Vulnerable code sample

import asyncio
from aiohttp import web, ClientSession

# This code demonstrates the logic of the vulnerability described in
# CVE-2025-69225. A vulnerable aiohttp server (version 3.13.2 and below)
# would incorrectly parse a 'Range' header containing non-ASCII decimals.
# This script sets up a server and a client to test this behavior.

async def vulnerable_range_handler(request):
    """
    This server handler inspects the incoming request's 'Range' header.
    
    The vulnerability is in the underlying parser that populates the
    `request.http_range` attribute. A vulnerable version will successfully
    parse non-ASCII digits, while a patched version will ignore them.
    """
    range_header_value = request.headers.get('Range', 'Not present')
    
    # The `http_range` attribute holds a slice object if parsing is successful.
    parsed_range = request.http_range
    
    # The response text shows whether the non-ASCII range was parsed.
    # On a vulnerable system, 'start' and 'stop' would be integers.
    # On a patched system, they would be 'None'.
    response_text = (
        f"Raw 'Range' header received: {range_header_value}\n"
        f"Parsed http_range.start: {parsed_range.start}\n"
        f"Parsed http_range.stop: {parsed_range.stop}\n"
    )
    
    if parsed_range.start is not None:
        response_text += "\nRESULT: VULNERABLE. Non-ASCII range was parsed."
    else:
        response_text += "\nRESULT: NOT VULNERABLE. Non-ASCII range was ignored."

    return web.Response(text=response_text)

async def main():
    # --- 1. Server Setup ---
    app = web.Application()
    app.router.add_get('/', vulnerable_range_handler)
    runner = web.AppRunner(app)
    await runner.setup()
    site = web.TCPSite(runner, '127.0.0.1', 8080)
    await site.start()
    
    server_address = 'http://127.0.0.1:8080'
    print(f"Server running at {server_address}")

    # --- 2. Client Request ---
    # The client sends a 'Range' header using non-ASCII full-width digits
    # (e.g., U+FF11 for '１' and U+FF19 for '９').
    # This is the vector used to demonstrate the parsing flaw.
    vulnerable_headers = {'Range': 'bytes=１-９９'}
    
    print("\nSending request with malicious 'Range' header...")
    print(f"-> Header: Range: {vulnerable_headers['Range']}")
    
    try:
        async with ClientSession() as session:
            async with session.get(server_address, headers=vulnerable_headers) as response:
                print("\n--- Server Response ---")
                server_output = await response.text()
                print(server_output)
    except Exception as e:
        print(f"\nAn error occurred during client request: {e}")
    finally:
        # --- 3. Server Shutdown ---
        await runner.cleanup()
        print("\nServer shut down.")

if __name__ == "__main__":
    # To run this demonstration, you need to have 'aiohttp' installed.
    # `pip install aiohttp`
    # This script simulates the environment before the fix for CVE-2025-69225.
    # Running it on a vulnerable version would show integer values for start/stop
    # and a "VULNERABLE" result.
    try:
        asyncio.run(main())
    except KeyboardInterrupt:
        print("\nDemonstration stopped by user.")