[Django] #37100: Prevent header injection through malformed response reason phrase

[Django]

#37100: Prevent header injection through malformed response reason phrase
-----------------------------+-----------------------------------------
Reporter: Jake Howard | Type: Bug
Status: new | Component: HTTP handling
Version: dev | Severity: Normal
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-----------------------------+-----------------------------------------
`HttpResponse.reason_phrase` is not correctly sanitized when creating a
response body:

{{{#!python
HttpResponse(
"body",
reason="OK\r\nX-Injected-header: yes",
)
}}}

This results in an extra header in the response, which is not present in
`.headers`.

The [https://peps.python.org/pep-0333/#the-start-response-callable WSGI
spec] requires that the status line (which contains the reason phrase)
must not contain whitespace or other control characters. Therefore, Django
should sanitize the input.

----

This was previously reported to the Security Team by rasputinkaiser,
however as reason phase is never intended to be user-controlled, it was
not considered a vulnerability.
--
Ticket URL: <https://code.djangoproject.com/ticket/37100>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#37100: Prevent header injection through malformed response reason phrase

-------------------------------+------------------------------------
Reporter: Jake Howard | Owner: (none)

Type: Bug | Status: new
Component: HTTP handling | Version: dev

Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted

Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

-------------------------------+------------------------------------
Changes (by Sarah Boyce):

* stage: Unreviewed => Accepted

--
Ticket URL: <https://code.djangoproject.com/ticket/37100#comment:1>

[Django]

#37100: Prevent header injection through malformed response reason phrase

-------------------------------------+-------------------------------------
Reporter: Jake Howard | Owner: Varun
| Kasyap Pentamaraju
Type: Bug | Status: assigned

Component: HTTP handling | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

-------------------------------------+-------------------------------------
Changes (by Varun Kasyap Pentamaraju):

* owner: (none) => Varun Kasyap Pentamaraju
* status: new => assigned

--
Ticket URL: <https://code.djangoproject.com/ticket/37100#comment:2>

[Django]

#37100: Prevent header injection through malformed response reason phrase
-------------------------------------+-------------------------------------
Reporter: Jake Howard | Owner: Varun
| Kasyap Pentamaraju
Type: Bug | Status: assigned
Component: HTTP handling | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted

Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by Varun Kasyap Pentamaraju):

* has_patch: 0 => 1

Comment:

https://github.com/django/django/pull/21290
--
Ticket URL: <https://code.djangoproject.com/ticket/37100#comment:3>

[Django]

#37100: Prevent header injection through malformed response reason phrase
-------------------------------------+-------------------------------------
Reporter: Jake Howard | Owner: Varun
| Kasyap Pentamaraju
Type: Bug | Status: assigned
Component: HTTP handling | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 1

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Jake Howard):

* needs_better_patch: 0 => 1

--
Ticket URL: <https://code.djangoproject.com/ticket/37100#comment:4>

[Django]

#37100: Prevent header injection through malformed response reason phrase
-------------------------------------+-------------------------------------
Reporter: Jake Howard | Owner: Varun
| Kasyap Pentamaraju
Type: Bug | Status: assigned
Component: HTTP handling | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Varun Kasyap Pentamaraju):

* needs_better_patch: 1 => 0

--
Ticket URL: <https://code.djangoproject.com/ticket/37100#comment:5>

[Django]

#37100: Prevent header injection through malformed response reason phrase
-------------------------------------+-------------------------------------
Reporter: Jake Howard | Owner: Varun
| Kasyap Pentamaraju
Type: Bug | Status: assigned
Component: HTTP handling | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 1

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Jake Howard):

* needs_better_patch: 0 => 1

--
Ticket URL: <https://code.djangoproject.com/ticket/37100#comment:6>

[Django]

#37100: Prevent header injection through malformed response reason phrase
-------------------------------------+-------------------------------------
Reporter: Jake Howard | Owner: Varun
| Kasyap Pentamaraju
Type: Bug | Status: assigned
Component: HTTP handling | Version: dev
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Varun Kasyap Pentamaraju):

* needs_better_patch: 1 => 0

--
Ticket URL: <https://code.djangoproject.com/ticket/37100#comment:7>

[Django]

#37100: Prevent header injection through malformed response reason phrase
-------------------------------------+-------------------------------------
Reporter: Jake Howard | Owner: Varun
| Kasyap Pentamaraju
Type: Bug | Status: assigned
Component: HTTP handling | Version: dev
Severity: Normal | Resolution:

Keywords: | Triage Stage: Ready for
| checkin

Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Jacob Walls):

* stage: Accepted => Ready for checkin

--
Ticket URL: <https://code.djangoproject.com/ticket/37100#comment:8>

[Django]

#37100: Prevent header injection through malformed response reason phrase
-------------------------------------+-------------------------------------
Reporter: Jake Howard | Owner: Varun
| Kasyap Pentamaraju

Type: Bug | Status: closed

Component: HTTP handling | Version: dev

Severity: Normal | Resolution: fixed

Keywords: | Triage Stage: Ready for
| checkin
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Jacob Walls <jacobtylerwalls@…>):

* resolution: => fixed
* status: assigned => closed

Comment:

In [changeset:"53645750412efa1e9013004040db328bd515e0f1" 5364575]:
{{{#!CommitTicketReference repository=""
revision="53645750412efa1e9013004040db328bd515e0f1"
Fixed #37100 -- Prevented control characters in HttpResponse
reason_phrase.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/37100#comment:9>

[Django]

#37100: Prevent header injection through malformed response reason phrase
-------------------------------------+-------------------------------------
Reporter: Jake Howard | Owner: Varun
| Kasyap Pentamaraju
Type: Bug | Status: closed
Component: HTTP handling | Version: dev
Severity: Normal | Resolution: fixed
Keywords: | Triage Stage: Ready for
| checkin
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Jacob Walls <jacobtylerwalls@…>):

In [changeset:"d7b3fed6a1f8204a120929d44f78b7538e3f0703" d7b3fed]:
{{{#!CommitTicketReference repository=""
revision="d7b3fed6a1f8204a120929d44f78b7538e3f0703"
[6.1.x] Fixed #37100 -- Prevented control characters in HttpResponse
reason_phrase.

Backport of 53645750412efa1e9013004040db328bd515e0f1 from main.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/37100#comment:10>