Add early detection of invalid http data when request line starts with binary

python-hyper / h11

A pure-Python, bring-your-own-I/O implementation of HTTP/1.1

https://h11.readthedocs.io/

MIT License

490 stars 62 forks source link

Closed touilleMan closed 3 years ago

touilleMan commented 3 years ago

closes #121

njsmith commented 3 years ago

Looks good to me, just two nitpicks:

Can you add a newsfragment?
Can you tweak the comment (and maybe the test) to note that client TLS handshakes always start with 0x16, so this is 100% guaranteed to catch them? (It's not even a protocol version, it's a "message type" code – 0x16 is the code for "this is a handshake message", and it's been consistent across all versions of TLS so far.)

sethmlarson commented 3 years ago

Since the primary case we're covering is TLS should we test 0x16 explicitly? Otherwise LGTM.

touilleMan commented 3 years ago

@njsmith @sethmlarson I've updated my PR ;-)

pgjones commented 3 years ago

Could you update again (note there is an actual conflict here, self._start is no longer used)?

touilleMan commented 3 years ago

@pgjones rebased ! \o/

(and happy new year to the h11 team :partying_face: :champagne: :tada: )