Reject invalid HTTP method token characters

[andrewkernel]

❓ What kind of change does this PR introduce?

• 🐞 bug fix
• 🐣 feature
• 📋 docs update
• 📋 tests/coverage improvement
• 📋 refactoring
• 💥 other

📋 What is the related issue number (starting with #)

Closes #715.

❓ What is the current behavior? (You can also link to an open issue here)

HTTP request methods containing characters outside the HTTP token grammar could be accepted after parsing the request line.

❓ What is the new behavior (if this is a feature change)?

Cheroot now validates parsed HTTP methods against the HTTP token character set and rejects methods containing invalid token characters with 400 Bad Request.

📋 Other information:

Added docs/changelog-fragments.d/833.bugfix.rst.

Testing:

• .venv\Scripts\python.exe -m pytest --no-cov -n 0 cheroot/test/test_core.py -k "malformed_http_method or invalid_character_in_http_method"

📋 Contribution checklist:

• I wrote descriptive pull request text above
• I think the code is well written
• I wrote good commit messages
• I have squashed related commits together after the changes have been approved
• Unit tests for the changes exist
• Integration tests for the changes exist (if applicable)
• I used the same coding conventions as the rest of the project
• The new code doesn't generate linter offenses
• Documentation reflects the changes
• The PR relates to only one subject with a clear title and description in grammatically correct, complete sentences

[read-the-docs-community]

Documentation build overview

📚 cheroot | 🛠️ Build #33486590 | 📁 Comparing 0446800 against latest (3937fe1)

  🔍 Preview build  

6 files changed · ± 6 modified

± Modified

• genindex/index.html
• history/index.html
• pkg/cheroot/index.html
• pkg/cheroot.server/index.html
• pkg/cheroot.test/index.html
• pkg/cheroot.test.test_core/index.html

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.16%. Comparing base (3937fe1) to head (0446800).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #833      +/-   ##
==========================================
- Coverage   78.19%   78.16%   -0.03%     
==========================================
  Files          41       41              
  Lines        4788     4800      +12     
  Branches      547      548       +1     
==========================================
+ Hits         3744     3752       +8     
- Misses        905      907       +2     
- Partials      139      141       +2     

[julianz-]

Useful like #832 but can you use the original template in the PR description?

Your commit also needs a body message which can expand on the commit message. The CI log mentions this:

Commit ede37bd316:
3: B6 Body message is missing
Error: Process completed with exit code 1.

You also need to add a docs/changelog-fragments.d/833.bugfix.rst describing the bug fix in the appropriate towncrier style - see docs/changelog-fragments.d/README.rst.

[julianz-]

Use a descriptive variable name such as conn.

[julianz-]

Let's make the message more informative e.g.: Malformed method name: invalid token (see RFC 9110 section 9.1). See, for example, line 834. References older (obsoleted) RFCs but you get the idea.

resp = (
                'Malformed method name: According to RFC 2616 '
                '(section 5.1.1) and its successors '
                'RFC 7230 (section 3.1.1) and RFC 7231 (section 4.1) '
                'method names are case-sensitive and uppercase.'
            )