Skip to content

Commit

Permalink
Remove arbitrary cap on length of outgoing headers.
Browse files Browse the repository at this point in the history
The cap is too low for some uses, and it's unclear if it's worth
keeping.

Closes tornadoweb#1473.
Closes tornadoweb#1025.
  • Loading branch information
bdarnell committed Jul 30, 2015
1 parent 1d02ed6 commit 95c4dce
Showing 1 changed file with 2 additions and 4 deletions.
6 changes: 2 additions & 4 deletions tornado/web.py
Original file line number Diff line number Diff line change
Expand Up @@ -362,10 +362,8 @@ def _convert_header_value(self, value):
else:
raise TypeError("Unsupported header value %r" % value)
# If \n is allowed into the header, it is possible to inject
# additional headers or split the request. Also cap length to
# prevent obviously erroneous values.
if (len(value) > 4000 or
RequestHandler._INVALID_HEADER_CHAR_RE.search(value)):
# additional headers or split the request.
if RequestHandler._INVALID_HEADER_CHAR_RE.search(value):
raise ValueError("Unsafe header value %r", value)
return value

Expand Down

0 comments on commit 95c4dce

Please sign in to comment.