Martin Panter <[email protected]> added the comment:
The main cause of this behaviour is that whitespace (matching the ASCII RE
“\s”) is treated as separation between cookie “morsels”. It looks like this has
always been the behaviour, but I’m not sure it was intended.
>>> print(BaseCookie('first=morsel second=morsel'))
Set-Cookie: first=morsel
Set-Cookie: second=morsel
This could be a security problem, if an attacker managed to inject a CSRF token
as the second “morsel”. This was mentioned in
<https://translate.google.com/translate?u=https://habr.com/en/post/272187/>.
IMO it would be better to not split off a second morsel. Either keep it as one
long morsel value with spaces in, or skip over it to the next semicolon (;).
The reason why the whole cookie string is lost is due to the behaviour of
cookie morsels without equals signs:
>>> BaseCookie('cookie=lost; ignore').items()
dict_items([])
IMO it would be better to skip over these to the next semicolon as well. It
looks like this is a regression in Python 3.5+ caused by Issue 22796.
----------
nosy: +martin.panter
_______________________________________
Python tracker <[email protected]>
<https://bugs.python.org/issue31456>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe:
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
