102 lines
4.5 KiB
Diff
102 lines
4.5 KiB
Diff
diff -uNrp a/Lib/cookielib.py b/Lib/cookielib.py
|
|
--- a/Lib/cookielib.py 2019-12-21 16:06:12.476000000 +0800
|
|
+++ b/Lib/cookielib.py 2019-12-21 16:09:31.556000000 +0800
|
|
@@ -1139,6 +1139,12 @@ class DefaultCookiePolicy(CookiePolicy):
|
|
req_host, erhn = eff_request_host(request)
|
|
domain = cookie.domain
|
|
|
|
+ if domain and not domain.startswith("."):
|
|
+ dotdomain = "." + domain
|
|
+ else:
|
|
+ dotdomain = domain
|
|
+
|
|
+
|
|
# strict check of non-domain cookies: Mozilla does this, MSIE5 doesn't
|
|
if (cookie.version == 0 and
|
|
(self.strict_ns_domain & self.DomainStrictNonDomain) and
|
|
@@ -1151,7 +1157,7 @@ class DefaultCookiePolicy(CookiePolicy):
|
|
_debug(" effective request-host name %s does not domain-match "
|
|
"RFC 2965 cookie domain %s", erhn, domain)
|
|
return False
|
|
- if cookie.version == 0 and not ("."+erhn).endswith(domain):
|
|
+ if cookie.version == 0 and not ("."+erhn).endswith(dotdomain):
|
|
_debug(" request-host %s does not match Netscape cookie domain "
|
|
"%s", req_host, domain)
|
|
return False
|
|
@@ -1165,7 +1171,11 @@ class DefaultCookiePolicy(CookiePolicy):
|
|
req_host = "."+req_host
|
|
if not erhn.startswith("."):
|
|
erhn = "."+erhn
|
|
- if not (req_host.endswith(domain) or erhn.endswith(domain)):
|
|
+ if domain and not domain.startswith("."):
|
|
+ dotdomain = "." + domain
|
|
+ else:
|
|
+ dotdomain = domain
|
|
+ if not (req_host.endswith(dotdomain) or erhn.endswith(dotdomain)):
|
|
#_debug(" request domain %s does not match cookie domain %s",
|
|
# req_host, domain)
|
|
return False
|
|
diff -uNrp a/Lib/test/test_cookielib.py b/Lib/test/test_cookielib.py
|
|
--- a/Lib/test/test_cookielib.py 2019-12-21 16:06:12.640000000 +0800
|
|
+++ b/Lib/test/test_cookielib.py 2019-12-21 16:11:53.888000000 +0800
|
|
@@ -368,6 +368,7 @@ class CookieTests(TestCase):
|
|
("http://foo.bar.com/", ".foo.bar.com", True),
|
|
("http://foo.bar.com/", "foo.bar.com", True),
|
|
("http://foo.bar.com/", ".bar.com", True),
|
|
+ ("http://foo.bar.com/", "bar.com", True),
|
|
("http://foo.bar.com/", "com", True),
|
|
("http://foo.com/", "rhubarb.foo.com", False),
|
|
("http://foo.com/", ".foo.com", True),
|
|
@@ -378,6 +379,8 @@ class CookieTests(TestCase):
|
|
("http://foo/", "foo", True),
|
|
("http://foo/", "foo.local", True),
|
|
("http://foo/", ".local", True),
|
|
+ ("http://barfoo.com", ".foo.com", False),
|
|
+ ("http://barfoo.com", "foo.com", False),
|
|
]:
|
|
request = urllib2.Request(url)
|
|
r = pol.domain_return_ok(domain, request)
|
|
@@ -938,6 +941,34 @@ class CookieTests(TestCase):
|
|
c.add_cookie_header(req)
|
|
self.assertFalse(req.has_header("Cookie"))
|
|
|
|
+ c.clear()
|
|
+
|
|
+ pol.set_blocked_domains([])
|
|
+ req = Request("http://acme.com/")
|
|
+ res = FakeResponse(headers, "http://acme.com/")
|
|
+ cookies = c.make_cookies(res, req)
|
|
+ c.extract_cookies(res, req)
|
|
+ self.assertEqual(len(c), 1)
|
|
+
|
|
+ req = Request("http://acme.com/")
|
|
+ c.add_cookie_header(req)
|
|
+ self.assertTrue(req.has_header("Cookie"))
|
|
+
|
|
+ req = Request("http://badacme.com/")
|
|
+ c.add_cookie_header(req)
|
|
+ self.assertFalse(pol.return_ok(cookies[0], req))
|
|
+ self.assertFalse(req.has_header("Cookie"))
|
|
+
|
|
+ p = pol.set_blocked_domains(["acme.com"])
|
|
+ req = Request("http://acme.com/")
|
|
+ c.add_cookie_header(req)
|
|
+ self.assertFalse(req.has_header("Cookie"))
|
|
+
|
|
+ req = Request("http://badacme.com/")
|
|
+ c.add_cookie_header(req)
|
|
+ self.assertFalse(req.has_header("Cookie"))
|
|
+
|
|
+
|
|
def test_secure(self):
|
|
from cookielib import CookieJar, DefaultCookiePolicy
|
|
|
|
diff -uNrp a/Misc/NEWS.d/next/Security/2019-05-20-00-35-12.bpo-35121.RRi-HU.rst b/Misc/NEWS.d/next/Security/2019-05-20-00-35-12.bpo-35121.RRi-HU.rst
|
|
--- a/Misc/NEWS.d/next/Security/2019-05-20-00-35-12.bpo-35121.RRi-HU.rst 1970-01-01 08:00:00.000000000 +0800
|
|
+++ b/Misc/NEWS.d/next/Security/2019-05-20-00-35-12.bpo-35121.RRi-HU.rst 2019-12-21 16:12:17.416000000 +0800
|
|
@@ -0,0 +1,4 @@
|
|
+Don't send cookies of domain A without Domain attribute to domain B when
|
|
+domain A is a suffix match of domain B while using a cookiejar with
|
|
+:class:`cookielib.DefaultCookiePolicy` policy. Patch by Karthikeyan
|
|
+Singaravelan.
|