Issue #26560: Avoid potential ValueError in BaseHandler.start_response

Initial patch by Peter Inglesby.

Lib/test/test_wsgiref.py

@@ -166,6 +166,27 @@ class IntegrationTests(TestCase):
             " be of type list: <class 'tuple'>"
         )
 
+    def test_status_validation_errors(self):
+        def create_bad_app(status):
+            def bad_app(environ, start_response):
+                start_response(status, [("Content-Type", "text/plain; charset=utf-8")])
+                return [b"Hello, world!"]
+            return bad_app
+
+        tests = [
+            ('200', 'AssertionError: Status must be at least 4 characters'),
+            ('20X OK', 'AssertionError: Status message must begin w/3-digit code'),
+            ('200OK', 'AssertionError: Status message must have a space after code'),
+        ]
+
+        for status, exc_message in tests:
+            with self.subTest(status=status):
+                out, err = run_amock(create_bad_app(status))
+                self.assertTrue(out.endswith(
+                    b"A server error occurred.  Please contact the administrator."
+                ))
+                self.assertEqual(err.splitlines()[-2], exc_message)
+
     def test_wsgi_input(self):
         def bad_app(e,s):
             e["wsgi.input"].read()

Lib/wsgiref/handlers.py

@@ -226,7 +226,7 @@ class BaseHandler:
         self.headers = self.headers_class(headers)
         status = self._convert_string_type(status, "Status")
         assert len(status)>=4,"Status must be at least 4 characters"
-        assert int(status[:3]),"Status message must begin w/3-digit code"
+        assert status[:3].isdigit(), "Status message must begin w/3-digit code"
         assert status[3]==" ", "Status message must have a space after code"
 
         if __debug__:

Misc/NEWS

@@ -226,6 +226,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #26560: Avoid potential ValueError in BaseHandler.start_response.
+  Initial patch by Peter Inglesby.
+
 - Issue #26567: Add a new function :c:func:`PyErr_ResourceWarning` function to
   pass the destroyed object. Add a *source* attribute to
   :class:`warnings.WarningMessage`. Add warnings._showwarnmsg() which uses