File CVE-2025-67725.patch of Package python-tornado.42131

From 68e81b4a3385161877408a7a49c7ed12b45a614d Mon Sep 17 00:00:00 2001
From: Ben Darnell <ben@bendarnell.com>
Date: Tue, 9 Dec 2025 13:27:27 -0500
Subject: [PATCH] httputil: Fix quadratic performance of repeated header lines

Previouisly, when many header lines with the same name were found
in an HTTP request or response, repeated string concatenation would
result in quadratic performance. This change does the concatenation
lazily (with a cache) so that repeated headers can be processed
efficiently.

Security: The previous behavior allowed a denial of service attack
via a maliciously crafted HTTP message, but only if the
max_header_size was increased from its default of 64kB.
---
 tornado/httputil.py           | 36 ++++++++++++++++++++++++-----------
 tornado/test/httputil_test.py | 15 +++++++++++++++
 2 files changed, 40 insertions(+), 11 deletions(-)

Index: tornado-4.5.3/tornado/httputil.py
===================================================================
--- tornado-4.5.3.orig/tornado/httputil.py
+++ tornado-4.5.3/tornado/httputil.py
@@ -130,8 +130,8 @@ class HTTPHeaders(collections.MutableMap
     Set-Cookie: C=D
     """
     def __init__(self, *args, **kwargs):
-        self._dict = {}  # type: typing.Dict[str, str]
         self._as_list = {}  # type: typing.Dict[str, typing.List[str]]
+        self._combined_cache = {} # type: typing.Dict[str, str]
         self._last_key = None
         if (len(args) == 1 and len(kwargs) == 0 and
                 isinstance(args[0], HTTPHeaders)):
@@ -150,8 +150,7 @@ class HTTPHeaders(collections.MutableMap
         norm_name = _normalized_headers[name]
         self._last_key = norm_name
         if norm_name in self:
-            self._dict[norm_name] = (native_str(self[norm_name]) + ',' +
-                                     native_str(value))
+            self._combined_cache.pop(norm_name, None)
             self._as_list[norm_name].append(value)
         else:
             self[norm_name] = value
@@ -184,7 +183,7 @@ class HTTPHeaders(collections.MutableMap
             # continuation of a multi-line header
             new_part = ' ' + line.lstrip()
             self._as_list[self._last_key][-1] += new_part
-            self._dict[self._last_key] += new_part
+            self._combined_cache.pop(self._last_key, None)
         else:
             name, value = line.split(":", 1)
             self.add(name, value.strip())
@@ -207,23 +206,33 @@ class HTTPHeaders(collections.MutableMap
 
     def __setitem__(self, name, value):
         norm_name = _normalized_headers[name]
-        self._dict[norm_name] = value
+        self._combined_cache[norm_name] = value
         self._as_list[norm_name] = [value]
 
+    def __contains__(self, name):
+        # This is an important optimization to avoid the expensive concatenation
+        # in __getitem__ when it's not needed.
+        if not isinstance(name, str):
+            return False
+        return name in self._as_list
+
     def __getitem__(self, name):
         # type: (str) -> str
-        return self._dict[_normalized_headers[name]]
+        header = _normalized_headers[name]
+        if header not in self._combined_cache:
+            self._combined_cache[header] = ",".join(self._as_list[header])
+        return self._combined_cache[header]
 
     def __delitem__(self, name):
         norm_name = _normalized_headers[name]
-        del self._dict[norm_name]
+        del self._combined_cache[norm_name]
         del self._as_list[norm_name]
 
     def __len__(self):
-        return len(self._dict)
+        return len(self._as_list)
 
     def __iter__(self):
-        return iter(self._dict)
+        return iter(self._as_list)
 
     def copy(self):
         # defined in dict but not in MutableMapping.
Index: tornado-4.5.3/tornado/test/httputil_test.py
===================================================================
--- tornado-4.5.3.orig/tornado/test/httputil_test.py
+++ tornado-4.5.3/tornado/test/httputil_test.py
@@ -365,6 +365,20 @@ Foo: even
         headers2 = HTTPHeaders.parse(str(headers))
         self.assertEquals(headers, headers2)
 
+    def test_linear_performance(self):
+        def f(n):
+            start = time.time()
+            headers = HTTPHeaders()
+            for i in range(n):
+                headers.add("X-Foo", "bar")
+            return time.time() - start
+
+        # This runs under 50ms on my laptop as of 2025-12-09.
+        d1 = f(10000)
+        d2 = f(100000)
+        if d2 / d1 > 20:
+            # d2 should be about 10x d1 but allow a wide margin for variability.
+            self.fail("HTTPHeaders.add() does not scale linearly: %s vs %s" % (d1, d2))
 
 class FormatTimestampTest(unittest.TestCase):
     # Make sure that all the input types are supported.
@@ -418,6 +432,21 @@ class ParseRequestStartLineTest(unittest
         self.assertEqual(parsed_start_line.path, self.PATH)
         self.assertEqual(parsed_start_line.version, self.VERSION)
 
+    def test_linear_performance(self):
+        def f(n):
+            start = time.time()
+            headers = HTTPHeaders()
+            for i in range(n):
+                headers.add("X-Foo", "bar")
+            return time.time() - start
+
+        # This runs under 50ms on my laptop as of 2025-12-09.
+        d1 = f(10000)
+        d2 = f(100000)
+        if d2 / d1 > 20:
+            # d2 should be about 10x d1 but allow a wide margin for variability.
+            self.fail("HTTPHeaders.add() does not scale linearly: %s vs %s" % (d1, d2))
+
 
 class ParseCookieTest(unittest.TestCase):
     # These tests copied from Django: