2.x backport of [1538] and [1549] (Fix for leading CRLF in request).

1 files changed, 10 insertions, 0 deletions

diff --git a/cherrypy/_cpwsgiserver.py b/cherrypy/_cpwsgiserver.py
index 4a32e53a..52b7f2ba 100644
--- a/cherrypy/_cpwsgiserver.py
+++ b/cherrypy/_cpwsgiserver.py
@@ -68,6 +68,16 @@ class HTTPRequest(object):
             self.ready = False
             return
         
+        if request_line == "\r\n":
+            # RFC 2616 sec 4.1: "...if the server is reading the protocol
+            # stream at the beginning of a message and receives a CRLF
+            # first, it should ignore the CRLF."
+            # But only ignore one leading line! else we enable a DoS.
+            request_line = self.rfile.readline()
+            if not request_line:
+                self.ready = False
+                return
+        
         method, path, req_protocol = request_line.strip().split(" ", 2)
         self.environ["REQUEST_METHOD"] = method