Validate multipart part headers (#1142)

Author: Kludex

src/httpx2/httpx2/_multipart.py

@@ -24,6 +24,8 @@
 _HTML5_FORM_ENCODING_REPLACEMENTS = {'"': "%22", "\\": "\\\\"}
 _HTML5_FORM_ENCODING_REPLACEMENTS.update({chr(c): f"%{c:02X}" for c in range(0x1F + 1) if c != 0x1B})
 _HTML5_FORM_ENCODING_RE = re.compile(r"|".join([re.escape(c) for c in _HTML5_FORM_ENCODING_REPLACEMENTS.keys()]))
+_HEADER_NAME_RE = re.compile(r"[!#$%&'*+\-.^_`|~0-9A-Za-z]+")
+_FORBIDDEN_HEADER_VALUE_CHARS_RE = re.compile(r"[\x00-\x08\x0a-\x1f\x7f]")
 
 
 def _format_form_param(name: str, value: str) -> bytes:
@@ -176,6 +178,10 @@ def render_headers(self) -> bytes:
                 filename = _format_form_param("filename", self.filename)
                 parts.extend([b"; ", filename])
             for header_name, header_value in self.headers.items():
+                if _HEADER_NAME_RE.fullmatch(header_name) is None:
+                    raise ValueError("Invalid multipart header name.")
+                if _FORBIDDEN_HEADER_VALUE_CHARS_RE.search(header_value) is not None:
+                    raise ValueError("Invalid control character in multipart header value.")
                 key, val = f"\r\n{header_name}: ".encode(), header_value.encode()
                 parts.extend([key, val])
             parts.append(b"\r\n\r\n")

tests/httpx2/test_multipart.py

@@ -205,6 +205,29 @@ def test_multipart_headers_include_content_type() -> None:
     )
 
 
+@pytest.mark.parametrize(
+    ("content_type", "file_headers"),
+    [
+        ("text/plain\r", {}),
+        (None, {"X-Test\t": "value"}),
+        (None, {"X-Test": "value\n"}),
+    ],
+)
+def test_multipart_rejects_invalid_file_headers(content_type: str | None, file_headers: dict[str, str]) -> None:
+    files = {"file": ("test.txt", b"<file content>", content_type, file_headers)}
+
+    with pytest.raises(ValueError, match="Invalid .*multipart header"):
+        httpx2.Request("POST", "https://www.example.com/", files=files)
+
+
+@pytest.mark.parametrize("control_character", ["\x00", "\x01", "\x08", "\x1f", "\x7f"])
+def test_multipart_rejects_control_characters_in_file_header_values(control_character: str) -> None:
+    files = {"file": ("test.txt", b"<file content>", None, {"X-Test": f"value{control_character}"})}
+
+    with pytest.raises(ValueError, match="Invalid control character in multipart header value"):
+        httpx2.Request("POST", "https://www.example.com/", files=files)
+
+
 def test_multipart_encode(tmp_path: typing.Any) -> None:
     path = str(tmp_path / "name.txt")
     with open(path, "wb") as f: