#26158: cookie parsing fails with python 3.x if request contains unnamed cookie
--------------------------------+--------------------------------------
Reporter: Treverix | Owner: nobody
Type: Bug | Status: new
Component: HTTP handling | Version: 1.8
Severity: Normal | Resolution:
Keywords: cookie python3 | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
--------------------------------+--------------------------------------
Comment (by Treverix):
Django relies on the python core module http.cookies for parsing the
cookie strings. Right now, django apps that run with python 3.x are
vulnerable and stop working, if the request contains a nameless cookie. It
would be great, if the python devs accepted this as a bug (i.e. ignore
unnamed cookies and create all the others instead on none). But there's no
guarantee and in the ends, it's not python but our django app (and our
clients) that stops working...
An alternative could be to split the cookie at ';' and load the cookies
one by one. As far as I understand, the correct cookies will be created,
the unnamed ones ignored.
So instead of doing
{{{#!python
c.load(cookie)
}}}
something like
{{{#!python
[c.load(_cookie) for _cookie in cookie.split(';')]
}}}
(Just for the idea, don't know if escaped semicolons are allowed in cookie
values - but it would do the trick of filtering the unnamed cookies and
keeping the correct ones)
--
Ticket URL: <https://code.djangoproject.com/ticket/26158#comment:2>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/066.b137f8a8932faecd5088a6962621ea8d%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
