diff options
| author | Pascal Wittmann <mail@pascal-wittmann.de> | 2022-06-07 08:11:03 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-06-07 08:11:03 (GMT) |
| commit | c6f6ede728df144c6c39858f558ea65a2aac7cda (patch) | |
| tree | f7e53a912a6e5fb0cb85d8cabcc92cdb1f26b005 /Misc/NEWS.d/next/Security | |
| parent | 57e8ee7086bf3f5c50c901e9d5896275644bbb54 (diff) | |
| download | cpython-c6f6ede728df144c6c39858f558ea65a2aac7cda.zip cpython-c6f6ede728df144c6c39858f558ea65a2aac7cda.tar.gz cpython-c6f6ede728df144c6c39858f558ea65a2aac7cda.tar.bz2 | |
gh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar.save() (GH-93463)
Note: This change is not effective on Microsoft Windows.
Cookies can store sensitive information and should therefore be protected
against unauthorized third parties. This is also described in issue #79096.
The filesystem permissions are currently set to 644, everyone can read the
file. This commit changes the permissions to 600, only the creater of the file
can read and modify it. This improves security, because it reduces the attack
surface. Now the attacker needs control of the user that created the cookie or
a ways to circumvent the filesystems permissions.
This change is backwards incompatible. Systems that rely on world-readable
cookies will breake. However, one could argue that those are misconfigured in
the first place.
Diffstat (limited to 'Misc/NEWS.d/next/Security')
| -rw-r--r-- | Misc/NEWS.d/next/Security/2022-06-03-12-52-53.gh-issue-79096.YVoxgC.rst | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/Misc/NEWS.d/next/Security/2022-06-03-12-52-53.gh-issue-79096.YVoxgC.rst b/Misc/NEWS.d/next/Security/2022-06-03-12-52-53.gh-issue-79096.YVoxgC.rst new file mode 100644 index 0000000..9ec3335 --- /dev/null +++ b/Misc/NEWS.d/next/Security/2022-06-03-12-52-53.gh-issue-79096.YVoxgC.rst @@ -0,0 +1 @@ +LWPCookieJar and MozillaCookieJar create files with file mode 600 instead of 644 (Microsoft Windows is not affected) |