147 lines
6.0 KiB
Diff
147 lines
6.0 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
|
|
Date: Mon, 16 Mar 2026 13:43:43 +0000
|
|
Subject: 00484: CVE-2026-3644
|
|
|
|
Incomplete control character validation in http.cookies
|
|
|
|
Co-authored-by: Victor Stinner <victor.stinner@gmail.com>
|
|
---
|
|
Lib/http/cookies.py | 24 ++++++++++--
|
|
Lib/test/test_http_cookies.py | 38 +++++++++++++++++++
|
|
...-03-06-17-03-38.gh-issue-145599.kchwZV.rst | 4 ++
|
|
3 files changed, 62 insertions(+), 4 deletions(-)
|
|
create mode 100644 Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst
|
|
|
|
diff --git a/Lib/http/cookies.py b/Lib/http/cookies.py
|
|
index d0a69cbe19..63d119ad46 100644
|
|
--- a/Lib/http/cookies.py
|
|
+++ b/Lib/http/cookies.py
|
|
@@ -335,9 +335,16 @@ def update(self, values):
|
|
key = key.lower()
|
|
if key not in self._reserved:
|
|
raise CookieError("Invalid attribute %r" % (key,))
|
|
+ if _has_control_character(key, val):
|
|
+ raise CookieError("Control characters are not allowed in "
|
|
+ f"cookies {key!r} {val!r}")
|
|
data[key] = val
|
|
dict.update(self, data)
|
|
|
|
+ def __ior__(self, values):
|
|
+ self.update(values)
|
|
+ return self
|
|
+
|
|
def isReservedKey(self, K):
|
|
return K.lower() in self._reserved
|
|
|
|
@@ -363,9 +370,15 @@ def __getstate__(self):
|
|
}
|
|
|
|
def __setstate__(self, state):
|
|
- self._key = state['key']
|
|
- self._value = state['value']
|
|
- self._coded_value = state['coded_value']
|
|
+ key = state['key']
|
|
+ value = state['value']
|
|
+ coded_value = state['coded_value']
|
|
+ if _has_control_character(key, value, coded_value):
|
|
+ raise CookieError("Control characters are not allowed in cookies "
|
|
+ f"{key!r} {value!r} {coded_value!r}")
|
|
+ self._key = key
|
|
+ self._value = value
|
|
+ self._coded_value = coded_value
|
|
|
|
def output(self, attrs=None, header="Set-Cookie:"):
|
|
return "%s %s" % (header, self.OutputString(attrs))
|
|
@@ -377,13 +390,16 @@ def __repr__(self):
|
|
|
|
def js_output(self, attrs=None):
|
|
# Print javascript
|
|
+ output_string = self.OutputString(attrs)
|
|
+ if _has_control_character(output_string):
|
|
+ raise CookieError("Control characters are not allowed in cookies")
|
|
return """
|
|
<script type="text/javascript">
|
|
<!-- begin hiding
|
|
document.cookie = \"%s\";
|
|
// end hiding -->
|
|
</script>
|
|
- """ % (self.OutputString(attrs).replace('"', r'\"'))
|
|
+ """ % (output_string.replace('"', r'\"'))
|
|
|
|
def OutputString(self, attrs=None):
|
|
# Build up our result
|
|
diff --git a/Lib/test/test_http_cookies.py b/Lib/test/test_http_cookies.py
|
|
index f196bcc48e..2478a6c630 100644
|
|
--- a/Lib/test/test_http_cookies.py
|
|
+++ b/Lib/test/test_http_cookies.py
|
|
@@ -573,6 +573,14 @@ def test_control_characters(self):
|
|
with self.assertRaises(cookies.CookieError):
|
|
morsel["path"] = c0
|
|
|
|
+ # .__setstate__()
|
|
+ with self.assertRaises(cookies.CookieError):
|
|
+ morsel.__setstate__({'key': c0, 'value': 'val', 'coded_value': 'coded'})
|
|
+ with self.assertRaises(cookies.CookieError):
|
|
+ morsel.__setstate__({'key': 'key', 'value': c0, 'coded_value': 'coded'})
|
|
+ with self.assertRaises(cookies.CookieError):
|
|
+ morsel.__setstate__({'key': 'key', 'value': 'val', 'coded_value': c0})
|
|
+
|
|
# .setdefault()
|
|
with self.assertRaises(cookies.CookieError):
|
|
morsel.setdefault("path", c0)
|
|
@@ -587,6 +595,18 @@ def test_control_characters(self):
|
|
with self.assertRaises(cookies.CookieError):
|
|
morsel.set("path", "val", c0)
|
|
|
|
+ # .update()
|
|
+ with self.assertRaises(cookies.CookieError):
|
|
+ morsel.update({"path": c0})
|
|
+ with self.assertRaises(cookies.CookieError):
|
|
+ morsel.update({c0: "val"})
|
|
+
|
|
+ # .__ior__()
|
|
+ with self.assertRaises(cookies.CookieError):
|
|
+ morsel |= {"path": c0}
|
|
+ with self.assertRaises(cookies.CookieError):
|
|
+ morsel |= {c0: "val"}
|
|
+
|
|
def test_control_characters_output(self):
|
|
# Tests that even if the internals of Morsel are modified
|
|
# that a call to .output() has control character safeguards.
|
|
@@ -607,6 +627,24 @@ def test_control_characters_output(self):
|
|
with self.assertRaises(cookies.CookieError):
|
|
cookie.output()
|
|
|
|
+ # Tests that .js_output() also has control character safeguards.
|
|
+ for c0 in support.control_characters_c0():
|
|
+ morsel = cookies.Morsel()
|
|
+ morsel.set("key", "value", "coded-value")
|
|
+ morsel._key = c0 # Override private variable.
|
|
+ cookie = cookies.SimpleCookie()
|
|
+ cookie["cookie"] = morsel
|
|
+ with self.assertRaises(cookies.CookieError):
|
|
+ cookie.js_output()
|
|
+
|
|
+ morsel = cookies.Morsel()
|
|
+ morsel.set("key", "value", "coded-value")
|
|
+ morsel._coded_value = c0 # Override private variable.
|
|
+ cookie = cookies.SimpleCookie()
|
|
+ cookie["cookie"] = morsel
|
|
+ with self.assertRaises(cookies.CookieError):
|
|
+ cookie.js_output()
|
|
+
|
|
|
|
def load_tests(loader, tests, pattern):
|
|
tests.addTest(doctest.DocTestSuite(cookies))
|
|
diff --git a/Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst b/Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst
|
|
new file mode 100644
|
|
index 0000000000..e53a932d12
|
|
--- /dev/null
|
|
+++ b/Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst
|
|
@@ -0,0 +1,4 @@
|
|
+Reject control characters in :class:`http.cookies.Morsel`
|
|
+:meth:`~http.cookies.Morsel.update` and
|
|
+:meth:`~http.cookies.BaseCookie.js_output`.
|
|
+This addresses :cve:`2026-3644`.
|