This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: Quote mark breaks http.cookies, Cookie.py processing
Type: behavior Stage:
Components: Library (Lib) Versions: Python 3.5, Python 2.7
process
Status: open Resolution:
Dependencies: Superseder:
Assigned To: Nosy List: Artur Smęt, brayer.benoit, martin.panter
Priority: normal Keywords:

Created on 2016-08-03 12:22 by Artur Smęt, last changed 2022-04-11 14:58 by admin.

Messages (4)
msg271901 - (view) Author: Artur Smęt (Artur Smęt) Date: 2016-08-03 12:22
The problem is similar to https://bugs.python.org/issue22931 with square brackets in cookie values.
Incorrect value is serialized JSON in this case, for example:

>>> from Cookie import SimpleCookie
>>> cookie = SimpleCookie()
>>> cookie.load('a=b; c={"somekey":"value"}; d=e, f=g, some=other')
>>> cookie.output()
'Set-Cookie: a=b'
>>> 

From my tests I figured out that quote mark (") is causing problems.

In fact, according to HTTP specification, cookies can't be JSON objects, but I think that python library shouldn't silently allow incorrect values. Probably incorrect cookies should be skipped, or some exception should be thrown there.
msg271903 - (view) Author: Artur Smęt (Artur Smęt) Date: 2016-08-03 13:03
Problem exists in Chrome for sure (it sends cookies as they are - set with JS for example).

I have two another examples that can make this issue more clear:

>>> from Cookie import SimpleCookie
>>> c = SimpleCookie()
>>> c.load('a=b; c=c"c; d=d')
>>> c.output()
'Set-Cookie: a=b'

Also using escaping and quotes (cookie version 1) works:
>>> c = SimpleCookie()
>>> c.load('a=b; c="c\\"c"; d=d')
>>> c.output()
'Set-Cookie: a=b\r\nSet-Cookie: c="c\\"c"\r\nSet-Cookie: d=d'
>>>
msg271934 - (view) Author: Martin Panter (martin.panter) * (Python committer) Date: 2016-08-04 00:30
If you want to silently skip over invalid cookies by looking for a semicolon, see Issue 25228. For that, I think we need someone to add some more tests and confirm it doesn’t open a security hole.

Also maybe see Issue 22983 and Issue 17340.
msg376289 - (view) Author: Benoît Brayer (brayer.benoit) Date: 2020-09-03 09:29
Please find what Django's devs have done to parse cookies: 

https://github.com/django/django/commit/93a135d111c2569d88d65a3f4ad9e6d9ad291452

I hope this might help to find a solution.
History
Date User Action Args
2022-04-11 14:58:34adminsetgithub: 71861
2020-09-03 09:29:56brayer.benoitsetnosy: + brayer.benoit
messages: + msg376289
2020-09-03 05:18:49martin.panterlinkissue41695 superseder
2016-08-22 12:46:40martin.pantersettitle: Quote mark breaks cookie processing -> Quote mark breaks http.cookies, Cookie.py processing
2016-08-04 00:30:54martin.pantersetnosy: + martin.panter
messages: + msg271934
2016-08-03 13:03:52Artur Smętsetmessages: + msg271903
2016-08-03 12:29:45Artur Smętsetversions: + Python 3.5
2016-08-03 12:22:28Artur Smętcreate