[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Python-Dev] Need help to fix HTTP Header Injection vulnerability

> 1. Is there a library of URL / Header injection tests e.g. for fuzzing
> that we could generate additional test cases with or from? seems to contain
payload related stuff but not sure how useful it is for URL parsing.

> 2. Are requests.get() and also vulnerable?

urllib3 seems to be vulnerable as noted in . requests uses urllib3 under
the hood. The last time I checked requests passed encoded URL to urllib3
where this doesn't seem to be exploitable but I could be wrong.

Karthikeyan S
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>