changeset:   92440:d3663a0f97ed
parent:      92437:5660c1bdc2b6
parent:      92439:60cab9d28525
user:        Antoine Pitrou <solipsis@pitrou.net>
date:        Wed Sep 17 00:27:26 2014 +0200
files:       Misc/ACKS Misc/NEWS
description:
Lax cookie parsing in http.cookies could be a security issue when combined
with non-standard cookie handling in some Web browsers.

Reported by Sergey Bobrov.


diff -r 5660c1bdc2b6 -r d3663a0f97ed Lib/http/cookies.py
--- a/Lib/http/cookies.py	Tue Sep 16 18:33:37 2014 +0530
+++ b/Lib/http/cookies.py	Wed Sep 17 00:27:26 2014 +0200
@@ -431,6 +431,7 @@
 _LegalCharsPatt  = r"[\w\d!#%&'~_`><@,:/\$\*\+\-\.\^\|\)\(\?\}\{\=]"
 _CookiePattern = re.compile(r"""
     (?x)                           # This is a verbose pattern
+    \s*                            # Optional whitespace at start of cookie
     (?P<key>                       # Start of group 'key'
     """ + _LegalCharsPatt + r"""+?   # Any word of at least one letter
     )                              # End of group 'key'
@@ -534,7 +535,7 @@
 
         while 0 <= i < n:
             # Start looking for a cookie
-            match = patt.search(str, i)
+            match = patt.match(str, i)
             if not match:
                 # No more cookies
                 break
diff -r 5660c1bdc2b6 -r d3663a0f97ed Lib/test/test_http_cookies.py
--- a/Lib/test/test_http_cookies.py	Tue Sep 16 18:33:37 2014 +0530
+++ b/Lib/test/test_http_cookies.py	Wed Sep 17 00:27:26 2014 +0200
@@ -179,6 +179,15 @@
         </script>
         """)
 
+    def test_invalid_cookies(self):
+        # Accepting these could be a security issue
+        C = cookies.SimpleCookie()
+        for s in (']foo=x', '[foo=x', 'blah]foo=x', 'blah[foo=x'):
+            C.load(s)
+            self.assertEqual(dict(C), {})
+            self.assertEqual(C.output(), '')
+
+
 class MorselTests(unittest.TestCase):
     """Tests for the Morsel object."""
 
diff -r 5660c1bdc2b6 -r d3663a0f97ed Misc/ACKS
--- a/Misc/ACKS	Tue Sep 16 18:33:37 2014 +0530
+++ b/Misc/ACKS	Wed Sep 17 00:27:26 2014 +0200
@@ -142,6 +142,7 @@
 Pablo Bleyer
 Erik van Blokland
 Eric Blossom
+Sergey Bobrov
 Finn Bock
 Paul Boddie
 Matthew Boedicker
diff -r 5660c1bdc2b6 -r d3663a0f97ed Misc/NEWS
--- a/Misc/NEWS	Tue Sep 16 18:33:37 2014 +0530
+++ b/Misc/NEWS	Wed Sep 17 00:27:26 2014 +0200
@@ -132,6 +132,10 @@
 Library
 -------
 
+- Lax cookie parsing in http.cookies could be a security issue when combined
+  with non-standard cookie handling in some Web browsers.  Reported by
+  Sergey Bobrov.
+
 - Issue #20537: logging methods now accept an exception instance as well as a
   Boolean value or exception tuple. Thanks to Yury Selivanov for the patch.