René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Uncaught exception in `http.server` request handling (\u003c=3.10)","articleBody":"Sending a null byte in an HTTP request path or URL triggers an uncaught `ValueError` in CPython 3.10 and below.\r\n\r\n# Reproduction Instructions\r\nOpen two terminals and do the following (requires python \u003c=3.10; current 3.10 branch included):\r\n\r\nTerminal 1:\r\n```bash\r\n$ ./python -m http.server --bind 127.0.0.1\r\nServing HTTP on 127.0.0.1 port 8000 (http://127.0.0.1:8000/) ...\r\n```\r\n\r\nTerminal 2:\r\n```bash\r\n$ printf 'GET \\x00 HTTP/1.1\\r\\n\\r\\n' | nc localhost 8000\r\n```\r\n\r\nTerminal 1:\r\n```\r\n----------------------------------------\r\nException occurred during processing of request from ('127.0.0.1', 56900)\r\nTraceback (most recent call last):\r\n  File \"/home/bkallus/clones/cpython/Lib/socketserver.py\", line 683, in process_request_thread\r\n    self.finish_request(request, client_address)\r\n  File \"/home/bkallus/clones/cpython/Lib/http/server.py\", line 1304, in finish_request\r\n    self.RequestHandlerClass(request, client_address, self,\r\n  File \"/home/bkallus/clones/cpython/Lib/http/server.py\", line 668, in __init__\r\n    super().__init__(*args, **kwargs)\r\n  File \"/home/bkallus/clones/cpython/Lib/socketserver.py\", line 747, in __init__\r\n    self.handle()\r\n  File \"/home/bkallus/clones/cpython/Lib/http/server.py\", line 433, in handle\r\n    self.handle_one_request()\r\n  File \"/home/bkallus/clones/cpython/Lib/http/server.py\", line 421, in handle_one_request\r\n    method()\r\n  File \"/home/bkallus/clones/cpython/Lib/http/server.py\", line 672, in do_GET\r\n    f = self.send_head()\r\n  File \"/home/bkallus/clones/cpython/Lib/http/server.py\", line 727, in send_head\r\n    f = open(path, 'rb')\r\nValueError: embedded null byte\r\n----------------------------------------\r\n```\r\n\r\nThis bug is fixed in python 3.11+, but I haven't yet figured out why. As far as I can tell, the relevant portions of `Lib/http/server.py` and `Lib/socketserver.py` remain unchanged. I think the issue boils down to catching only OSErrors, but not `ValueError`s, even though `open` can raise `ValueError`s. I would guess that this happened because the docs do not clearly state that `open(path, 'rb')` can raise a `ValueError`.\r\n\r\n# Environment:\r\nArch Linux, x86_64\r\nPython 3.10.10+","author":{"url":"https://github.com/kenballus","@type":"Person","name":"kenballus"},"datePublished":"2023-04-03T21:09:35.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":3},"url":"https://github.com/103223/cpython/issues/103223"}