django.git/tests/asgi/tests.py, branch 6.0.4

[6.0.x] Fixed CVE-2026-33034 -- Enforced DATA_UPLOAD_MAX_MEMORY_SIZE on body size in ASGI requests.

2026-04-07T11:22:54Z

The `body` property in `HttpRequest` checks DATA_UPLOAD_MAX_MEMORY_SIZE against the declared `Content-Length` header before reading. On the ASGI path, chunked requests carry no `Content-Length`, so the check evaluated to 0 and always passed regardless of the actual body size. This work adds a new check on the actual number of bytes consumed. Thanks to Superior for the report, and to Jake Howard and Jacob Walls for reviews. Backport of 953c238058c0ce387a1a41cb491bfc1875d73ad0 from main.

[6.0.x] Fixed CVE-2026-3902 -- Ignored headers with underscores in ASGIRequest.

2026-04-07T11:20:07Z

Thanks Tarek Nakkouch for the report and Jake Howard and Natalia Bidart for reviews. Backport of caf90a971f09323775ed0cacf94eadaf39d040e0 from main.

[6.0.x] Fixed CVE-2025-14550 -- Optimized repeated header parsing in ASGI requests.

2026-02-03T13:00:14Z

Thanks Jiyong Yang for the report, and Natalia Bidart, Jacob Walls, and Shai Berger for reviews. Backport of eb22e1d6d643360e952609ef562c139a100ea4eb from main.

Fixed #36399 -- Added support for multiple Cookie headers in HTTP/2 for ASGIRequest.

2025-08-21T14:48:54Z

Signed-off-by: SaJH

Refs #36467 -- Added test for Set-Cookie header values in ASGIHandler.

2025-06-18T09:25:14Z

Fixed #36281 -- Used async-safe write in ASGIHandler.read_body().

2025-05-04T12:53:08Z

Thanks Carlton Gibson for reviews.

Fixed warnings per flake8 7.2.0.

2025-03-30T15:54:15Z

https://github.com/PyCQA/flake8/releases/tag/7.2.0

Refs #33735 -- Captured stderr during ASGITest.test_file_response.

2024-11-27T10:00:05Z

Refs #35059 -- Used asyncio.Event in ASGITest.test_asyncio_cancel_error to enforce specific interleaving.

2024-05-28T17:36:34Z

Sleep call leads to a hard to trace error in CI. Using an Event is more deterministic, and should be less prone to environment variations. Bug in 11393ab1316f973c5fbb534305750740d909b4e4.

Fixed #35059 -- Ensured that ASGIHandler always sends the request_finished signal.

2024-01-31T17:40:57Z

Prior to this work, when async tasks that process the request are cancelled due to receiving an early "http.disconnect" ASGI message, the request_finished signal was not being sent, potentially leading to resource leaks (such as database connections). This branch ensures that the request_finished signal is sent even in the case of early termination of the response. Regression in 64cea1e48f285ea2162c669208d95188b32bbc82. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Co-authored-by: Carlton Gibson