mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-04 08:59:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

#9824: encode , and ; in cookie values so that browsers don't split on them

Browse source 
There is a small chance of backward incompatibility here, but only for
non-SimpleCookie applications reading SimpleCookie generated cookies.  Even
then, any such ap is likely to be handling escaped values already, and it would
take a fairly perverse implementation of unescaping to fail to unescape these
newly escaped chars, so the risk seems minimal.
This commit is contained in:
R. David Murray 2010-12-28 18:54:13 +00:00
parent 8aa7e999b5
commit e05ca2aff4
3 changed files with 16 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
Lib/http/cookies.py
View file

@ -173,6 +173,11 @@ _Translator = {
'\033' : '\\033', '\034' : '\\034', '\035' : '\\035',
'\036' : '\\036', '\037' : '\\037',
# Because of the way browsers really handle cookies (as opposed
# to what the RFC says) we also encode , and ;
',' : '\\054', ';' : '\\073',
'"' : '\\"', '\\' : '\\\\',
'\177' : '\\177', '\200' : '\\200', '\201' : '\\201',