summaryrefslogtreecommitdiffstats
path: root/Lib/http/cookiejar.py
Commit message (Collapse)AuthorAgeFilesLines
* bpo-38804: Fix REDoS in http.cookiejar (GH-17157) (#17344)Victor Stinner2020-04-031-6/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The regex http.cookiejar.LOOSE_HTTP_DATE_RE was vulnerable to regular expression denial of service (REDoS). LOOSE_HTTP_DATE_RE.match is called when using http.cookiejar.CookieJar to parse Set-Cookie headers returned by a server. Processing a response from a malicious HTTP server can lead to extreme CPU usage and execution will be blocked for a long time. The regex contained multiple overlapping \s* capture groups. Ignoring the ?-optional capture groups the regex could be simplified to \d+-\w+-\d+(\s*\s*\s*)$ Therefore, a long sequence of spaces can trigger bad performance. Matching a malicious string such as LOOSE_HTTP_DATE_RE.match("1-c-1" + (" " * 2000) + "!") caused catastrophic backtracking. The fix removes ambiguity about which \s* should match a particular space. You can create a malicious server which responds with Set-Cookie headers to attack all python programs which access it e.g. from http.server import BaseHTTPRequestHandler, HTTPServer def make_set_cookie_value(n_spaces): spaces = " " * n_spaces expiry = f"1-c-1{spaces}!" return f"b;Expires={expiry}" class Handler(BaseHTTPRequestHandler): def do_GET(self): self.log_request(204) self.send_response_only(204) # Don't bother sending Server and Date n_spaces = ( int(self.path[1:]) # Can GET e.g. /100 to test shorter sequences if len(self.path) > 1 else 65506 # Max header line length 65536 ) value = make_set_cookie_value(n_spaces) for i in range(99): # Not necessary, but we can have up to 100 header lines self.send_header("Set-Cookie", value) self.end_headers() if __name__ == "__main__": HTTPServer(("", 44020), Handler).serve_forever() This server returns 99 Set-Cookie headers. Each has 65506 spaces. Extracting the cookies will pretty much never complete. Vulnerable client using the example at the bottom of https://docs.python.org/3/library/http.cookiejar.html : import http.cookiejar, urllib.request cj = http.cookiejar.CookieJar() opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj)) r = opener.open("http://localhost:44020/") The popular requests library was also vulnerable without any additional options (as it uses http.cookiejar by default): import requests requests.get("http://localhost:44020/") * Regression test for http.cookiejar REDoS If we regress, this test will take a very long time. * Improve performance of http.cookiejar.ISO_DATE_RE A string like "444444" + (" " * 2000) + "A" could cause poor performance due to the 2 overlapping \s* groups, although this is not as serious as the REDoS in LOOSE_HTTP_DATE_RE was. (cherry picked from commit 1b779bfb8593739b11cbb988ef82a883ec9d077e) Co-authored-by: bcaller <bcaller@users.noreply.github.com>
* [3.5] bpo-35121: prefix dot in domain for proper subdomain validation ↵Xtreak2019-03-171-2/+11
| | | | | | | | (GH-10258) (#12281) Don't send cookies of domain A without Domain attribute to domain B when domain A is a suffix match of domain B while using a cookiejar with `http.cookiejar.DefaultCookiePolicy` policy. Patch by Karthikeyan Singaravelan. (cherry picked from commit ca7fe5063593958e5efdf90f068582837f07bd14) Co-authored-by: Xtreak <tir.karthi@gmail.com>
* bpo-35647: Fix path check in cookiejar (#11436) (#12277)Xtreak2019-03-161-5/+9
| | | | | | | | | | | | | * Refactor cookie path check as per RFC 6265 * Add tests for prefix match of path * Add news entry * Fix set_ok_path and refactor tests * Use slice for last letter (cherry picked from commit 0e1f1f01058bd4a9b98cfe443214adecc019a38c)
* Issue 19504: Change "customise" to "customize" American spelling.Raymond Hettinger2016-08-261-1/+1
|
* Issue #27466: Change time format returned by http.cookie.time2netscape,Senthil Kumaran2016-07-101-1/+1
| | | | confirming the netscape cookie format.
* Fix typos in comments, documentation and test method namesMartin Panter2016-05-081-1/+1
|
* Issue #16181: cookiejar.http2time() now returns None if year is higher than ↵Berker Peksag2016-03-141-1/+4
| | | | datetime.MAXYEAR
* Merge typo and grammar fixes from 3.4 into 3.5Martin Panter2015-11-141-4/+4
|\
| * Correct Content-Type syntax in documentationMartin Panter2015-11-141-4/+4
| |
* | Issue #25523: Merge a-to-an corrections from 3.4.Serhiy Storchaka2015-11-021-1/+1
|\ \ | |/
| * Issue #25523: Further a-to-an corrections.Serhiy Storchaka2015-11-021-1/+1
| |
* | Issue #23888: Handle fractional time in cookie expiry. Patch by ssh.Robert Collins2015-08-031-1/+1
|\ \ | |/
| * Issue #23888: Handle fractional time in cookie expiry. Patch by ssh.Robert Collins2015-08-031-1/+1
| |
* | Issue #22831: Use "with" to avoid possible fd leaks.Serhiy Storchaka2015-04-041-1/+0
| |
* | Issue #23138: Fixed parsing cookies with absent keys or values in cookiejar.Serhiy Storchaka2015-03-131-15/+31
|\ \ | |/ | | | | Patch by Demian Brecht.
| * Issue #23138: Fixed parsing cookies with absent keys or values in cookiejar.Serhiy Storchaka2015-03-131-15/+31
| | | | | | | | Patch by Demian Brecht.
* | merge 3.4 (#23221)Benjamin Peterson2015-01-131-1/+1
|\ \ | |/
| * fix instances of consecutive articles (closes #23221)Benjamin Peterson2015-01-131-1/+1
| | | | | | | | Patch by Karan Goel.
* | Issue #11957: Explicit parameter name when calling re.split() and re.sub()Victor Stinner2014-10-291-1/+1
| |
* | Issue #22033: Reprs of most Python implemened classes now contain actualSerhiy Storchaka2014-07-251-1/+1
|/ | | | class name instead of hardcoded one.
* Fixed bugs in reprs of CookieJar and multiprocessing.dummy.Value.Serhiy Storchaka2014-07-221-2/+2
|
* merge 3.3 (#20018)Benjamin Peterson2013-12-181-1/+1
|\
| * update url to spec (closes #20018)Benjamin Peterson2013-12-181-1/+1
| |
* | Issue #18200: Back out usage of ModuleNotFoundError (8d28d44f3a9a)Brett Cannon2013-07-041-1/+1
| |
* | Issue #18200: Update the stdlib (except tests) to useBrett Cannon2013-06-141-1/+1
| | | | | | | | ModuleNotFoundError.
* | #17678: Remove the use of a deprecated method http/cookiejar.py. Changing theSenthil Kumaran2013-04-091-1/+1
|\ \ | |/ | | | | | | | | usage of get_origin_req_host() to origin_req_host. Patch by Wei-Cheng Pan
| * #17678: Fix DeprecationWarning in the http/cookiejar.py by changing the usageSenthil Kumaran2013-04-091-1/+1
| | | | | | | | | | | | of get_origin_req_host() to origin_req_host. Patch by Wei-Cheng Pan
* | modernize some modules' code by using with statement around open()Giampaolo Rodola'2013-02-121-12/+3
| |
* | Replace IOError with OSError (#16715)Andrew Svetlov2012-12-251-7/+6
| |
* | more yield fromPhilip Jenvey2012-10-011-2/+1
|/ | | | patch by Serhiy Storchaka
* #15980: merge with 3.2.Ezio Melotti2012-09-211-2/+2
|\
| * #15980: properly escape newlines in docstrings. Patch by Serhiy Storchaka.Ezio Melotti2012-09-211-2/+2
| |
* | Issue #15409: Replace use of deprecated urllib.request.Request methods in ↵Meador Inge2012-07-211-4/+4
|/ | | | | | http.cookijar Patch by Flávio Ribeiro.
* Don’t interpret backslashes in ASCII diagram in a docstringÉric Araujo2011-11-071-1/+1
|
* Remove duplication.Ezio Melotti2011-10-191-1/+1
|
* merge 3.1Victor Stinner2011-03-211-6/+12
|\
| * Issue #5537: Fix time2isoz() and time2netscape() functions of httplib.cookiejarVictor Stinner2011-03-211-6/+12
| | | | | | | | for expiration year greater than 2038 on 32-bit systems.
| * Merged revisions 83370,83372-83374,83384 via svnmerge fromGeorg Brandl2010-08-011-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | svn+ssh://svn.python.org/python/branches/py3k ........ r83370 | georg.brandl | 2010-07-31 23:51:48 +0200 (Sa, 31 Jul 2010) | 5 lines #8198: the Helper class should not save the stdin and stdout objects at import time, rather by default use the current streams like the other APIs that output help. ........ r83372 | georg.brandl | 2010-08-01 00:05:54 +0200 (So, 01 Aug 2010) | 1 line #4007: remove *.a and *.so.X.Y files in "make clean". ........ r83373 | georg.brandl | 2010-08-01 00:11:11 +0200 (So, 01 Aug 2010) | 1 line #5147: revert accidental indentation of header constant for MozillaCookieJar. ........ r83374 | georg.brandl | 2010-08-01 00:32:52 +0200 (So, 01 Aug 2010) | 1 line #5146: handle UID THREAD command correctly. ........ r83384 | georg.brandl | 2010-08-01 08:32:55 +0200 (So, 01 Aug 2010) | 1 line Build properties using lambdas. This makes test_pyclbr pass again, because it does not think that input and output are methods anymore. ........
| * Merged revisions 82985 via svnmerge fromGregory P. Smith2010-07-251-9/+6
| | | | | | | | | | | | | | | | | | | | | | svn+ssh://pythondev@svn.python.org/python/branches/py3k ........ r82985 | gregory.p.smith | 2010-07-19 16:17:22 -0700 (Mon, 19 Jul 2010) | 3 lines Fixes Issue #3704: http.cookiejar was not properly handling URLs with a / in the parameters. (This is jjlee's issue3704.patch ported to py3k) ........
* | #5147: revert accidental indentation of header constant for MozillaCookieJar.Georg Brandl2010-07-311-3/+3
| |
* | Fixes Issue #3704: http.cookiejar was not properly handling URLs with a / inGregory P. Smith2010-07-191-9/+6
| | | | | | | | the parameters. (This is jjlee's issue3704.patch ported to py3k)
* | Merged revisions 81465-81466,81468,81679,81735,81760,81868,82183 via ↵Benjamin Peterson2010-06-271-5/+15
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | svnmerge from svn+ssh://pythondev@svn.python.org/python/trunk ........ r81465 | georg.brandl | 2010-05-22 06:29:19 -0500 (Sat, 22 May 2010) | 2 lines Issue #3924: Ignore cookies with invalid "version" field in cookielib. ........ r81466 | georg.brandl | 2010-05-22 06:31:16 -0500 (Sat, 22 May 2010) | 1 line Underscore the name of an internal utility function. ........ r81468 | georg.brandl | 2010-05-22 06:43:25 -0500 (Sat, 22 May 2010) | 1 line #8635: document enumerate() start parameter in docstring. ........ r81679 | benjamin.peterson | 2010-06-03 16:21:03 -0500 (Thu, 03 Jun 2010) | 1 line use a set for membership testing ........ r81735 | michael.foord | 2010-06-05 06:46:59 -0500 (Sat, 05 Jun 2010) | 1 line Extract error message truncating into a method (unittest.TestCase._truncateMessage). ........ r81760 | michael.foord | 2010-06-05 14:38:42 -0500 (Sat, 05 Jun 2010) | 1 line Issue 8302. SkipTest exception is setUpClass or setUpModule is now reported as a skip rather than an error. ........ r81868 | benjamin.peterson | 2010-06-09 14:45:04 -0500 (Wed, 09 Jun 2010) | 1 line fix code formatting ........ r82183 | benjamin.peterson | 2010-06-23 15:29:26 -0500 (Wed, 23 Jun 2010) | 1 line cpython only gc tests ........
* #2834: Change re module semantics, so that str and bytes mixing is forbidden,Antoine Pitrou2008-08-191-11/+11
| | | | | and str (unicode) patterns get full unicode matching by default. The re.ASCII flag is also introduced to ask for ASCII matching instead.
* Fix old urllib/urllib2/urlparse usage.Georg Brandl2008-06-231-1/+1
|
* Make a new urllib package .Jeremy Hylton2008-06-181-9/+9
| | | | | | | | | | | | | It consists of code from urllib, urllib2, urlparse, and robotparser. The old modules have all been removed. The new package has five submodules: urllib.parse, urllib.request, urllib.response, urllib.error, and urllib.robotparser. The urllib.request.urlopen() function uses the url opener from urllib2. Note that the unittests have not been renamed for the beta, but they will be renamed in the future. Joint work with Senthil Kumaran.
* Patch for issue 2848, mostly by Humberto Diogenes, with a couple ofBarry Warsaw2008-06-121-2/+2
| | | | small fixes by Barry. This removes mimetools from the stdlib.
* Remove _FooCookieJar modules and merge their content into http.cookiejar.Georg Brandl2008-05-261-2/+295
|
* Create http package. #2883.Georg Brandl2008-05-261-0/+1785
generated by cgit v0.12 at 2025-08-26 11:42:41 (GMT)