diff options
author | 2019-03-09 18:59:28 -0800 | |
---|---|---|
committer | 2019-03-09 21:59:28 -0500 | |
commit | b241af861b37e20ad30533bc0b7e2e5491cc470f (patch) | |
tree | 91ad18ba13375a25b7a8dcbef47d51b11d20479a /Lib/http | |
parent | Document the surprising sideeffect PyErr_Print(). (GH-12081) (GH-12084) (diff) | |
download | cpython-b241af861b37e20ad30533bc0b7e2e5491cc470f.tar.gz cpython-b241af861b37e20ad30533bc0b7e2e5491cc470f.tar.bz2 cpython-b241af861b37e20ad30533bc0b7e2e5491cc470f.zip |
bpo-35121: prefix dot in domain for proper subdomain validation (GH-10258) (GH-12260)
Don't send cookies of domain A without Domain attribute to domain B when domain A is a suffix match of domain B while using a cookiejar with `http.cookiejar.DefaultCookiePolicy` policy. Patch by Karthikeyan Singaravelan.
(cherry picked from commit ca7fe5063593958e5efdf90f068582837f07bd14)
Co-authored-by: Xtreak <tir.karthi@gmail.com>
Diffstat (limited to 'Lib/http')
-rw-r--r-- | Lib/http/cookiejar.py | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/Lib/http/cookiejar.py b/Lib/http/cookiejar.py index adf956d66a0..97599d48d8e 100644 --- a/Lib/http/cookiejar.py +++ b/Lib/http/cookiejar.py @@ -1148,6 +1148,11 @@ class DefaultCookiePolicy(CookiePolicy): req_host, erhn = eff_request_host(request) domain = cookie.domain + if domain and not domain.startswith("."): + dotdomain = "." + domain + else: + dotdomain = domain + # strict check of non-domain cookies: Mozilla does this, MSIE5 doesn't if (cookie.version == 0 and (self.strict_ns_domain & self.DomainStrictNonDomain) and @@ -1160,7 +1165,7 @@ class DefaultCookiePolicy(CookiePolicy): _debug(" effective request-host name %s does not domain-match " "RFC 2965 cookie domain %s", erhn, domain) return False - if cookie.version == 0 and not ("."+erhn).endswith(domain): + if cookie.version == 0 and not ("."+erhn).endswith(dotdomain): _debug(" request-host %s does not match Netscape cookie domain " "%s", req_host, domain) return False @@ -1174,7 +1179,11 @@ class DefaultCookiePolicy(CookiePolicy): req_host = "."+req_host if not erhn.startswith("."): erhn = "."+erhn - if not (req_host.endswith(domain) or erhn.endswith(domain)): + if domain and not domain.startswith("."): + dotdomain = "." + domain + else: + dotdomain = domain + if not (req_host.endswith(dotdomain) or erhn.endswith(dotdomain)): #_debug(" request domain %s does not match cookie domain %s", # req_host, domain) return False |