Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

gh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar.save()#93463

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
ambv merged 2 commits intopython:mainfrompSub:cookiejar-protect-cookie-file
Jun 7, 2022
Merged
Show file tree
Hide file tree
Changes from1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
NextNext commit
gh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar.save()
Note: This change is not effective on Microsoft Windows.Cookies can store sensitive information and should therefore be protectedagainst unauthorized third parties. This is also described in issue#79096.The filesystem permissions are currently set to 644, everyone can read thefile. This commit changes the permissions to 600, only the creater of the filecan read and modify it. This improves security, because it reduces the attacksurface. Now the attacker needs control of the user that created the cookie ora ways to circumvent the filesystems permissions.This change is backwards incompatible. Systems that rely on world-readablecookies will breake. However, one could argue that those are misconfigured inthe first place.
  • Loading branch information
@pSub
pSub committedJun 3, 2022
commitce998c010a1524030687e180377e36a997b33162
4 changes: 2 additions & 2 deletionsLib/http/cookiejar.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -1890,7 +1890,7 @@ def save(self, filename=None, ignore_discard=False, ignore_expires=False):
if self.filename is not None: filename = self.filename
else: raise ValueError(MISSING_FILENAME_TEXT)

with open(filename,"w") as f:
withos.fdopen(os.open(filename,os.O_CREAT | os.O_WRONLY, 0o600), 'w') as f:
# There really isn't an LWP Cookies 2.0 format, but this indicates
# that there is extra information in here (domain_dot and
# port_spec) while still being compatible with libwww-perl, I hope.
Expand DownExpand Up@@ -2086,7 +2086,7 @@ def save(self, filename=None, ignore_discard=False, ignore_expires=False):
if self.filename is not None: filename = self.filename
else: raise ValueError(MISSING_FILENAME_TEXT)

with open(filename,"w") as f:
withos.fdopen(os.open(filename,os.O_CREAT | os.O_WRONLY, 0o600), 'w') as f:
f.write(NETSCAPE_HEADER_TEXT)
now = time.time()
for cookie in self:
Expand Down
31 changes: 31 additions & 0 deletionsLib/test/test_http_cookiejar.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
"""Tests for http/cookiejar.py."""

import os
import sys
import re
import test.support
from test.support import os_helper
Expand All@@ -17,6 +18,7 @@
reach, is_HDN, domain_match, user_domain_match, request_path,
request_port, request_host)

mswindows = (sys.platform == "win32")

class DateTimeTests(unittest.TestCase):

Expand DownExpand Up@@ -368,6 +370,35 @@ def test_lwp_valueless_cookie(self):
except OSError: pass
self.assertEqual(c._cookies["www.acme.com"]["/"]["boo"].value, None)

@unittest.skipIf(mswindows, "windows file permissions are incompatible with file modes")
def test_lwp_filepermissions(self):
# Cookie file should only be readable by the creator
filename = os_helper.TESTFN
c = LWPCookieJar()
interact_netscape(c, "http://www.acme.com/", 'boo')
try:
c.save(filename, ignore_discard=True)
status = os.stat(filename)
print(status.st_mode)
self.assertEqual(oct(status.st_mode)[-3:], '600')
finally:
try: os.unlink(filename)
except OSError: pass

@unittest.skipIf(mswindows, "windows file permissions are incompatible with file modes")
def test_mozilla_filepermissions(self):
# Cookie file should only be readable by the creator
filename = os_helper.TESTFN
c = MozillaCookieJar()
interact_netscape(c, "http://www.acme.com/", 'boo')
try:
c.save(filename, ignore_discard=True)
status = os.stat(filename)
self.assertEqual(oct(status.st_mode)[-3:], '600')
finally:
try: os.unlink(filename)
except OSError: pass

def test_bad_magic(self):
# OSErrors (eg. file doesn't exist) are allowed to propagate
filename = os_helper.TESTFN
Expand Down

[8]ページ先頭

©2009-2025 Movatter.jp