diff options
| author | Xtreak <tir.karthi@gmail.com> | 2019-03-10 02:09:48 (GMT) |
|---|---|---|
| committer | Ned Deily <nad@python.org> | 2019-03-10 02:09:48 (GMT) |
| commit | ca7fe5063593958e5efdf90f068582837f07bd14 (patch) | |
| tree | e35c37359dcb14d3784a0e177de2a3399cbf1b7a /Lib/test | |
| parent | 738c19f4c5475da186de03e966bd6648e5ced4c4 (diff) | |
| download | cpython-ca7fe5063593958e5efdf90f068582837f07bd14.zip cpython-ca7fe5063593958e5efdf90f068582837f07bd14.tar.gz cpython-ca7fe5063593958e5efdf90f068582837f07bd14.tar.bz2 | |
bpo-35121: prefix dot in domain for proper subdomain validation (GH-10258)
Don't send cookies of domain A without Domain attribute to domain B when domain A is a suffix match of domain B while using a cookiejar with `http.cookiejar.DefaultCookiePolicy` policy. Patch by Karthikeyan Singaravelan.
Diffstat (limited to 'Lib/test')
| -rw-r--r-- | Lib/test/test_http_cookiejar.py | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/Lib/test/test_http_cookiejar.py b/Lib/test/test_http_cookiejar.py index 170549c..acf315a 100644 --- a/Lib/test/test_http_cookiejar.py +++ b/Lib/test/test_http_cookiejar.py @@ -440,6 +440,7 @@ class CookieTests(unittest.TestCase): ("http://foo.bar.com/", ".foo.bar.com", True), ("http://foo.bar.com/", "foo.bar.com", True), ("http://foo.bar.com/", ".bar.com", True), + ("http://foo.bar.com/", "bar.com", True), ("http://foo.bar.com/", "com", True), ("http://foo.com/", "rhubarb.foo.com", False), ("http://foo.com/", ".foo.com", True), @@ -450,6 +451,8 @@ class CookieTests(unittest.TestCase): ("http://foo/", "foo", True), ("http://foo/", "foo.local", True), ("http://foo/", ".local", True), + ("http://barfoo.com", ".foo.com", False), + ("http://barfoo.com", "foo.com", False), ]: request = urllib.request.Request(url) r = pol.domain_return_ok(domain, request) @@ -984,6 +987,33 @@ class CookieTests(unittest.TestCase): c.add_cookie_header(req) self.assertFalse(req.has_header("Cookie")) + c.clear() + + pol.set_blocked_domains([]) + req = urllib.request.Request("http://acme.com/") + res = FakeResponse(headers, "http://acme.com/") + cookies = c.make_cookies(res, req) + c.extract_cookies(res, req) + self.assertEqual(len(c), 1) + + req = urllib.request.Request("http://acme.com/") + c.add_cookie_header(req) + self.assertTrue(req.has_header("Cookie")) + + req = urllib.request.Request("http://badacme.com/") + c.add_cookie_header(req) + self.assertFalse(pol.return_ok(cookies[0], req)) + self.assertFalse(req.has_header("Cookie")) + + p = pol.set_blocked_domains(["acme.com"]) + req = urllib.request.Request("http://acme.com/") + c.add_cookie_header(req) + self.assertFalse(req.has_header("Cookie")) + + req = urllib.request.Request("http://badacme.com/") + c.add_cookie_header(req) + self.assertFalse(req.has_header("Cookie")) + def test_secure(self): for ns in True, False: for whitespace in " ", "": |