From: Dave Shawley <daveshawley@gmail.com>
Date: Fri, 27 Dec 2024 22:12:03 +0000 (-0500)
Subject: Exclude DEL character from header values
X-Git-Tag: v6.5.0b1~19^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=39fcd3b110e0f33b407694af489abbe522eac1f0;p=thirdparty%2Ftornado.git

Exclude DEL character from header values

https://github.com/tornadoweb/tornado/pull/3451#discussion_r1894148653
---

diff --git a/tornado/test/web_test.py b/tornado/test/web_test.py
index 9c6d750f..d99a66a4 100644
--- a/tornado/test/web_test.py
+++ b/tornado/test/web_test.py
@@ -712,6 +712,7 @@ class SetHeaderHandler(RequestHandler):
         # should match the invalid characters from
         # https://www.rfc-editor.org/rfc/rfc9110#name-field-values
         illegal_chars = [chr(o) for o in range(0, 0x20)]
+        illegal_chars.append(chr(0x7f))
         illegal_chars.remove('\t')
         for char in illegal_chars:
             try:
diff --git a/tornado/web.py b/tornado/web.py
index acaae7de..b6119590 100644
--- a/tornado/web.py
+++ b/tornado/web.py
@@ -399,7 +399,7 @@ class RequestHandler:
         if name in self._headers:
             del self._headers[name]
 
-    _INVALID_HEADER_CHAR_RE = re.compile(r"[\x00-\x08\x0a-\x1f]")
+    _INVALID_HEADER_CHAR_RE = re.compile(r"[\x00-\x08\x0a-\x1f\x7f]")
 
     def _convert_header_value(self, value: _HeaderTypes) -> str:
         # Convert the input value to a str. This type check is a bit