Mercurial > p > roundup > code
view roundup/scripts/__init__.py @ 8322:a2c376d0f110
fix: fix possible HTTP Response Splitting in roundup-server
CodeQL flagged a possible HTTP Response Splitting in the Location
header's URL.
The AI suggested cleaning the Host value, except the URL also includes
the query parameters in the URL so they could potentially trigger the
issue. Th host header probably doesn;t have a newline or cr in it
otherwise it wouldn't have been recognized by the server as a valid
host.
In any case strip all \n or \r from the url before use.
Also update CHANGES.txt with fixing the gpg install.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Tue, 03 Jun 2025 22:23:10 -0400 |
| parents | 6e3e4f24c753 |
| children |
line wrap: on
line source
# # Copyright (c) 2001 Bizar Software Pty Ltd (http://www.bizarsoftware.com.au/) # This module is free software, and you may redistribute it and/or modify # under the same terms as Python, so long as this copyright message and # disclaimer are retained in their original form. # # IN NO EVENT SHALL BIZAR SOFTWARE PTY LTD BE LIABLE TO ANY PARTY FOR # DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING # OUT OF THE USE OF THIS CODE, EVEN IF THE AUTHOR HAS BEEN ADVISED OF THE # POSSIBILITY OF SUCH DAMAGE. # # BIZAR SOFTWARE PTY LTD SPECIFICALLY DISCLAIMS ANY WARRANTIES, INCLUDING, # BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS # FOR A PARTICULAR PURPOSE. THE CODE PROVIDED HEREUNDER IS ON AN "AS IS" # BASIS, AND THERE IS NO OBLIGATION WHATSOEVER TO PROVIDE MAINTENANCE, # SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS. '''Subpackage containing the modules that implement the command line tools. Note that these are imported by script stubs generated by "setup.py". ''' __docformat__ = 'restructuredtext' # vim: set filetype=python ts=4 sw=4 et si