Skip to content

HTTPHeaders: raise TypeError on non-string keys in set/get/delitem#3650

Open
HrachShah wants to merge 1 commit into
tornadoweb:masterfrom
HrachShah:fix/headers-reject-non-string-keys
Open

HTTPHeaders: raise TypeError on non-string keys in set/get/delitem#3650
HrachShah wants to merge 1 commit into
tornadoweb:masterfrom
HrachShah:fix/headers-reject-non-string-keys

Conversation

@HrachShah

Copy link
Copy Markdown

Fixes #3649.

HTTPHeaders.__setitem__, __getitem__, and __delitem__ did not validate the key type before calling _normalize_header, which is @lru_cache-wrapped and only accepts str. Passing a non-string key (e.g. h[1] = 'x') leaked AttributeError: 'int' object has no attribute 'split' from inside the cache. __contains__ already short-circuits the same case with False; this patch makes the three other indexers raise TypeError with a clear message instead, matching the public MutableMapping[str, str] typing.

tests/test/httputil_test.py adds four regression tests covering __setitem__, __getitem__, __delitem__, and __contains__. The first three fail on master with the original AttributeError and pass on the fix; the contains test pins the existing correct behaviour.

python3 -m tornado.test.httputil_test: 60 passed (56 baseline + 4 new). Black-formatted. PR opens on the upstream tornadoweb/tornado fork HrachShah/tornado branch fix/headers-reject-non-string-keys.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

HTTPHeaders leaks AttributeError on non-string keys via _normalize_header

1 participant