diff -r ef90c40fe6cf Doc/library/http.client.rst --- a/Doc/library/http.client.rst Wed Sep 18 08:53:26 2013 -0400 +++ b/Doc/library/http.client.rst Fri Oct 25 18:37:59 2013 +0200 @@ -169,6 +169,11 @@ A subclass of :exc:`HTTPException`. Raised if a server responds with a HTTP status code that we don't understand. +.. exception:: TooManyHeaders + + A subclass of :exc:`HTTPException`. Raised if the servers sends too + many headers to the client. Current limit is 100 headers. + The constants defined in this module are: diff -r ef90c40fe6cf Lib/http/client.py --- a/Lib/http/client.py Wed Sep 18 08:53:26 2013 -0400 +++ b/Lib/http/client.py Fri Oct 25 18:37:59 2013 +0200 @@ -206,6 +206,8 @@ # maximal line length when calling readline(). _MAXLINE = 65536 +_MAXHEADERS = 100 + class HTTPMessage(email.message.Message): # XXX The only usage of this method is in @@ -253,6 +255,8 @@ if len(line) > _MAXLINE: raise LineTooLong("header line") headers.append(line) + if len(headers) > _MAXHEADERS: + raise TooManyHeaders() if line in (b'\r\n', b'\n', b''): break hstring = b''.join(headers).decode('iso-8859-1') @@ -1192,5 +1196,10 @@ HTTPException.__init__(self, "got more than %d bytes when reading %s" % (_MAXLINE, line_type)) + +class TooManyHeaders(HTTPException): + def __init__(self): + HTTPException.__init__(self, "got more than %d headers" % _MAXHEADERS) + # for backwards compatibility error = HTTPException diff -r ef90c40fe6cf Lib/test/test_httplib.py --- a/Lib/test/test_httplib.py Wed Sep 18 08:53:26 2013 -0400 +++ b/Lib/test/test_httplib.py Fri Oct 25 18:37:59 2013 +0200 @@ -272,6 +272,13 @@ if resp.read(): self.fail("Did not expect response from HEAD request") + def test_too_many_headers(self): + headers = '\r\n'.join('Header%d: foo' % i for i in range(200)) + '\r\n' + text = ('HTTP/1.1 200 OK\r\n' + headers) + s = FakeSocket(text) + r = client.HTTPResponse(s) + self.assertRaises(client.TooManyHeaders, r.begin) + def test_send_file(self): expected = (b'GET /foo HTTP/1.1\r\nHost: example.com\r\n' b'Accept-Encoding: identity\r\nContent-Length:')