diff options
| author | Xtreak <tir.karthi@gmail.com> | 2019-03-10 02:09:48 (GMT) |
|---|---|---|
| committer | Ned Deily <nad@python.org> | 2019-03-10 02:09:48 (GMT) |
| commit | ca7fe5063593958e5efdf90f068582837f07bd14 (patch) | |
| tree | e35c37359dcb14d3784a0e177de2a3399cbf1b7a /Lib/http | |
| parent | 738c19f4c5475da186de03e966bd6648e5ced4c4 (diff) | |
| download | cpython-ca7fe5063593958e5efdf90f068582837f07bd14.zip cpython-ca7fe5063593958e5efdf90f068582837f07bd14.tar.gz cpython-ca7fe5063593958e5efdf90f068582837f07bd14.tar.bz2 | |
bpo-35121: prefix dot in domain for proper subdomain validation (GH-10258)
Don't send cookies of domain A without Domain attribute to domain B when domain A is a suffix match of domain B while using a cookiejar with `http.cookiejar.DefaultCookiePolicy` policy. Patch by Karthikeyan Singaravelan.
Diffstat (limited to 'Lib/http')
| -rw-r--r-- | Lib/http/cookiejar.py | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/Lib/http/cookiejar.py b/Lib/http/cookiejar.py index befe765..3a96383 100644 --- a/Lib/http/cookiejar.py +++ b/Lib/http/cookiejar.py @@ -1148,6 +1148,11 @@ class DefaultCookiePolicy(CookiePolicy): req_host, erhn = eff_request_host(request) domain = cookie.domain + if domain and not domain.startswith("."): + dotdomain = "." + domain + else: + dotdomain = domain + # strict check of non-domain cookies: Mozilla does this, MSIE5 doesn't if (cookie.version == 0 and (self.strict_ns_domain & self.DomainStrictNonDomain) and @@ -1160,7 +1165,7 @@ class DefaultCookiePolicy(CookiePolicy): _debug(" effective request-host name %s does not domain-match " "RFC 2965 cookie domain %s", erhn, domain) return False - if cookie.version == 0 and not ("."+erhn).endswith(domain): + if cookie.version == 0 and not ("."+erhn).endswith(dotdomain): _debug(" request-host %s does not match Netscape cookie domain " "%s", req_host, domain) return False @@ -1174,7 +1179,11 @@ class DefaultCookiePolicy(CookiePolicy): req_host = "."+req_host if not erhn.startswith("."): erhn = "."+erhn - if not (req_host.endswith(domain) or erhn.endswith(domain)): + if domain and not domain.startswith("."): + dotdomain = "." + domain + else: + dotdomain = domain + if not (req_host.endswith(dotdomain) or erhn.endswith(dotdomain)): #_debug(" request domain %s does not match cookie domain %s", # req_host, domain) return False |