Skip to content

Validate Content-Length format in ClientRequest #12385

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jmestwa-coder wants to merge 3 commits into
base: master
Choose a base branch
from
+45 −7
Open

Validate Content-Length format in ClientRequest #12385

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a66944d
Validate Content-Length format in ClientRequest
jmestwa-coder Apr 17, 2026
5233af9
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot] Apr 20, 2026
ee47a1b
Merge branch 'master' into fix-content-length-validation
jmestwa-coder Apr 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 4 additions & 6 deletions aiohttp/client_reqrep.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,7 @@

_CONNECTION_CLOSED_EXCEPTION = ClientConnectionError("Connection closed")
_CONTAINS_CONTROL_CHAR_RE = re.compile(r"[^-!#$%&'*+.^_`|~0-9a-zA-Z]")
_DIGITS_RE = re.compile(r"\d+", re.ASCII)


def _gen_default_accept_encoding() -> str:
Expand Down Expand Up @@ -753,12 +754,9 @@ def _get_content_length(self) -> int | None:
return None

content_length_hdr = self.headers[hdrs.CONTENT_LENGTH]
try:
return int(content_length_hdr)
except ValueError:
raise ValueError(
f"Invalid Content-Length header: {content_length_hdr}"
) from None
if not _DIGITS_RE.fullmatch(content_length_hdr):
raise ValueError(f"Invalid Content-Length header: {content_length_hdr!r}")
return int(content_length_hdr)

@property
def _writer(self) -> asyncio.Task[None] | None:
Expand Down
19 changes: 18 additions & 1 deletion tests/test_client_request.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1911,7 +1911,24 @@ async def test_get_content_length(make_client_request: _RequestMaker) -> None:

# Invalid Content-Length header
req.headers["Content-Length"] = "invalid"
with pytest.raises(ValueError, match="Invalid Content-Length header: invalid"):
with pytest.raises(ValueError, match="Invalid Content-Length header"):
req._get_content_length()


async def test_get_content_length_invalid_formats(
make_client_request: _RequestMaker,
) -> None:
req = make_client_request("get", URL("http://python.org/"))

req.headers["Content-Length"] = "100"
assert req._get_content_length() == 100

req.headers["Content-Length"] = "-100"
with pytest.raises(ValueError, match="Invalid Content-Length header"):
req._get_content_length()

req.headers["Content-Length"] = " 100"
Copy link
Copy Markdown
Member

@Dreamsorcerer Dreamsorcerer Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Strictly speaking, this produces a valid header: Content-Length: 100
We probably don't have a real preference on whether it's rejected or not, so probably better to just use another test example. e.g. ५ <- devengali number 5, which would pass through an int() call.

with pytest.raises(ValueError, match="Invalid Content-Length header"):
req._get_content_length()


Expand Down
23 changes: 23 additions & 0 deletions tests/test_web_functional.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,6 +196,29 @@ async def handler(request: web.Request) -> web.Response:
resp.release()


async def test_content_length_invalid(
aiohttp_client: AiohttpClient,
) -> None:
async def handler(request: web.Request) -> web.Response:
body = await request.read()
return web.Response(body=body)

app = web.Application()
app.router.add_post("/", handler)
client = await aiohttp_client(app)

resp = await client.post("/", data=b"hello world", headers={CONTENT_LENGTH: "11"})
assert resp.status == 200
assert await resp.read() == b"hello world"
resp.release()

with pytest.raises(ValueError, match="Invalid Content-Length header"):
await client.post("/", data=b"hello world", headers={CONTENT_LENGTH: "-100"})

with pytest.raises(ValueError, match="Invalid Content-Length header"):
await client.post("/", data=b"hello world", headers={CONTENT_LENGTH: " 100"})


@pytest.mark.skipif(sys.version_info < (3, 11), reason="Needs Task.cancelling()")
async def test_cancel_shutdown(aiohttp_client: AiohttpClient) -> None:
async def handler(request: web.Request) -> web.Response:
Expand Down
Loading