whitespace handling in header field values

Strip whitespace also *after* header field value.

Intoduce a default-off option to simply refuse obsolete
header folding. While we are at it, explicitly handle recently
introduced http error classes with intended status code.

docs/source/settings.rst

@@ -1396,6 +1396,23 @@ The variables are passed to the PasteDeploy entrypoint. Example::
 
 .. versionadded:: 19.7
 
+.. _refuse-obsolete-folding:
+
+``refuse_obsolete_folding``
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+**Command line:** ``--refuse-obsolete-folding``
+
+**Default:** ``False``
+
+Refuse requests employing obsolete HTTP line folding mechanism
+
+The mechanism was deprecated by rfc7230 Section 3.2.4.
+
+Safe to enable if you only ever want to serve standards compliant HTTP clients.
+
+.. versionadded:: 22.1.0
+
 .. _strip-header-spaces:
 
 ``strip_header_spaces``

gunicorn/config.py

@@ -2241,6 +2241,24 @@ class PasteGlobalConf(Setting):
         """
 
 
+class RefuseObsoleteFolding(Setting):
+    name = "refuse_obsolete_folding"
+    section = "Server Mechanics"
+    cli = ["--refuse-obsolete-folding"]
+    validator = validate_bool
+    action = "store_true"
+    default = False
+    desc = """\
+        Refuse requests employing obsolete HTTP line folding mechanism
+
+        The mechanism was deprecated by rfc7230 Section 3.2.4.
+
+        Safe to enable if you only ever want to serve standards compliant HTTP clients.
+
+        .. versionadded:: 22.1.0
+        """
+
+
 class StripHeaderSpaces(Setting):
     name = "strip_header_spaces"
     section = "Server Mechanics"

gunicorn/http/errors.py

@@ -65,6 +65,14 @@ def __str__(self):
         return "Invalid HTTP Header: %r" % self.hdr
 
 
+class ObsoleteFolding(ParseException):
+    def __init__(self, hdr):
+        self.hdr = hdr
+
+    def __str__(self):
+        return "Obsolete line folding is unacceptable: %r" % (self.hdr, )
+
+
 class InvalidHeaderName(ParseException):
     def __init__(self, hdr):
         self.hdr = hdr

gunicorn/http/message.py

@@ -12,7 +12,7 @@
     InvalidHeader, InvalidHeaderName, NoMoreData,
     InvalidRequestLine, InvalidRequestMethod, InvalidHTTPVersion,
     LimitRequestLine, LimitRequestHeaders,
-    UnsupportedTransferCoding,
+    UnsupportedTransferCoding, ObsoleteFolding,
 )
 from gunicorn.http.errors import InvalidProxyLine, ForbiddenProxyRequest
 from gunicorn.http.errors import InvalidSchemeHeaders
@@ -109,9 +109,13 @@ def parse_headers(self, data, from_trailer=False):
             # b"\xDF".decode("latin-1").upper().encode("ascii") == b"SS"
             name = name.upper()
 
-            value = [value.lstrip(" \t")]
+            value = [value.strip(" \t")]
 
-            # Consume value continuation lines
+            # Refuse obsolete folding
+            if self.cfg.refuse_obsolete_folding:
+                if lines and lines[0].startswith((" ", "\t")):
+                    raise ObsoleteFolding(name)
+            # OR: Consume value continuation lines
             while lines and lines[0].startswith((" ", "\t")):
                 curr = lines.pop(0)
                 header_length += len(curr) + len("\r\n")

gunicorn/workers/base.py

@@ -20,6 +20,8 @@
     InvalidProxyLine, InvalidRequestLine,
     InvalidRequestMethod, InvalidSchemeHeaders,
     LimitRequestHeaders, LimitRequestLine,
+    UnsupportedTransferCoding,
+    ConfigurationProblem, ObsoleteFolding,
 )
 from gunicorn.http.wsgi import Response, default_environ
 from gunicorn.reloader import reloader_engines
@@ -210,7 +212,8 @@ def handle_error(self, req, client, addr, exc):
             InvalidHTTPVersion, InvalidHeader, InvalidHeaderName,
             LimitRequestLine, LimitRequestHeaders,
             InvalidProxyLine, ForbiddenProxyRequest,
-            InvalidSchemeHeaders,
+            InvalidSchemeHeaders, UnsupportedTransferCoding,
+            ConfigurationProblem, ObsoleteFolding,
             SSLError,
         )):
 
@@ -223,6 +226,14 @@ def handle_error(self, req, client, addr, exc):
                 mesg = "Invalid Method '%s'" % str(exc)
             elif isinstance(exc, InvalidHTTPVersion):
                 mesg = "Invalid HTTP Version '%s'" % str(exc)
+            elif isinstance(exc, UnsupportedTransferCoding):
+                mesg = "%s" % str(exc)
+                status_int = 501
+            elif isinstance(exc, ConfigurationProblem):
+                mesg = "%s" % str(exc)
+                status_int = 500
+            elif isinstance(exc, ObsoleteFolding):
+                mesg = "%s" % str(exc)
             elif isinstance(exc, (InvalidHeaderName, InvalidHeader,)):
                 mesg = "%s" % str(exc)
                 if not req and hasattr(exc, "req"):

tests/requests/invalid/obs_fold_01.http

@@ -0,0 +1,5 @@
+GET / HTTP/1.1\r\n
+Long: one\r\n
+ two\r\n
+Host: localhost\r\n
+\r\n

tests/requests/invalid/obs_fold_01.py

@@ -0,0 +1,7 @@
+from gunicorn.http.errors import ObsoleteFolding
+from gunicorn.config import Config
+
+cfg = Config()
+cfg.set('refuse_obsolete_folding', True)
+
+request = ObsoleteFolding

tests/requests/valid/padding_01.http

@@ -0,0 +1,4 @@
+GET / HTTP/1.1\r\n
+Host: localhost\r\n
+Name: \t value \t \r\n
+\r\n

tests/requests/valid/padding_01.py

@@ -0,0 +1,11 @@
+
+request = {
+    "method": "GET",
+    "uri": uri("/"),
+    "version": (1, 1),
+    "headers": [
+        ("HOST", "localhost"),
+        ("NAME", "value")
+    ],
+    "body": b"",
+}