mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-11-11 22:55:08 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

Strengthen the warning against using SerialCookie and SmartCookie.

Browse source 
(If they're security holes, should they be documented at all?)
Minor rewrites.
This commit is contained in:
Andrew M. Kuchling 2000-08-20 23:33:50 +00:00
parent 6aa92c5093
commit 120beb6b67
1 changed files with 12 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

21
Doc/lib/libcookie.tex
View file

@ -8,22 +8,20 @@
The \module{Cookie} module defines classes for abstracting the concept of The \module{Cookie} module defines classes for abstracting the concept of
Cookies, an HTTP state management mechanism. It supports both simplistic cookies, an HTTP state management mechanism. It supports both simplistic
string-only cookies, and provides an abstraction for having any serializable string-only cookies, and provides an abstraction for having any serializable
data-type as cookie value. data-type as cookie value.
The module formerly strictly applied the parsing rules described in in
the \rfc{2109} and \rfc{2068} specifications. It has since been discovered
that MSIE 3.0x doesn't follow the character rules outlined in those
specs. As a result, the parsing rules used are a bit less strict.
\begin{excdesc}{CookieError} \begin{excdesc}{CookieError}
Exception failing because of \rfc{2109} invalidity: incorrect Exception failing because of \rfc{2109} invalidity: incorrect
attributes, incorrect \code{Set-Cookie} header, etc. attributes, incorrect \code{Set-Cookie} header, etc.
\end{excdesc} \end{excdesc}
This used to be strict parsing based on the \rfc{2109} and \rfc{2068}
specifications. I have since discovered that MSIE 3.0x doesn't
follow the character rules outlined in those specs. As a
result, the parsing rules here are less strict.
\begin{classdesc}{BaseCookie}{\optional{input}} \begin{classdesc}{BaseCookie}{\optional{input}}
This class is a dictionary-like object whose keys are strings and This class is a dictionary-like object whose keys are strings and
whose values are \class{Morsel}s. Note that upon setting a key to whose values are \class{Morsel}s. Note that upon setting a key to
@ -41,8 +39,13 @@ and \method{value_encode} to be the identity and \function{str()} respectively.
\begin{classdesc}{SerialCookie}{\optional{input}} \begin{classdesc}{SerialCookie}{\optional{input}}
This class derives from \class{BaseCookie} and overrides \method{value_decode} This class derives from \class{BaseCookie} and overrides \method{value_decode}
and \method{value_encode} to be the \function{pickle.loads()} and and \method{value_encode} to be the \function{pickle.loads()} and
\function{pickle.dumps}. Note that using this class is a security hole, \function{pickle.dumps}.
as arbitrary client-code can be run on \function{pickle.loads()}.
Do not use this class. Reading pickled values from a cookie is a
security hole, as arbitrary client-code can be run on
\function{pickle.loads()}. It is supported for backwards
compatibility.
\end{classdesc} \end{classdesc}
\begin{classdesc}{SmartCookie}{\optional{input}} \begin{classdesc}{SmartCookie}{\optional{input}}