Log message for revision 127998: - LP #930812: Scrub headers a bit more.
Changed: U Zope/trunk/src/ZPublisher/HTTPResponse.py U Zope/trunk/src/ZPublisher/tests/testHTTPResponse.py -=- Modified: Zope/trunk/src/ZPublisher/HTTPResponse.py =================================================================== --- Zope/trunk/src/ZPublisher/HTTPResponse.py 2012-10-14 12:43:43 UTC (rev 127997) +++ Zope/trunk/src/ZPublisher/HTTPResponse.py 2012-10-14 12:46:17 UTC (rev 127998) @@ -128,7 +128,7 @@ if otherTypes: uncompressableMimeMajorTypes += tuple(otherTypes.split(',')) -_CRLF = re.compile(r'\r[\n]?') +_CRLF = re.compile(r'[\r\n]') def _scrubHeader(name, value): return ''.join(_CRLF.split(str(name))), ''.join(_CRLF.split(str(value))) Modified: Zope/trunk/src/ZPublisher/tests/testHTTPResponse.py =================================================================== --- Zope/trunk/src/ZPublisher/tests/testHTTPResponse.py 2012-10-14 12:43:43 UTC (rev 127997) +++ Zope/trunk/src/ZPublisher/tests/testHTTPResponse.py 2012-10-14 12:46:17 UTC (rev 127998) @@ -409,6 +409,15 @@ self.assertEqual(response.headers['location'], 'http://www.ietf.org/rfc/rfc2616.txt') + def test_setHeader_drops_LF(self): + # Some browsers accept \n in place of \n\r to separate headers, + # so we scrub it too. + response = self._makeOne() + response.setHeader('Location', + 'http://www.ietf.org/rfc/\nrfc2616.txt') + self.assertEqual(response.headers['location'], + 'http://www.ietf.org/rfc/rfc2616.txt') + def test_appendHeader_no_existing(self): response = self._makeOne() response.appendHeader('foo', 'foo') _______________________________________________ Zope-Checkins maillist - Zope-Checkins@zope.org https://mail.zope.org/mailman/listinfo/zope-checkins