diff options
Diffstat (limited to 'django/test/client.py')
| -rw-r--r-- | django/test/client.py | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/django/test/client.py b/django/test/client.py index c7cdd24abf..0f986d5a6c 100644 --- a/django/test/client.py +++ b/django/test/client.py @@ -773,7 +773,10 @@ class AsyncRequestFactory(RequestFactory): if headers: extra.update(HttpHeaders.to_asgi_names(headers)) s["headers"] += [ - (key.lower().encode("ascii"), value.encode("latin1")) + # Avoid breaking test clients that just want to supply normalized + # ASGI names, regardless of the fact that ASGIRequest drops headers + # with underscores (CVE-2026-3902). + (key.lower().replace("_", "-").encode("ascii"), value.encode("latin1")) for key, value in extra.items() ] return self.request(**s) |