Commit Graph

62 Commits

Author SHA1 Message Date
Glyph b9aa14a484
gh-100519: simplification to `eff_request_host` in cookiejar.py (#99588)
`IPV4_RE` includes a `.`, and the `.find(".") == -1` included here is already testing to make sure there's no dot, so this part of the expression is tautological. Instead use more modern `in` syntax to make it clear what the check is doing here. The simplified implementation more clearly matches the wording in RFC 2965.

Co-authored-by: hauntsaninja <hauntsaninja@gmail.com>
2022-12-24 18:14:51 -06:00
Nikita Sobolev 44892d45b0
gh-99576: Fix cookiejar file that was not truncated for some classes (GH-99616)
Co-authored-by: Łukasz Langa <lukasz@langa.pl>
2022-12-20 17:51:26 +01:00
Nick Drozd 024ac542d7
bpo-45975: Simplify some while-loops with walrus operator (GH-29347) 2022-11-26 14:33:25 -08:00
Boris Verkhovskiy 0ea8b925d0
Document that MozillaCookieJar works for curl's cookie files (#91852)
MozillaCookieJar works for curl's cookies
2022-10-03 15:07:54 -07:00
Pascal Wittmann c6f6ede728
gh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar.save() (GH-93463)
Note: This change is not effective on Microsoft Windows.

Cookies can store sensitive information and should therefore be protected
against unauthorized third parties. This is also described in issue #79096.

The filesystem permissions are currently set to 644, everyone can read the
file. This commit changes the permissions to 600, only the creater of the file
can read and modify it. This improves security, because it reduces the attack
surface. Now the attacker needs control of the user that created the cookie or
a ways to circumvent the filesystems permissions.

This change is backwards incompatible. Systems that rely on world-readable
cookies will breake. However, one could argue that those are misconfigured in
the first place.
2022-06-07 10:11:03 +02:00
Iman Kermani 615b24c80b
bpo-42066: CookieJar cookies should not be sorted (GH-22745) 2022-04-20 20:45:24 -05:00
Nick b6d5e3c3c9
bpo-46075: Store localhost cookies in CookieJar (#30108)
Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com>
2022-04-19 13:08:06 -07:00
Nikita Sobolev 0cbdd21311
bpo-46565: `del` loop vars that are leaking into module namespaces (GH-30993) 2022-02-03 11:20:08 +02:00
Jacob Neil Taylor 16ee68da6e
bpo-38976: Add support for HTTP Only flag in MozillaCookieJar (#17471)
Add support for HTTP Only flag in MozillaCookieJar

Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
2020-10-23 15:48:55 -07:00
bcaller 1b779bfb85 bpo-38804: Fix REDoS in http.cookiejar (GH-17157)
The regex http.cookiejar.LOOSE_HTTP_DATE_RE was vulnerable to regular
expression denial of service (REDoS).

LOOSE_HTTP_DATE_RE.match is called when using http.cookiejar.CookieJar
to parse Set-Cookie headers returned by a server.
Processing a response from a malicious HTTP server can lead to extreme
CPU usage and execution will be blocked for a long time.

The regex contained multiple overlapping \s* capture groups.
Ignoring the ?-optional capture groups the regex could be simplified to

    \d+-\w+-\d+(\s*\s*\s*)$

Therefore, a long sequence of spaces can trigger bad performance.

Matching a malicious string such as

    LOOSE_HTTP_DATE_RE.match("1-c-1" + (" " * 2000) + "!")

caused catastrophic backtracking.

The fix removes ambiguity about which \s* should match a particular
space.

You can create a malicious server which responds with Set-Cookie headers
to attack all python programs which access it e.g.

    from http.server import BaseHTTPRequestHandler, HTTPServer

    def make_set_cookie_value(n_spaces):
        spaces = " " * n_spaces
        expiry = f"1-c-1{spaces}!"
        return f"b;Expires={expiry}"

    class Handler(BaseHTTPRequestHandler):
        def do_GET(self):
            self.log_request(204)
            self.send_response_only(204)  # Don't bother sending Server and Date
            n_spaces = (
                int(self.path[1:])  # Can GET e.g. /100 to test shorter sequences
                if len(self.path) > 1 else
                65506  # Max header line length 65536
            )
            value = make_set_cookie_value(n_spaces)
            for i in range(99):  # Not necessary, but we can have up to 100 header lines
                self.send_header("Set-Cookie", value)
            self.end_headers()

    if __name__ == "__main__":
        HTTPServer(("", 44020), Handler).serve_forever()

This server returns 99 Set-Cookie headers. Each has 65506 spaces.
Extracting the cookies will pretty much never complete.

Vulnerable client using the example at the bottom of
https://docs.python.org/3/library/http.cookiejar.html :

    import http.cookiejar, urllib.request
    cj = http.cookiejar.CookieJar()
    opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj))
    r = opener.open("http://localhost:44020/")

The popular requests library was also vulnerable without any additional
options (as it uses http.cookiejar by default):

    import requests
    requests.get("http://localhost:44020/")

* Regression test for http.cookiejar REDoS

If we regress, this test will take a very long time.

* Improve performance of http.cookiejar.ISO_DATE_RE

A string like

"444444" + (" " * 2000) + "A"

could cause poor performance due to the 2 overlapping \s* groups,
although this is not as serious as the REDoS in LOOSE_HTTP_DATE_RE was.
2019-11-22 15:22:11 +01:00
Xtreak bb41147eab bpo-12144: Handle cookies with expires attribute in CookieJar.make_cookies (GH-13921)
Handle time comparison for cookies with `expires` attribute when `CookieJar.make_cookies` is called.

Co-authored-by: Demian Brecht <demianbrecht@gmail.com>


https://bugs.python.org/issue12144



Automerge-Triggered-By: @asvetlov
2019-09-13 04:29:00 -07:00
Xtreak 0e1f1f0105 bpo-35647: Fix path check in cookiejar (#11436)
* Refactor cookie path check as per RFC 6265

* Add tests for prefix match of path

* Add news entry

* Fix set_ok_path and refactor tests

* Use slice for last letter
2019-03-10 10:12:28 -07:00
Xtreak ca7fe50635 bpo-35121: prefix dot in domain for proper subdomain validation (GH-10258)
Don't send cookies of domain A without Domain attribute to domain B when domain A is a suffix match of domain B while using a cookiejar with `http.cookiejar.DefaultCookiePolicy` policy.  Patch by Karthikeyan Singaravelan.
2019-03-09 21:09:48 -05:00
Stéphane Wirtel 4b219ce81e bpo-36043: FileCookieJar supports os.PathLike (GH-11945)
https://bugs.python.org/issue36043
2019-03-01 12:40:54 -08:00
Paul Bailey 4c33997057 bpo-34911: Added support for secure websocket cookies (GH-9734) 2018-10-08 21:49:29 +03:00
Antoine Pitrou a6a4dc816d bpo-31370: Remove support for threads-less builds (#3385)
* Remove Setup.config
* Always define WITH_THREAD for compatibility.
2017-09-07 18:56:24 +02:00
R David Murray 44b548dda8 #27364: fix "incorrect" uses of escape character in the stdlib.
And most of the tools.

Patch by Emanual Barry, reviewed by me, Serhiy Storchaka, and
Martin Panter.
2016-09-08 13:59:53 -04:00
Raymond Hettinger 7ea386e56e Issue 19504: Change "customise" to "customize" American spelling. 2016-08-25 21:11:50 -07:00
Senthil Kumaran d5b47fb8ce Issue #27466: Change time format returned by http.cookie.time2netscape,
confirming the netscape cookie format.
2016-07-10 06:45:38 -07:00
Martin Panter f0564164ba Fix typos in comments, documentation and test method names 2016-05-08 13:48:10 +00:00
Berker Peksag 20be53e5b5 Issue #16181: cookiejar.http2time() now returns None if year is higher than datetime.MAXYEAR 2016-03-14 05:48:02 +02:00
Martin Panter 32acc16cda Merge typo and grammar fixes from 3.4 into 3.5 2015-11-14 01:14:25 +00:00
Martin Panter ac34e09bbf Correct Content-Type syntax in documentation 2015-11-14 00:58:32 +00:00
Serhiy Storchaka a84f6c3dd3 Issue #25523: Merge a-to-an corrections from 3.4. 2015-11-02 14:39:05 +02:00
Serhiy Storchaka d65c9496da Issue #25523: Further a-to-an corrections. 2015-11-02 14:10:23 +02:00
Robert Collins a0e5d981cd Issue #23888: Handle fractional time in cookie expiry. Patch by ssh. 2015-08-04 10:06:29 +12:00
Robert Collins f3d9c315b6 Issue #23888: Handle fractional time in cookie expiry. Patch by ssh. 2015-08-04 10:07:06 +12:00
Serhiy Storchaka 46ba6c8563 Issue #22831: Use "with" to avoid possible fd leaks. 2015-04-04 11:01:02 +03:00
Serhiy Storchaka f7cc3fccad Issue #23138: Fixed parsing cookies with absent keys or values in cookiejar.
Patch by Demian Brecht.
2015-03-13 09:09:35 +02:00
Serhiy Storchaka 577fc4e87f Issue #23138: Fixed parsing cookies with absent keys or values in cookiejar.
Patch by Demian Brecht.
2015-03-13 09:05:01 +02:00
Benjamin Peterson 610bc6a211 merge 3.4 (#23221) 2015-01-13 09:20:31 -05:00
Benjamin Peterson 82f34ada45 fix instances of consecutive articles (closes #23221)
Patch by Karan Goel.
2015-01-13 09:17:24 -05:00
Victor Stinner 55e614a2a8 Issue #11957: Explicit parameter name when calling re.split() and re.sub() 2014-10-29 16:58:59 +01:00
Serhiy Storchaka 465e60e654 Issue #22033: Reprs of most Python implemened classes now contain actual
class name instead of hardcoded one.
2014-07-25 23:36:00 +03:00
Serhiy Storchaka 1392df96ef Fixed bugs in reprs of CookieJar and multiprocessing.dummy.Value. 2014-07-22 11:09:36 +03:00
Benjamin Peterson fc45f173a3 merge 3.3 (#20018) 2013-12-18 15:37:03 -06:00
Benjamin Peterson ccedc22769 update url to spec (closes #20018) 2013-12-18 15:35:18 -06:00
Brett Cannon cd171c8e92 Issue #18200: Back out usage of ModuleNotFoundError (8d28d44f3a9a) 2013-07-04 17:43:24 -04:00
Brett Cannon 0a140668fa Issue #18200: Update the stdlib (except tests) to use
ModuleNotFoundError.
2013-06-13 20:57:26 -04:00
Senthil Kumaran 7005b1f90a #17678: Remove the use of a deprecated method http/cookiejar.py. Changing the
usage of get_origin_req_host() to origin_req_host.

Patch by Wei-Cheng Pan
2013-04-09 07:11:07 -07:00
Senthil Kumaran d9fbf36bbd #17678: Fix DeprecationWarning in the http/cookiejar.py by changing the usage
of get_origin_req_host() to origin_req_host.

Patch by Wei-Cheng Pan
2013-04-09 07:07:59 -07:00
Giampaolo Rodola' 2f50aaf2ff modernize some modules' code by using with statement around open() 2013-02-12 02:04:27 +01:00
Andrew Svetlov f7a17b48d7 Replace IOError with OSError (#16715) 2012-12-25 16:47:37 +02:00
Philip Jenvey fd0d3e5d25 more yield from
patch by Serhiy Storchaka
2012-10-01 15:34:31 -07:00
Ezio Melotti 8b15ee0d6e #15980: merge with 3.2. 2012-09-21 16:31:24 +03:00
Ezio Melotti 0847db7c01 #15980: properly escape newlines in docstrings. Patch by Serhiy Storchaka. 2012-09-21 16:30:22 +03:00
Meador Inge da1ffbc4ee Issue #15409: Replace use of deprecated urllib.request.Request methods in http.cookijar
Patch by Flávio Ribeiro.
2012-07-20 19:12:04 -05:00
Éric Araujo 23760e97ed Don’t interpret backslashes in ASCII diagram in a docstring 2011-11-07 17:52:48 +01:00
Ezio Melotti e130a52d8a Remove duplication. 2011-10-19 10:58:56 +03:00
Victor Stinner 56f9a0221b merge 3.1 2011-03-21 02:51:38 +01:00