Jun 7, 2022 · Jun 3, 2022 · Jun 3, 2022
diff --git a/Lib/http/cookiejar.py b/Lib/http/cookiejar.py
            if self.filename is not None: filename = self.filename
            else: raise ValueError(MISSING_FILENAME_TEXT)

        with open(filename,"w") as f:
        withos.fdopen(os.open(filename,os.O_CREAT | os.O_WRONLY, 0o600), 'w') as f:
            # There really isn't an LWP Cookies 2.0 format, but this indicates
            # that there is extra information in here (domain_dot and
            # port_spec) while still being compatible with libwww-perl, I hope.
            if self.filename is not None: filename = self.filename
            else: raise ValueError(MISSING_FILENAME_TEXT)

        with open(filename,"w") as f:
        withos.fdopen(os.open(filename,os.O_CREAT | os.O_WRONLY, 0o600), 'w') as f:
            f.write(NETSCAPE_HEADER_TEXT)
            now = time.time()
            for cookie in self:
diff --git a/Lib/test/test_http_cookiejar.py b/Lib/test/test_http_cookiejar.py
 """Tests for http/cookiejar.py."""

 import os
 import sys
 import re
 import test.support
 from test.support import os_helper
     reach, is_HDN, domain_match, user_domain_match, request_path,
     request_port, request_host)

 mswindows = (sys.platform == "win32")

 class DateTimeTests(unittest.TestCase):

            except OSError: pass
        self.assertEqual(c._cookies["www.acme.com"]["/"]["boo"].value, None)

    @unittest.skipIf(mswindows, "windows file permissions are incompatible with file modes")
    def test_lwp_filepermissions(self):
        # Cookie file should only be readable by the creator
        filename = os_helper.TESTFN
        c = LWPCookieJar()
        interact_netscape(c, "http://www.acme.com/", 'boo')
        try:
            c.save(filename, ignore_discard=True)
            status = os.stat(filename)
            print(status.st_mode)
            self.assertEqual(oct(status.st_mode)[-3:], '600')
        finally:
            try: os.unlink(filename)
            except OSError: pass

    @unittest.skipIf(mswindows, "windows file permissions are incompatible with file modes")
    def test_mozilla_filepermissions(self):
        # Cookie file should only be readable by the creator
        filename = os_helper.TESTFN
        c = MozillaCookieJar()
        interact_netscape(c, "http://www.acme.com/", 'boo')
        try:
            c.save(filename, ignore_discard=True)
            status = os.stat(filename)
            self.assertEqual(oct(status.st_mode)[-3:], '600')
        finally:
            try: os.unlink(filename)
            except OSError: pass

    def test_bad_magic(self):
        # OSErrors (eg. file doesn't exist) are allowed to propagate
        filename = os_helper.TESTFN
diff --git a/Misc/NEWS.d/next/Security/2022-06-03-12-52-53.gh-issue-79096.YVoxgC.rst b/Misc/NEWS.d/next/Security/2022-06-03-12-52-53.gh-issue-79096.YVoxgC.rst
 LWPCookieJar and MozillaCookieJar create files with file mode 600 instead of 644 (Microsoft Windows is not affected)
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1890,7 +1890,7 @@ def save(self, filename=None, ignore_discard=False, ignore_expires=False):
		if self.filename is not None: filename = self.filename
		else: raise ValueError(MISSING_FILENAME_TEXT)

		with open(filename,"w") as f:
		withos.fdopen(os.open(filename,os.O_CREAT \| os.O_WRONLY, 0o600), 'w') as f:
		# There really isn't an LWP Cookies 2.0 format, but this indicates
		# that there is extra information in here (domain_dot and
		# port_spec) while still being compatible with libwww-perl, I hope.
Expand DownExpand Up		@@ -2086,7 +2086,7 @@ def save(self, filename=None, ignore_discard=False, ignore_expires=False):
		if self.filename is not None: filename = self.filename
		else: raise ValueError(MISSING_FILENAME_TEXT)

		with open(filename,"w") as f:
		withos.fdopen(os.open(filename,os.O_CREAT \| os.O_WRONLY, 0o600), 'w') as f:
		f.write(NETSCAPE_HEADER_TEXT)
		now = time.time()
		for cookie in self:
Expand Down
Original file line number	Diff line number	Diff line change
		@@ -1,6 +1,7 @@
		"""Tests for http/cookiejar.py."""

		import os
		import sys
		import re
		import test.support
		from test.support import os_helper
Expand All		@@ -17,6 +18,7 @@
		reach, is_HDN, domain_match, user_domain_match, request_path,
		request_port, request_host)

		mswindows = (sys.platform == "win32")

		class DateTimeTests(unittest.TestCase):

Expand DownExpand Up		@@ -368,6 +370,35 @@ def test_lwp_valueless_cookie(self):
		except OSError: pass
		self.assertEqual(c._cookies["www.acme.com"]["/"]["boo"].value, None)

		@unittest.skipIf(mswindows, "windows file permissions are incompatible with file modes")
		def test_lwp_filepermissions(self):
		# Cookie file should only be readable by the creator
		filename = os_helper.TESTFN
		c = LWPCookieJar()
		interact_netscape(c, "http://www.acme.com/", 'boo')
		try:
		c.save(filename, ignore_discard=True)
		status = os.stat(filename)
		print(status.st_mode)
		self.assertEqual(oct(status.st_mode)[-3:], '600')
		finally:
		try: os.unlink(filename)
		except OSError: pass

		@unittest.skipIf(mswindows, "windows file permissions are incompatible with file modes")
		def test_mozilla_filepermissions(self):
		# Cookie file should only be readable by the creator
		filename = os_helper.TESTFN
		c = MozillaCookieJar()
		interact_netscape(c, "http://www.acme.com/", 'boo')
		try:
		c.save(filename, ignore_discard=True)
		status = os.stat(filename)
		self.assertEqual(oct(status.st_mode)[-3:], '600')
		finally:
		try: os.unlink(filename)
		except OSError: pass

		def test_bad_magic(self):
		# OSErrors (eg. file doesn't exist) are allowed to propagate
		filename = os_helper.TESTFN
Expand Down
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		LWPCookieJar and MozillaCookieJar create files with file mode 600 instead of 644 (Microsoft Windows is not affected)