Lax cookie parsing in http.cookies could be a security issue when

combined with non-standard cookie handling in some Web browsers.

Reported by Sergey Bobrov.

1 files changed, 9 insertions, 0 deletions

diff --git a/Lib/test/test_cookie.py b/Lib/test/test_cookie.py
index 5370a8d..41ba60f 100644
--- a/Lib/test/test_cookie.py
+++ b/Lib/test/test_cookie.py
@@ -133,6 +133,15 @@ class CookieTests(unittest.TestCase):
         self.assertEqual(C['Customer']['version'], '1')
         self.assertEqual(C['Customer']['path'], '/acme')
 
+    def test_invalid_cookies(self):
+        # Accepting these could be a security issue
+        C = Cookie.SimpleCookie()
+        for s in (']foo=x', '[foo=x', 'blah]foo=x', 'blah[foo=x'):
+            C.load(s)
+            self.assertEqual(dict(C), {})
+            self.assertEqual(C.output(), '')
+
+
 def test_main():
     run_unittest(CookieTests)
     if Cookie.__doc__ is not None: