Problem: The http.server module lets some control characters from the request thru which when emitted as is in a log message to a terminal can be used to control it or otherwise generate misleading output. python -m http.server is typically run within such a terminal.
Fix: The http.server default log_message() method needs to prevent printing of control characters.
Reported by David Leadbeater, G-Research on 2022-12-04
Linked PRs
Reactions are currently unavailable
Problem: The http.server module lets some control characters from the request thru which when emitted as is in a log message to a terminal can be used to control it or otherwise generate misleading output. python -m http.server is typically run within such a terminal.
Fix: The http.server default log_message() method needs to prevent printing of control characters.
Reported by David Leadbeater, G-Research on 2022-12-04
Linked PRs