Repository: Kinto/kinto

Issue:
Crash on redirect when path contains control characters
version 4.3.4 maybe fixed since (?)

`GET /9l2j7%0A21m2n`

```
  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/pyramid\/view.py\", line 547, in _call_view
    response = view_callable(context, request)
  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/pyramid\/viewderivers.py\", line 413, in viewresult_to_response
    result = view(context, request)
  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/pyramid\/viewderivers.py\", line 147, in _requestonly_view
    response = view(request)
  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/kinto\/core\/initialization.py\", line 79, in _redirect_to_version_view
    raise HTTPTemporaryRedirect(redirect)
  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/pyramid\/httpexceptions.py\", line 493, in __init__
    body_template=body_template, location=location, **kw)
  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/pyramid\/httpexceptions.py\", line 221, in __init__
    Response.__init__(self, status=status, **kw)
  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/webob\/response.py\", line 153, in __init__
    setattr(self, name, value)
  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/webob\/descriptors.py\", line 142, in fset
    raise ValueError('Header value may not contain control characters')
```
Crash on redirect when path contains control characters
version 4.3.4 maybe fixed since (?)

`GET /9l2j7%0A21m2n`

```
  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/pyramid\/view.py\", line 547, in _call_view
    response = view_callable(context, request)
  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/pyramid\/viewderivers.py\", line 413, in viewresult_to_response
    result = view(context, request)
  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/pyramid\/viewderivers.py\", line 147, in _requestonly_view
    response = view(request)
  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/kinto\/core\/initialization.py\", line 79, in _redirect_to_version_view
    raise HTTPTemporaryRedirect(redirect)
  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/pyramid\/httpexceptions.py\", line 493, in __init__
    body_template=body_template, location=location, **kw)
  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/pyramid\/httpexceptions.py\", line 221, in __init__
    Response.__init__(self, status=status, **kw)
  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/webob\/response.py\", line 153, in __init__
    setattr(self, name, value)
  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/webob\/descriptors.py\", line 142, in fset
    raise ValueError('Header value may not contain control characters')
```


Discussion:

Resolving patch:
diff --git a/kinto/core/initialization.py b/kinto/core/initialization.py
--- a/kinto/core/initialization.py
+++ b/kinto/core/initialization.py
@@ -87,7 +87,7 @@ def _redirect_to_version_view(request):
     config.route_prefix = None
 
     config.add_route(name='redirect_to_version',
-                     pattern=r'/{path:(?!v[0-9]+)[^\r]*}')
+                     pattern=r'/{path:(?!v[0-9]+)[^\r\n]*}')
 
     config.add_view(view=_redirect_to_version_view,
                     route_name='redirect_to_version',


Test patch:
diff --git a/tests/core/test_views_errors.py b/tests/core/test_views_errors.py
--- a/tests/core/test_views_errors.py
+++ b/tests/core/test_views_errors.py
@@ -180,6 +180,9 @@ def test_redirection_does_not_allow_crlf(self):
         self.app.get('/crlftest%0DSet-Cookie:test%3Dtest%3Bdomain%3D.yelp.com',
                      status=404)
 
+    def test_redirection_does_not_allow_control_characters(self):
+        self.app.get('/9l2j7%0A21m2n', status=404)
+
 
 class TrailingSlashRedirectViewTest(FormattedErrorMixin, BaseWebTest,
                                     unittest.TestCase):