]> git.ipfire.org Git - thirdparty/tornado.git/commit
httputil: Fix quadratic performance of repeated header lines 3553/head
authorBen Darnell <ben@bendarnell.com>
Tue, 9 Dec 2025 18:27:27 +0000 (13:27 -0500)
committerBen Darnell <ben@bendarnell.com>
Tue, 9 Dec 2025 18:27:27 +0000 (13:27 -0500)
commit68e81b4a3385161877408a7a49c7ed12b45a614d
treee73965592e811c301d3186fbfcb1d4da7d3c4c60
parent00dd0802eb60e2c01a40b1b5308596364709abc6
httputil: Fix quadratic performance of repeated header lines

Previouisly, when many header lines with the same name were found
in an HTTP request or response, repeated string concatenation would
result in quadratic performance. This change does the concatenation
lazily (with a cache) so that repeated headers can be processed
efficiently.

Security: The previous behavior allowed a denial of service attack
via a maliciously crafted HTTP message, but only if the
max_header_size was increased from its default of 64kB.
tornado/httputil.py
tornado/test/httputil_test.py