As noted in the comments of#22758 by Georg Brandle: * Django uses __init__(str()) roundtripping, which is not explicitly supported by the library, and worked by accident with previous versions.  That it works again with 3.3+ is another accident, and a bug.(The change for#16611 reintroduces "lax" parsing behavior that the security fix [1] was supposed to prevent.)[1]https://hg.python.org/cpython/rev/d3663a0f97ed

This test still exists, so the change didn't cause it to trigger.  What is the security bug?  The commit doesn't say, and doesn't reference an issue number.  So if that test still passes, what's the bug?

Well, with this change you can again (e.g.) pass"Set-cookie: foo=bar"which isn't a valid cookie.  It doesn't reintroduce the same vulnerability, but it will still silently consume invalid cookies (i.e. such with attribute-like tokens upfront) and return a seemingly valid one.IMO this is questionable behavior of the kind that can enable exploits, which is also why it was disallowed by the fix of the first vulnerability.

The security issue isn't easy to explain, it involves an elaborated set of services (browser, Web site...) each having a slightly different notion of cookie parsing to mount an attack allowing to bypass CSRF protection on certain Python-powered frameworks. It's from a report made tosecurity@p.o.

This qualification isn't really accurate:> The change for#16611 reintroduces "lax" parsing behavior that the security fix [1] was supposed to preventsince the#16611 changes were committed *before* the security fix.

Note thatf81846c2b746 adds an explicit test for acceptance of invalid cookie strings ("test_bad_attrs").

These are unknown attributes after a key=value pair.  What this issue is about is accepting attributes *before* any key=value pair.

Well, if we want to become stricter, I don't it makes sense to stop at the middle of the road.In any case, here is a patch enabling strict parsing.

Django's test suite passes with the proposed patch after some updates:https://github.com/django/django/pull/3455

The patch looks good.  One nit, please change "items" to "typed_items" or somesuch.  That will make it clear why there are 3-tuples instead of the traditional 2-tuple used for normal mappings.

Paul, Tim, do you think there's a real risk of regression with the proposed patch?

Security-wise? I don't know, I haven't really been in the loop on the original issue.

No, I meant functionality-wise.

Django's test suite doesn't reveal any regressions. All the changes there are expected as far as I can see.

New changeseta065ab1c67a8 by Antoine Pitrou in branch 'default':Issue#22796: HTTP cookie parsing is now stricter, in order to protect against potential injection attacks.https://hg.python.org/cpython/rev/a065ab1c67a8

Thank you, I've committed the patch to 3.5 now.