refuse HTTP method CONNECT

gunicorn/http/message.py

@@ -417,6 +417,12 @@ def parse_request_line(self, line_bytes):
                 raise InvalidRequestMethod(self.method)
             if not 3 <= len(bits[0]) <= 20:
                 raise InvalidRequestMethod(self.method)
+            # this restriction mitigates the failure to validate authority-form below
+            # ! do not remove simply because cfg.permit_unconventional_http_method is removed
+            if self.method == "CONNECT":
+                # BUG: method is not necessarily invalid, merely unsupported
+                # TODO: improve once Worker.handle_error is refactored
+                raise InvalidRequestMethod(self.method)
         # standard restriction: RFC9110 token
         if not TOKEN_RE.fullmatch(self.method):
             raise InvalidRequestMethod(self.method)

tests/requests/invalid/method_01.http

@@ -0,0 +1,4 @@
+CONNECT host:25 HTTP/1.1\r\n
+Content-Length: 3\r\n
+\r\n
+BOO

tests/requests/invalid/method_01.py

@@ -0,0 +1,3 @@
+from gunicorn.http.errors import InvalidRequestMethod
+
+request = InvalidRequestMethod

tests/requests/invalid/method_02.http

@@ -0,0 +1,4 @@
+CONNECT domain.example HTTP/1.1\r\n
+Content-Length: 3\r\n
+\r\n
+FOO

tests/requests/invalid/method_02.py

@@ -0,0 +1,3 @@
+from gunicorn.http.errors import InvalidRequestMethod
+
+request = InvalidRequestMethod