changeset:   92443:9e765e65e5cb
branch:      2.7
parent:      92431:e6c7a5a94a1d
user:        Guido van Rossum <guido@python.org>
date:        Tue Sep 16 15:45:36 2014 -0700
files:       Lib/Cookie.py Lib/test/test_cookie.py Misc/ACKS Misc/NEWS
description:
Lax cookie parsing in http.cookies could be a security issue when
combined with non-standard cookie handling in some Web browsers.

Reported by Sergey Bobrov.


diff -r e6c7a5a94a1d -r 9e765e65e5cb Lib/Cookie.py
--- a/Lib/Cookie.py	Mon Sep 15 11:35:06 2014 +0300
+++ b/Lib/Cookie.py	Tue Sep 16 15:45:36 2014 -0700
@@ -531,6 +531,7 @@
 _LegalCharsPatt  = r"[\w\d!#%&'~_`><@,:/\$\*\+\-\.\^\|\)\(\?\}\{\=]"
 _CookiePattern = re.compile(
     r"(?x)"                       # This is a Verbose pattern
+    r"\s*"                        # Optional whitespace at start of cookie
     r"(?P<key>"                   # Start of group 'key'
     ""+ _LegalCharsPatt +"+?"     # Any word of at least one letter, nongreedy
     r")"                          # End of group 'key'
@@ -646,7 +647,7 @@
 
         while 0 <= i < n:
             # Start looking for a cookie
-            match = patt.search(str, i)
+            match = patt.match(str, i)
             if not match: break          # No more cookies
 
             K,V = match.group("key"), match.group("val")
diff -r e6c7a5a94a1d -r 9e765e65e5cb Lib/test/test_cookie.py
--- a/Lib/test/test_cookie.py	Mon Sep 15 11:35:06 2014 +0300
+++ b/Lib/test/test_cookie.py	Tue Sep 16 15:45:36 2014 -0700
@@ -133,6 +133,15 @@
         self.assertEqual(C['Customer']['version'], '1')
         self.assertEqual(C['Customer']['path'], '/acme')
 
+    def test_invalid_cookies(self):
+        # Accepting these could be a security issue
+        C = Cookie.SimpleCookie()
+        for s in (']foo=x', '[foo=x', 'blah]foo=x', 'blah[foo=x'):
+            C.load(s)
+            self.assertEqual(dict(C), {})
+            self.assertEqual(C.output(), '')
+
+
 def test_main():
     run_unittest(CookieTests)
     if Cookie.__doc__ is not None:
diff -r e6c7a5a94a1d -r 9e765e65e5cb Misc/ACKS
--- a/Misc/ACKS	Mon Sep 15 11:35:06 2014 +0300
+++ b/Misc/ACKS	Tue Sep 16 15:45:36 2014 -0700
@@ -136,6 +136,7 @@
 Pablo Bleyer
 Erik van Blokland
 Eric Blossom
+Sergey Bobrov
 Finn Bock
 Paul Boddie
 Matthew Boedicker
diff -r e6c7a5a94a1d -r 9e765e65e5cb Misc/NEWS
--- a/Misc/NEWS	Mon Sep 15 11:35:06 2014 +0300
+++ b/Misc/NEWS	Tue Sep 16 15:45:36 2014 -0700
@@ -21,6 +21,9 @@
 
 Library
 -------
+- Lax cookie parsing in http.cookies could be a security issue when combined
+  with non-standard cookie handling in some Web browsers.  Reported by
+  Sergey Bobrov.
 
 - Issue #21147: sqlite3 now raises an exception if the request contains a null
   character instead of truncate it.  Based on patch by Victor Stinner.