Skip to content

Conversation

@gpshead
Copy link
Member

@gpshead gpshead commented Jan 17, 2026

(cherry picked from commit f7fceed)

…pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
@gpshead gpshead added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes labels Jan 17, 2026
@gpshead gpshead changed the title [3.13] gh-143916: Reject control characters in wsgiref.headers.Headers [3.13] gh-143916: Reject control characters in wsgiref.headers.Headers (GH-143917) Jan 17, 2026
@bedevere-app bedevere-app bot added the type-security A security issue label Jan 17, 2026
@gpshead gpshead enabled auto-merge (squash) January 17, 2026 18:04
@gpshead gpshead merged commit 22e4d55 into python:3.13 Jan 17, 2026
45 of 46 checks passed
@miss-islington-app
Copy link

Thanks @gpshead for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12.
🐍🍒⛏🤖

@miss-islington-app
Copy link

Sorry, @gpshead, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 22e4d55285cee52bc4dbe061324e5f30bd4dee58 3.12

@miss-islington-app
Copy link

Sorry, @gpshead, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 22e4d55285cee52bc4dbe061324e5f30bd4dee58 3.11

@miss-islington-app
Copy link

Sorry, @gpshead, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 22e4d55285cee52bc4dbe061324e5f30bd4dee58 3.10

@bedevere-app
Copy link

bedevere-app bot commented Jan 17, 2026

GH-143974 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.12 only security fixes label Jan 17, 2026
gpshead added a commit to gpshead/cpython that referenced this pull request Jan 17, 2026
…Headers (pythonGH-143917) (pythonGH-143973)

pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
(cherry picked from commit 22e4d55)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
Co-authored-by: Seth Michael Larson <seth@python.org>
gpshead added a commit to gpshead/cpython that referenced this pull request Jan 17, 2026
…Headers (pythonGH-143917) (pythonGH-143973)

pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
(cherry picked from commit 22e4d55)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
Co-authored-by: Seth Michael Larson <seth@python.org>
@bedevere-app
Copy link

bedevere-app bot commented Jan 17, 2026

GH-143975 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.11 only security fixes label Jan 17, 2026
gpshead added a commit to gpshead/cpython that referenced this pull request Jan 17, 2026
…Headers (pythonGH-143917) (pythonGH-143973)

pythongh-143916: Reject control characters in wsgiref.headers.Headers  (pythonGH-143917)

* Add 'test.support' fixture for C0 control characters
* pythongh-143916: Reject control characters in wsgiref.headers.Headers

(cherry picked from commit f7fceed)
(cherry picked from commit 22e4d55)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
Co-authored-by: Seth Michael Larson <seth@python.org>
@bedevere-app
Copy link

bedevere-app bot commented Jan 17, 2026

GH-143976 is a backport of this pull request to the 3.10 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.10 only security fixes label Jan 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

type-security A security issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants