Lax cookie parsing in http.cookies could be a security issue when combined

with non-standard cookie handling in some Web browsers.

Reported by Sergey Bobrov.

1 files changed, 9 insertions, 0 deletions

diff --git a/Lib/test/test_http_cookies.py b/Lib/test/test_http_cookies.py
index 1f1ca58..30d4898 100644
--- a/Lib/test/test_http_cookies.py
+++ b/Lib/test/test_http_cookies.py
@@ -132,6 +132,15 @@ class CookieTests(unittest.TestCase):
         </script>
         """)
 
+    def test_invalid_cookies(self):
+        # Accepting these could be a security issue
+        C = cookies.SimpleCookie()
+        for s in (']foo=x', '[foo=x', 'blah]foo=x', 'blah[foo=x'):
+            C.load(s)
+            self.assertEqual(dict(C), {})
+            self.assertEqual(C.output(), '')
+
+
 class MorselTests(unittest.TestCase):
     """Tests for the Morsel object."""