GHSA-pr2v-jx2c-wg9f

Tornado vulnerable to Header Injection and XSS via reason argument

# Header injection and XSS via `reason` argument ## Summary The `reason` argument (used by both `RequestHandler.set_status` and `tornado.web.HTTPError` is designed to allow applications to pass custom "reason" phrases (the "Not Found" in `HTTP/1.1 404 Not Found`) to the HTTP status line (mainly for non-standard status codes). Vulnerabilities exist in Tornado versions prior to 6.5.3 if untrusted data is passed as the `reason` argument. ## Details In vulnerable versions, the supplied `reason` phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS). ## Impact * **Type:** Reflected Cross-Site Scripting (CWE-79) in default error page, or header injection (CWE-644) * **Actors:** Remote attacker who can cause the application to raise `HTTPError`/`set_status` with an attacker-controlled `reason` (e.g., via query parameter used by developer). * **Effect:** Execution of arbitrary JavaScript in victims' browsers when they view the error page — possible session token theft, CSRF escalation, UI spoofing, or other client-side attacks depending on context. * **Scope:** Only applications that explicitly reflect untrusted input into `reason` are affected. ## Mitigation Aside from upgrading to Tornado 6.5.3 or newer, the vulnerability can be mitigated by not using untrusted data for the `reason` argument. In the intended use case the `reason` argument would generally be a string literal and not derived from user input. Also, the `reason` argument is rarely required (reason phrases are not used at all in HTTP/2) and can generally be omitted. For a general-purpose error message in HTTPError, consider using the `log_message` argument instead of `reason`.