Reject invalid HTTP method token characters

Validate parsed HTTP methods against the RFC token character set before accepting the request line. This rejects methods containing invalid token characters with a 400 Bad Request response and covers the behavior with a focused regression test.

Author: pre-commit-ci[bot]

cheroot/server.py

@@ -162,7 +162,7 @@
 FORWARD_SLASH = b'/'
 QUOTED_SLASH = b'%2F'
 QUOTED_SLASH_REGEX = re.compile(b''.join((b'(?i)', QUOTED_SLASH)))
-HTTP_TOKEN_RE = re.compile(br"^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$")
+HTTP_TOKEN_RE = re.compile(rb'^[!#$%&\'*+\-.^_`|~0-9A-Za-z]+$')
 
 
 _STOPPING_FOR_INTERRUPT = Exception()  # sentinel used during shutdown

docs/changelog-fragments.d/833.bugfix.rst

@@ -0,0 +1 @@
+Rejected HTTP methods containing characters that are invalid in HTTP tokens.