This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: distutils sends non-RFC compliant HTTP request
Type: Stage: resolved
Components: Distutils Versions: Python 3.2, Python 3.3, Python 2.7
process
Status: closed Resolution: duplicate
Dependencies: Superseder: distutils upload/register should use CRLF in HTTP requests
View: 10510
Assigned To: eric.araujo Nosy List: eric.araujo, mitchellh, orsenthil, tarek
Priority: normal Keywords: patch

Created on 2011-10-08 14:56 by mitchellh, last changed 2022-04-11 14:57 by admin. This issue is now closed.

Files
File name Uploaded Description Edit
issue13132.patch mitchellh, 2011-10-08 15:01 Initial patch for the issue. review
Messages (6)
msg145171 - (view) Author: Mitchell Hashimoto (mitchellh) Date: 2011-10-08 14:56
In ``Lib/distutils/command/register.py`` as well as ``upload.py``, the following code exists to build the HTTP request body to send to the cheese shop server:

    body.write('\nContent-Disposition: form-data; name="%s"'%key)
    body.write("\n\n")

RFC2616 page 31 (http://tools.ietf.org/html/rfc2616#page-31) states that headers must be separated by CRLF. Specifically, the above "\n\n" for the header separator is causing issues with some minimal RFC-compliant web servers.
msg145172 - (view) Author: Mitchell Hashimoto (mitchellh) Date: 2011-10-08 15:01
Patch attached.
msg145202 - (view) Author: Éric Araujo (eric.araujo) * (Python committer) Date: 2011-10-09 03:01
Hi Mitchell, thanks for your interest in Python.  Using CLRF was requested before (#10510) and rejected on the ground that the RFC (at least for HTTP 1.0) allows LF.  CRLF is preferred but not required.  Hence, we deem it is not a bug.

The register, upload and upload_docs commands in distutils2 do use CRLF.

BTW, I think your patch was incomplete: You stripped one newline, replaced one LF with CRLF, and left many other LFs.
msg145719 - (view) Author: Éric Araujo (eric.araujo) * (Python committer) Date: 2011-10-17 15:56
http://tools.ietf.org/html/rfc2616#section-3.7.1

> When in canonical form, media subtypes of the "text" type use CRLF as
> the text line break. HTTP relaxes this requirement and allows the
> transport of text media with plain CR or LF alone representing a line
> break when it is done consistently for an entire entity-body. HTTP
> applications MUST accept CRLF, bare CR, and bare LF as being
> representative of a line break in text media received via HTTP
msg146146 - (view) Author: Éric Araujo (eric.araujo) * (Python committer) Date: 2011-10-21 22:36
Will close if no further input.
msg146214 - (view) Author: Éric Araujo (eric.araujo) * (Python committer) Date: 2011-10-23 02:08
The requests we send are multipart/form-data, so the RFC exception for text/* would not apply.  I’m closing this bug as a duplicate and will ask on the other one if we should reopen it.
History
Date User Action Args
2022-04-11 14:57:22adminsetgithub: 57341
2011-10-23 02:08:03eric.araujosetstatus: pending -> closed
resolution: duplicate
messages: + msg146214

superseder: distutils upload/register should use CRLF in HTTP requests
stage: resolved
2011-10-21 22:36:09eric.araujosetstatus: open -> pending

messages: + msg146146
2011-10-17 15:56:11eric.araujosetmessages: + msg145719
2011-10-09 03:01:53eric.araujosetnosy: + orsenthil
versions: - Python 2.6, Python 3.1, Python 3.4
messages: + msg145202

assignee: tarek -> eric.araujo
2011-10-08 15:01:44mitchellhsetfiles: + issue13132.patch
keywords: + patch
messages: + msg145172
2011-10-08 14:56:28mitchellhcreate