python - flask - "ValueError: Detected newline in header value. This is a potential security prob lem"

Question

我是 Python 的新手，正在玩弄 Flask，并且已经构建了一个 udacity 类(class)中教授内容的副本，您可以在其中将 ASCII 艺术上传到一个非常基本的网页。

玩了一圈之后，我注意到我在上传 ASCII 艺术作品时遇到错误，上面写着:

ValueError:在 header 值中检测到换行符。这是一个潜在的安全问题

我不知道问题出在哪里，我在下面附上了代码和请求 header :

标题:http://imgur.com/w3oaROB

from flask import Flask, render_template, redirect, url_for, request, flash, request
from datetime import datetime
import sqlite3
import os
from os.path import expanduser
app = Flask(__name__)


def fetch(name):
    conn = sqlite3.connect('art.db')
    cursor = conn.cursor()
    cursor.execute("SELECT * from {} ORDER BY created DESC".format(name))
    return cursor

def insert(title, art):
    time = datetime.now()
    conn = sqlite3.connect('art.db')
    cursor = conn.cursor()
    cursor.execute("""INSERT INTO art VALUES (?,?,?)""",(title, art,time))
    conn.commit()

def delete(title):
    conn = sqlite3.connect('art.db')
    cursor = conn.cursor()
    cursor.execute("""DELETE FROM art WHERE title = '{}'""".format(title))
    conn.commit()


def render_front(title='', art='', error='', posts=''):
    return render_template('front.html',title=title, art=art, error=error, posts=posts)

def get_posts(table):
    x = fetch(table)
    posts = [i for i in x]
    return posts

@app.route('/post/<title>/<art>', methods=['GET','POST'])
def new_post(title=None,art=None):
    if request.method == 'POST':
        if request.form.getlist('hidden'):
            title = request.form['hidden']
            delete(title)
            posts = get_posts('art')
            return render_front(posts=posts)
        elif request.form.getlist('titles'):
            title = request.form['titles']
            art = request.form['arts']
            if title and art:
                insert(str(title), str(art))
                return redirect('/post/{}/{}'.format(title,art))
            else:
                error = 'ERROR SOMEWHERE'
                return render_front(error=error, art=art, title=title)
    else:
        posts = [[title,art]]
        return render_front(posts=posts)

@app.route('/', methods=['GET','POST'])
def home():
    if request.method == 'POST':
        if request.form.getlist('hidden'):
            title = request.form['hidden']
            delete(title)
            posts = get_posts('art')
            return render_front(posts=posts)
        elif request.form.getlist('titles'):
            title = request.form['titles']
            art = request.form['arts']
            if title and art:
                insert(str(title), str(art))
                return redirect('/post/{}/{}'.format(title,art))
            else:
                error = 'ERROR SOMEWHERE'
                return render_front(error=error, art=art, title=title)
    else:
        posts = get_posts('art')
        return render_front(posts=posts)


if __name__ == '__main__':
    app.debug = True
    app.run()

Answer 1

如果 Header 中的值包含符号换行符\n 或\r，则会引发 ValueError 并显示文本错误:“在 header 值中检测到换行符。这是一个潜在的安全问题”。如果您使用重定向并且 header 具有目标 url 的键 Location 并且目标 url 包含符号换行符\n 或\r

，则可能会发生这种情况