Skip to content

js_output wrong for cookies with " characters #49110

Closed
Closed
js_output wrong for cookies with " characters#49110
Assignees
orsenthil
Labels
stdlibStandard Library Python modules in the Lib/ directorytestsTests in the Lib/test dirtype-bugAn unexpected behavior, bug, or error

Description

@noufal
noufal
mannequin
opened on Jan 6, 2009
BPO 4860
Nosy @orsenthil, @vstinner
Files
  • cookie.patch: Patch to fix js_output for cookies with an unquoted " character
  • cookie-2.patch
  • issue4860.diff
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = 'https://github.com/orsenthil'
closed_at = <Date 2009-04-02.03:04:54.316>
created_at = <Date 2009-01-06.21:44:09.991>
labels = ['tests', 'type-bug', 'library']
title = 'js_output wrong for cookies with " characters'
updated_at = <Date 2009-04-02.03:04:54.261>
user = 'https://bugs.python.org/noufal'

    bugs.python.org fields:

    activity = <Date 2009-04-02.03:04:54.261>
actor = 'orsenthil'
assignee = 'orsenthil'
closed = True
closed_date = <Date 2009-04-02.03:04:54.316>
closer = 'orsenthil'
components = ['Library (Lib)', 'Tests']
creation = <Date 2009-01-06.21:44:09.991>
creator = 'noufal'
dependencies = []
files = ['12625', '12632', '13564']
hgrepos = []
issue_num = 4860
keywords = ['patch']
message_count = 8.0
messages = ['79292', '79312', '79336', '79339', '79909', '79915', '85121', '85149']
nosy_count = 3.0
nosy_names = ['orsenthil', 'vstinner', 'noufal']
pr_nums = []
priority = 'normal'
resolution = 'accepted'
stage = None
status = 'closed'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue4860'
versions = ['Python 3.1', 'Python 2.7']

    Activity

    1. noufal commented on Jan 6, 2009

      @noufal
      noufalmannequin
      on Jan 6, 2009
      MannequinAuthor
      If a cookie is created with a " character in the content, the js_output
which is emitted is bad javascript. eg.
>>> import Cookie
>>> c=Cookie.Cookie('Customer="WILE_E_COYOTE"; Version=1; Path=/acme')
>>> print c
Set-Cookie: Customer="WILE_E_COYOTE"; Path=/acme; Version=1
>>> print c.js_output()
          \<script type="text/javascript"\>
    \<!-- begin hiding
    document.cookie = "Customer="WILE_E_COYOTE"; Path=/acme; Version=1";
    // end hiding --\>
    \</script\>

      >>

      Also, the test_cookie tests (test_load) explicitly checks for this
      (wrong) output.

      I have attached a patch that seems to fix this or at the very least
      produces the same Cookie settings whether the cookie is set using the
      header or using javascript (I've verified this on firefox on Linux).

    2. noufal
      added
      stdlibStandard Library Python modules in the Lib/ directory
      testsTests in the Lib/test dir
      type-bugAn unexpected behavior, bug, or error
      on Jan 6, 2009

    3. vstinner commented on Jan 7, 2009

      @vstinner
      vstinner
      on Jan 7, 2009
      Member

      The patch looks correct but it breaks the unit test: updated patch
      fixes Lib/test/test_cookie.py.

    4. noufal commented on Jan 7, 2009

      @noufal
      noufalmannequin
      on Jan 7, 2009
      MannequinAuthor

      A lot of the cookie tests need to be updated. A separate bug was filed
      regarding this. http://bugs.python.org/issue3788.

      I'm working on that now and will apply your patch there as well.

    5. vstinner commented on Jan 7, 2009

      @vstinner
      vstinner
      on Jan 7, 2009
      Member

      The characters <>& should also be escaped.

    6. noufal commented on Jan 15, 2009

      @noufal
      noufalmannequin
      on Jan 15, 2009
      MannequinAuthor

      What's wrong with < and >?

      I can see the issues with ; though.

    7. vstinner commented on Jan 15, 2009

      @vstinner
      vstinner
      on Jan 15, 2009
      Member

      What's wrong with < and >?

      >> c=Cookie.Cookie('Customer="</script>";'); print c.js_output()

          <script type="text/javascript">
    <!-- begin hiding
    document.cookie = "Customer="</script>"";
    // end hiding -->
    </script>

      It allows HTML/Javascript injection. Well, Python 2.5 already displays
      a warning:

      /usr/lib/python2.5/Cookie.py:710: DeprecationWarning:
      Cookie/SmartCookie class is insecure; do not use it

      The right fix is maybe to remove deprecated and unsecure function!

    8. orsenthil commented on Apr 1, 2009

      @orsenthil
      orsenthil
      on Apr 1, 2009
      Member

      Cookie.Cookie is deprecated in Py2k. In Py3k, it is
      http.cookies.SimpleCookie. The bug was present in Py3k, the attached
      patch fixes it.

    9. orsenthil
      self-assigned this
      on Apr 1, 2009

    10. orsenthil commented on Apr 2, 2009

      @orsenthil
      orsenthil
      on Apr 2, 2009
      Member

      Because SimpleCookie class is still usable (that is not deprecated), it
      makes sense to back port to Py2.7.
      Applied the patches in revision 71030 and r71029. Thanks.

    11. orsenthil
      closed this as completedon Apr 2, 2009
    12. ezio-melotti
      transferred this issue fromon Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Metadata

    Metadata

    Assignees

    Labels

    stdlibStandard Library Python modules in the Lib/ directorytestsTests in the Lib/test dirtype-bugAn unexpected behavior, bug, or error

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions