Merge pull request #484 from thearun85/fix/reject-duplicate-host-header

Reject duplicate Host headers per RFC 9112

Author: kgaughan

CONTRIBUTORS.txt

@@ -150,3 +150,5 @@ Contributors
 - Jonathan Vanasco, 2022-11-15
 
 - Simon King, 2024-11-12
+
+- Arun Raghunath, 2026-03-13

src/waitress/parser.py

@@ -33,6 +33,9 @@
     find_double_newline,
 )
 
+# A list of HEADERS that must not be duplicated per RFC 9112
+HEADERS_NO_DUPLICATES = frozenset({"HOST", "CONTENT_LENGTH"})
+
 
 def unquote_bytes_to_wsgi(bytestring):
     return unquote_to_bytes(bytestring).decode("latin-1")
@@ -237,6 +240,11 @@ def parse_header(self, header_plus):
             # RFC7230, don't strip the rest
             value = value.strip(b" \t")
             key1 = key.upper().replace(b"-", b"_").decode("latin-1")
+
+            # Reject duplicate 'Host' headers as per RFC 9112 section 3.2
+            if key1 in HEADERS_NO_DUPLICATES and key1 in headers:
+                raise ParsingError(f"Duplicate header: {key.decode('latin-1')}")
+
             # If a header already exists, we append subsequent values
             # separated by a comma. Applications already need to handle
             # the comma separated values, as HTTP front ends might do

tests/test_parser.py

@@ -63,6 +63,24 @@ def test_received_bad_host_header(self):
         self.assertTrue(self.parser.completed)
         self.assertIsInstance(self.parser.error, BadRequest)
 
+    def test_received_duplicate_host_header(self):
+        # RFC 9112: MUST reject HTTP/1.1 requests with more than one Host header
+        data = b"GET / HTTP/1.1\r\nHOST: test1.com\r\nHost: test2.com\r\n\r\n"
+        result = self.parser.received(data)
+        self.assertEqual(result, len(data))
+        self.assertTrue(self.parser.completed)
+        self.assertIsInstance(self.parser.error, BadRequest)
+        self.assertTrue(self.parser.error.body.startswith("Duplicate header:"))
+
+    def test_received_duplicate_content_length_header(self):
+        # RFC 7230: MUST reject requests with duplicate Content-Length headers
+        data = b"GET / HTTP/1.1\r\nHost: example.com\r\nContent-Length: 10\r\nContent-Length: 20\r\n\r\n"
+        result = self.parser.received(data)
+        self.assertEqual(result, len(data))
+        self.assertTrue(self.parser.completed)
+        self.assertIsInstance(self.parser.error, BadRequest)
+        self.assertTrue(self.parser.error.body.startswith("Duplicate header:"))
+
     def test_received_bad_transfer_encoding(self):
         data = (
             b"GET /foobar HTTP/1.1\r\n"
@@ -227,7 +245,7 @@ def test_parse_header_multiple_content_length(self):
         try:
             self.parser.parse_header(data)
         except ParsingError as e:
-            self.assertIn("Content-Length is invalid", e.args[0])
+            self.assertTrue(e.args[0].startswith("Duplicate header:"))
         else:  # pragma: nocover
             self.assertTrue(False)