Lax cookie parsing in http.cookies could be a security issue when combined

with non-standard cookie handling in some Web browsers.

Reported by Sergey Bobrov.

diff --git a/Lib/http/cookies.py b/Lib/http/cookies.py
index ddbcbf877bfca67d54ec9cc79bf669cb0168c427..28c11615829289b0d7c407d1ecec2b313f3c3648 100644 (file)
--- a/Lib/http/cookies.py
+++ b/Lib/http/cookies.py
@@ -432,6 +432,7 @@ class Morsel(dict):
 _LegalCharsPatt  = r"[\w\d!#%&'~_`><@,:/\$\*\+\-\.\^\|\)\(\?\}\{\=]"
 _CookiePattern = re.compile(r"""
     (?x)                           # This is a verbose pattern
+    \s*                            # Optional whitespace at start of cookie
     (?P<key>                       # Start of group 'key'
     """ + _LegalCharsPatt + r"""+?   # Any word of at least one letter
     )                              # End of group 'key'
@@ -532,7 +533,7 @@ class BaseCookie(dict):
 
         while 0 <= i < n:
             # Start looking for a cookie
-            match = patt.search(str, i)
+            match = patt.match(str, i)
             if not match:
                 # No more cookies
                 break

diff --git a/Lib/test/test_http_cookies.py b/Lib/test/test_http_cookies.py
index 1f1ca5852ef0989fa53149fdad9e0d21e70df22d..30d48983c695d5e7d96ec0e4374291df53ef46d0 100644 (file)
--- a/Lib/test/test_http_cookies.py
+++ b/Lib/test/test_http_cookies.py
@@ -132,6 +132,15 @@ class CookieTests(unittest.TestCase):
         </script>
         """)
 
+    def test_invalid_cookies(self):
+        # Accepting these could be a security issue
+        C = cookies.SimpleCookie()
+        for s in (']foo=x', '[foo=x', 'blah]foo=x', 'blah[foo=x'):
+            C.load(s)
+            self.assertEqual(dict(C), {})
+            self.assertEqual(C.output(), '')
+
+
 class MorselTests(unittest.TestCase):
     """Tests for the Morsel object."""
 

diff --git a/Misc/ACKS b/Misc/ACKS
index c183dc78f3dd7b72d8b19ca6714dc29b2808f0db..428fd01e8a5c3fd56895336595d3170b8a603288 100644 (file)
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -117,6 +117,7 @@ Martin Bless
 Pablo Bleyer
 Erik van Blokland
 Eric Blossom
+Sergey Bobrov
 Finn Bock
 Paul Boddie
 Matthew Boedicker

diff --git a/Misc/NEWS b/Misc/NEWS
index d8e61c30388ac8bceffa5ba6870cb9dbaf8f4c77..398ed294cfe9e4bdb9642b23cc25fdcda2f9b608 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -37,6 +37,10 @@ Library
   strings for ``rfc822Name`` (email), ``dNSName`` (DNS) and
   ``uniformResourceIdentifier`` (URI).
 
+- Lax cookie parsing in http.cookies could be a security issue when combined
+  with non-standard cookie handling in some Web browsers.  Reported by
+  Sergey Bobrov.
+
 - Issue #21766: Prevent a security hole in CGIHTTPServer by URL unquoting paths
   before checking for a CGI script at that path.