Repository: Kinto/kinto

Issue:
Crash when header contains control characters
```
Python 2.7.12 (default, Jul  1 2016, 15:12:24) 
[GCC 5.4.0 20160609] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import requests
>>> requests.get("http://localhost:8888/crlftest%0DSet-Cookie:test%3Dtest%3Bdomain%3D.yelp.com")
<Response [500]>
>>> 
```

```
  File "/data/kinto-dist/lib/python2.7/site-packages/pyramid/tweens.py", line 22, in excview_tween
    response = handler(request)
  File "/data/kinto-dist/lib/python2.7/site-packages/pyramid_tm/__init__.py", line 109, in tm_tween
    reraise(*exc_info)
  File "/data/kinto-dist/lib/python2.7/site-packages/pyramid_tm/__init__.py", line 88, in tm_tween
    response = handler(request)
  File "/data/kinto-dist/lib/python2.7/site-packages/pyramid/router.py", line 158, in handle_request
    view_name
  File "/data/kinto-dist/lib/python2.7/site-packages/pyramid/view.py", line 547, in _call_view
    response = view_callable(context, request)
  File "/data/kinto-dist/lib/python2.7/site-packages/pyramid/viewderivers.py", line 413, in viewresult_to_response
    result = view(context, request)
  File "/data/kinto-dist/lib/python2.7/site-packages/pyramid/viewderivers.py", line 147, in _requestonly_view
    response = view(request)
  File "/data/kinto-dist/lib/python2.7/site-packages/kinto/core/initialization.py", line 79, in _redirect_to_version_view
    raise HTTPTemporaryRedirect(redirect)
  File "/data/kinto-dist/lib/python2.7/site-packages/pyramid/httpexceptions.py", line 493, in __init__
    body_template=body_template, location=location, **kw)
  File "/data/kinto-dist/lib/python2.7/site-packages/pyramid/httpexceptions.py", line 221, in __init__
    Response.__init__(self, status=status, **kw)
  File "/data/kinto-dist/lib/python2.7/site-packages/webob/response.py", line 153, in __init__
    setattr(self, name, value)
  File "/data/kinto-dist/lib/python2.7/site-packages/webob/descriptors.py", line 142, in fset
    raise ValueError('Header value may not contain control characters')
    ValueError: Header value may not contain control characters","uid":null,"errno":null,"querystring":"{}","agent":"Amazon CloudFront","method":"GET","path":"/crlftest%0DSet-Cookie:test%3Dtest%3Bdomain%3D.yelp.com","authn_type":null},"Logger":"kinto","Type":["Header value may not contain control characters"],"Severity":2}
```

Crash when header contains control characters
```
Python 2.7.12 (default, Jul  1 2016, 15:12:24) 
[GCC 5.4.0 20160609] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import requests
>>> requests.get("http://localhost:8888/crlftest%0DSet-Cookie:test%3Dtest%3Bdomain%3D.yelp.com")
<Response [500]>
>>> 
```

```
  File "/data/kinto-dist/lib/python2.7/site-packages/pyramid/tweens.py", line 22, in excview_tween
    response = handler(request)
  File "/data/kinto-dist/lib/python2.7/site-packages/pyramid_tm/__init__.py", line 109, in tm_tween
    reraise(*exc_info)
  File "/data/kinto-dist/lib/python2.7/site-packages/pyramid_tm/__init__.py", line 88, in tm_tween
    response = handler(request)
  File "/data/kinto-dist/lib/python2.7/site-packages/pyramid/router.py", line 158, in handle_request
    view_name
  File "/data/kinto-dist/lib/python2.7/site-packages/pyramid/view.py", line 547, in _call_view
    response = view_callable(context, request)
  File "/data/kinto-dist/lib/python2.7/site-packages/pyramid/viewderivers.py", line 413, in viewresult_to_response
    result = view(context, request)
  File "/data/kinto-dist/lib/python2.7/site-packages/pyramid/viewderivers.py", line 147, in _requestonly_view
    response = view(request)
  File "/data/kinto-dist/lib/python2.7/site-packages/kinto/core/initialization.py", line 79, in _redirect_to_version_view
    raise HTTPTemporaryRedirect(redirect)
  File "/data/kinto-dist/lib/python2.7/site-packages/pyramid/httpexceptions.py", line 493, in __init__
    body_template=body_template, location=location, **kw)
  File "/data/kinto-dist/lib/python2.7/site-packages/pyramid/httpexceptions.py", line 221, in __init__
    Response.__init__(self, status=status, **kw)
  File "/data/kinto-dist/lib/python2.7/site-packages/webob/response.py", line 153, in __init__
    setattr(self, name, value)
  File "/data/kinto-dist/lib/python2.7/site-packages/webob/descriptors.py", line 142, in fset
    raise ValueError('Header value may not contain control characters')
    ValueError: Header value may not contain control characters","uid":null,"errno":null,"querystring":"{}","agent":"Amazon CloudFront","method":"GET","path":"/crlftest%0DSet-Cookie:test%3Dtest%3Bdomain%3D.yelp.com","authn_type":null},"Logger":"kinto","Type":["Header value may not contain control characters"],"Severity":2}
```



Discussion:

Resolving patch:
diff --git a/kinto/core/initialization.py b/kinto/core/initialization.py
--- a/kinto/core/initialization.py
+++ b/kinto/core/initialization.py
@@ -82,7 +82,7 @@ def _redirect_to_version_view(request):
     config.route_prefix = None
 
     config.add_route(name='redirect_to_version',
-                     pattern='/{path:(?!v[0-9]+).*}')
+                     pattern=r'/{path:(?!v[0-9]+)[^\r]*}')
 
     config.add_view(view=_redirect_to_version_view,
                     route_name='redirect_to_version',


Test patch:
diff --git a/tests/core/test_views_errors.py b/tests/core/test_views_errors.py
--- a/tests/core/test_views_errors.py
+++ b/tests/core/test_views_errors.py
@@ -168,6 +168,10 @@ def test_querystring_is_preserved_during_redirection(self):
         response = self.app.get('/home/articles?_since=42')
         self.assertEqual(response.location, 'http://localhost/v0/home/articles?_since=42')
 
+    def test_redirection_does_not_allow_crlf(self):
+        self.app.get('/crlftest%0DSet-Cookie:test%3Dtest%3Bdomain%3D.yelp.com',
+                     status=404)
+
 
 class TrailingSlashRedirectViewTest(FormattedErrorMixin, BaseWebTest,
                                     unittest.TestCase):