aboutsummaryrefslogtreecommitdiff
path: root/Lib/http
diff options
context:
space:
mode:
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>2019-03-09 18:59:28 -0800
committerNed Deily <nad@python.org>2019-03-09 21:59:28 -0500
commitb241af861b37e20ad30533bc0b7e2e5491cc470f (patch)
tree91ad18ba13375a25b7a8dcbef47d51b11d20479a /Lib/http
parentDocument the surprising sideeffect PyErr_Print(). (GH-12081) (GH-12084) (diff)
downloadcpython-b241af861b37e20ad30533bc0b7e2e5491cc470f.tar.gz
cpython-b241af861b37e20ad30533bc0b7e2e5491cc470f.tar.bz2
cpython-b241af861b37e20ad30533bc0b7e2e5491cc470f.zip
bpo-35121: prefix dot in domain for proper subdomain validation (GH-10258) (GH-12260)
Don't send cookies of domain A without Domain attribute to domain B when domain A is a suffix match of domain B while using a cookiejar with `http.cookiejar.DefaultCookiePolicy` policy. Patch by Karthikeyan Singaravelan. (cherry picked from commit ca7fe5063593958e5efdf90f068582837f07bd14) Co-authored-by: Xtreak <tir.karthi@gmail.com>
Diffstat (limited to 'Lib/http')
-rw-r--r--Lib/http/cookiejar.py13
1 files changed, 11 insertions, 2 deletions
diff --git a/Lib/http/cookiejar.py b/Lib/http/cookiejar.py
index adf956d66a0..97599d48d8e 100644
--- a/Lib/http/cookiejar.py
+++ b/Lib/http/cookiejar.py
@@ -1148,6 +1148,11 @@ class DefaultCookiePolicy(CookiePolicy):
req_host, erhn = eff_request_host(request)
domain = cookie.domain
+ if domain and not domain.startswith("."):
+ dotdomain = "." + domain
+ else:
+ dotdomain = domain
+
# strict check of non-domain cookies: Mozilla does this, MSIE5 doesn't
if (cookie.version == 0 and
(self.strict_ns_domain & self.DomainStrictNonDomain) and
@@ -1160,7 +1165,7 @@ class DefaultCookiePolicy(CookiePolicy):
_debug(" effective request-host name %s does not domain-match "
"RFC 2965 cookie domain %s", erhn, domain)
return False
- if cookie.version == 0 and not ("."+erhn).endswith(domain):
+ if cookie.version == 0 and not ("."+erhn).endswith(dotdomain):
_debug(" request-host %s does not match Netscape cookie domain "
"%s", req_host, domain)
return False
@@ -1174,7 +1179,11 @@ class DefaultCookiePolicy(CookiePolicy):
req_host = "."+req_host
if not erhn.startswith("."):
erhn = "."+erhn
- if not (req_host.endswith(domain) or erhn.endswith(domain)):
+ if domain and not domain.startswith("."):
+ dotdomain = "." + domain
+ else:
+ dotdomain = domain
+ if not (req_host.endswith(dotdomain) or erhn.endswith(dotdomain)):
#_debug(" request domain %s does not match cookie domain %s",
# req_host, domain)
return False