +--- a/src/twisted/web/http.py |
| 14 | ++++ b/src/twisted/web/http.py |
| 15 | +@@ -2443,14 +2443,38 @@ class HTTPChannel(basic.LineReceiver, policies.TimeoutMixin): |
| 16 | + |
| 17 | + self._handlingRequest = True |
| 18 | + |
| 19 | ++ # We go into raw mode here even though we will be receiving lines next |
| 20 | ++ # in the protocol; however, this data will be buffered and then passed |
| 21 | ++ # back to line mode in the setLineMode call in requestDone. |
| 22 | ++ self.setRawMode() |
| 23 | ++ |
| 24 | + req = self.requests[-1] |
| 25 | + req.requestReceived(command, path, version) |
| 26 | + |
| 27 | +- def dataReceived(self, data): |
| 28 | ++ def rawDataReceived(self, data: bytes) -> None: |
| 29 | + """ |
| 30 | +- Data was received from the network. Process it. |
| 31 | ++ This is called when this HTTP/1.1 parser is in raw mode rather than |
| 32 | ++ line mode. |
| 33 | ++ |
| 34 | ++ It may be in raw mode for one of two reasons: |
| 35 | ++ |
| 36 | ++ 1. All the headers of a request have been received and this |
| 37 | ++ L{HTTPChannel} is currently receiving its body. |
| 38 | ++ |
| 39 | ++ 2. The full content of a request has been received and is currently |
| 40 | ++ being processed asynchronously, and this L{HTTPChannel} is |
| 41 | ++ buffering the data of all subsequent requests to be parsed |
| 42 | ++ later. |
| 43 | ++ |
| 44 | ++ In the second state, the data will be played back later. |
| 45 | ++ |
| 46 | ++ @note: This isn't really a public API, and should be invoked only by |
| 47 | ++ L{LineReceiver}'s line parsing logic. If you wish to drive an |
| 48 | ++ L{HTTPChannel} from a custom data source, call C{dataReceived} on |
| 49 | ++ it directly. |
| 50 | ++ |
| 51 | ++ @see: L{LineReceive.rawDataReceived} |
| 52 | + """ |
| 53 | +- # If we're currently handling a request, buffer this data. |
| 54 | + if self._handlingRequest: |
| 55 | + self._dataBuffer.append(data) |
| 56 | + if ( |
| 57 | +@@ -2462,9 +2486,7 @@ class HTTPChannel(basic.LineReceiver, policies.TimeoutMixin): |
| 58 | + # ready. See docstring for _optimisticEagerReadSize above. |
| 59 | + self._networkProducer.pauseProducing() |
| 60 | + return |
| 61 | +- return basic.LineReceiver.dataReceived(self, data) |
| 62 | + |
| 63 | +- def rawDataReceived(self, data): |
| 64 | + self.resetTimeout() |
| 65 | + |
| 66 | + try: |
| 67 | +-- |
| 68 | +2.45.2 |
| 69 | + |
0 commit comments