NotificationsYou must be signed in to change notification settings
Fork33.7k
Star70.4k

Commit2084f94

authored

[3.11]gh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar.save() (GH-93463) (GH-93636)

Note: This change is not effective on Microsoft Windows.Cookies can store sensitive information and should therefore be protectedagainst unauthorized third parties. This is also described in issue#79096.The filesystem permissions are currently set to 644, everyone can read thefile. This commit changes the permissions to 600, only the creater of the filecan read and modify it. This improves security, because it reduces the attacksurface. Now the attacker needs control of the user that created the cookie ora ways to circumvent the filesystems permissions.This change is backwards incompatible. Systems that rely on world-readablecookies will breake. However, one could argue that those are misconfigured inthe first place.Co-authored-by: Łukasz Langa <lukasz@langa.pl>Co-authored-by: Pascal Wittmann <mail@pascal-wittmann.de>Co-authored-by: Christian Heimes <christian@python.org>

1 parent92f8786 commit2084f94Copy full SHA for 2084f94

File tree

3 files changed

+39

-11

lines changed

Lib
- http
  - cookiejar.py
- test
  - test_http_cookiejar.py
Misc/NEWS.d/next/Security
- 2022-06-03-12-52-53.gh-issue-79096.YVoxgC.rst

3 files changed

+39

-11

lines changed

`‎Lib/http/cookiejar.py‎`

Lines changed: 2 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -1890,7 +1890,7 @@ def save(self, filename=None, ignore_discard=False, ignore_expires=False):`
`1890`	`1890`	`ifself.filenameisnotNone:filename=self.filename`
`1891`	`1891`	`else:raiseValueError(MISSING_FILENAME_TEXT)`
`1892`	`1892`
`1893`		`-withopen(filename,"w")asf:`
	`1893`	`+withos.fdopen(os.open(filename,os.O_CREAT\|os.O_WRONLY,0o600),'w')asf:`
`1894`	`1894`	`# There really isn't an LWP Cookies 2.0 format, but this indicates`
`1895`	`1895`	`# that there is extra information in here (domain_dot and`
`1896`	`1896`	`# port_spec) while still being compatible with libwww-perl, I hope.`
`@@ -2086,7 +2086,7 @@ def save(self, filename=None, ignore_discard=False, ignore_expires=False):`
`2086`	`2086`	`ifself.filenameisnotNone:filename=self.filename`
`2087`	`2087`	`else:raiseValueError(MISSING_FILENAME_TEXT)`
`2088`	`2088`
`2089`		`-withopen(filename,"w")asf:`
	`2089`	`+withos.fdopen(os.open(filename,os.O_CREAT\|os.O_WRONLY,0o600),'w')asf:`
`2090`	`2090`	`f.write(NETSCAPE_HEADER_TEXT)`
`2091`	`2091`	`now=time.time()`
`2092`	`2092`	`forcookieinself:`

`‎Lib/test/test_http_cookiejar.py‎`

Lines changed: 36 additions & 9 deletions

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,8 @@`
`1`	`1`	`"""Tests for http/cookiejar.py."""`
`2`	`2`
`3`	`3`	`importos`
	`4`	`+importstat`
	`5`	`+importsys`
`4`	`6`	`importre`
`5`	`7`	`importtest.support`
`6`	`8`	`fromtest.supportimportos_helper`
`@@ -17,6 +19,7 @@`
`17`	`19`	`reach,is_HDN,domain_match,user_domain_match,request_path,`
`18`	`20`	`request_port,request_host)`
`19`	`21`
	`22`	`+mswindows= (sys.platform=="win32")`
`20`	`23`
`21`	`24`	`classDateTimeTests(unittest.TestCase):`
`22`	`25`
`@@ -364,10 +367,37 @@ def test_lwp_valueless_cookie(self):`
`364`	`367`	`c=LWPCookieJar()`
`365`	`368`	`c.load(filename,ignore_discard=True)`
`366`	`369`	`finally:`
`367`		`-try:os.unlink(filename)`
`368`		`-exceptOSError:pass`
	`370`	`+os_helper.unlink(filename)`
`369`	`371`	`self.assertEqual(c._cookies["www.acme.com"]["/"]["boo"].value,None)`
`370`	`372`
	`373`	`+@unittest.skipIf(mswindows,"windows file permissions are incompatible with file modes")`
	`374`	`+@os_helper.skip_unless_working_chmod`
	`375`	`+deftest_lwp_filepermissions(self):`
	`376`	`+# Cookie file should only be readable by the creator`
	`377`	`+filename=os_helper.TESTFN`
	`378`	`+c=LWPCookieJar()`
	`379`	`+interact_netscape(c,"http://www.acme.com/",'boo')`
	`380`	`+try:`
	`381`	`+c.save(filename,ignore_discard=True)`
	`382`	`+st=os.stat(filename)`
	`383`	`+self.assertEqual(stat.S_IMODE(st.st_mode),0o600)`
	`384`	`+finally:`
	`385`	`+os_helper.unlink(filename)`
	`386`	`+`
	`387`	`+@unittest.skipIf(mswindows,"windows file permissions are incompatible with file modes")`
	`388`	`+@os_helper.skip_unless_working_chmod`
	`389`	`+deftest_mozilla_filepermissions(self):`
	`390`	`+# Cookie file should only be readable by the creator`
	`391`	`+filename=os_helper.TESTFN`
	`392`	`+c=MozillaCookieJar()`
	`393`	`+interact_netscape(c,"http://www.acme.com/",'boo')`
	`394`	`+try:`
	`395`	`+c.save(filename,ignore_discard=True)`
	`396`	`+st=os.stat(filename)`
	`397`	`+self.assertEqual(stat.S_IMODE(st.st_mode),0o600)`
	`398`	`+finally:`
	`399`	`+os_helper.unlink(filename)`
	`400`	`+`
`371`	`401`	`deftest_bad_magic(self):`
`372`	`402`	`# OSErrors (eg. file doesn't exist) are allowed to propagate`
`373`	`403`	`filename=os_helper.TESTFN`
`@@ -391,8 +421,7 @@ def test_bad_magic(self):`
`391`	`421`	`c=cookiejar_class()`
`392`	`422`	`self.assertRaises(LoadError,c.load,filename)`
`393`	`423`	`finally:`
`394`		`-try:os.unlink(filename)`
`395`		`-exceptOSError:pass`
	`424`	`+os_helper.unlink(filename)`
`396`	`425`
`397`	`426`	`classCookieTests(unittest.TestCase):`
`398`	`427`	`# XXX`
`@@ -496,7 +525,7 @@ def test_missing_value(self):`
`496`	`525`	`c=MozillaCookieJar(filename)`
`497`	`526`	`c.revert(ignore_expires=True,ignore_discard=True)`
`498`	`527`	`finally:`
`499`		`-os.unlink(c.filename)`
	`528`	`+os_helper.unlink(c.filename)`
`500`	`529`	`# cookies unchanged apart from lost info re. whether path was specified`
`501`	`530`	`self.assertEqual(`
`502`	`531`	`repr(c),`
`@@ -1766,8 +1795,7 @@ def test_rejection(self):`
`1766`	`1795`	`c=LWPCookieJar(policy=pol)`
`1767`	`1796`	`c.load(filename,ignore_discard=True)`
`1768`	`1797`	`finally:`
`1769`		`-try:os.unlink(filename)`
`1770`		`-exceptOSError:pass`
	`1798`	`+os_helper.unlink(filename)`
`1771`	`1799`
`1772`	`1800`	`self.assertEqual(old,repr(c))`
`1773`	`1801`
`@@ -1826,8 +1854,7 @@ def save_and_restore(cj, ignore_discard):`
`1826`	`1854`	`DefaultCookiePolicy(rfc2965=True))`
`1827`	`1855`	`new_c.load(ignore_discard=ignore_discard)`
`1828`	`1856`	`finally:`
`1829`		`-try:os.unlink(filename)`
`1830`		`-exceptOSError:pass`
	`1857`	`+os_helper.unlink(filename)`
`1831`	`1858`	`returnnew_c`
`1832`	`1859`
`1833`	`1860`	`new_c=save_and_restore(c,True)`

`‎Misc/NEWS.d/next/Security/2022-06-03-12-52-53.gh-issue-79096.YVoxgC.rst‎`

Lines changed: 1 addition & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+LWPCookieJar and MozillaCookieJar create files with file mode 600 instead of 644 (Microsoft Windows is not affected)`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Commit2084f94

File tree

3 files changed

3 files changed

`‎Lib/http/cookiejar.py‎`

`‎Lib/test/test_http_cookiejar.py‎`

`‎Misc/NEWS.d/next/Security/2022-06-03-12-52-53.gh-issue-79096.YVoxgC.rst‎`

0 commit comments