mirror of
https://git.yoctoproject.org/poky
synced 2026-02-11 03:03:02 +01:00
26ab554fd5
Fixes CVE-2018-14647, CVE-2018-20406, CVE-2018-20852, CVE-2019-9636, CVE-2019-9740, and CVE-2019-9747. (From OE-Core rev: 5862716f22ca9f5745d3bca85c6ed0d8c35c437b) Signed-off-by: Dan Tran <dantran@microsoft.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
130 lines
5.6 KiB
Diff
130 lines
5.6 KiB
Diff
From 31c16d62fc762ab87e66e7f47e36dbfcfc8b5224 Mon Sep 17 00:00:00 2001
|
|
From: Xtreak <tir.karthi@gmail.com>
|
|
Date: Sun, 17 Mar 2019 05:33:39 +0530
|
|
Subject: [PATCH] [3.5] bpo-35121: prefix dot in domain for proper subdomain
|
|
validation (GH-10258) (#12281)
|
|
|
|
Don't send cookies of domain A without Domain attribute to domain B when domain A is a suffix match of domain B while using a cookiejar with `http.cookiejar.DefaultCookiePolicy` policy. Patch by Karthikeyan Singaravelan.
|
|
(cherry picked from commit ca7fe5063593958e5efdf90f068582837f07bd14)
|
|
|
|
Co-authored-by: Xtreak <tir.karthi@gmail.com>
|
|
|
|
CVE: CVE-2018-20852
|
|
Upstream-Status: Backport
|
|
[https://github.com/python/cpython/commit/4749f1b69000259e23b4cc6f63c542a9bdc62f1b]
|
|
|
|
Signed-off-by: Dan Tran <dantran@microsoft.com>
|
|
---
|
|
Lib/http/cookiejar.py | 13 ++++++--
|
|
Lib/test/test_http_cookiejar.py | 30 +++++++++++++++++++
|
|
.../2018-10-31-15-39-17.bpo-35121.EgHv9k.rst | 4 +++
|
|
3 files changed, 45 insertions(+), 2 deletions(-)
|
|
create mode 100644 Misc/NEWS.d/next/Security/2018-10-31-15-39-17.bpo-35121.EgHv9k.rst
|
|
|
|
diff --git a/Lib/http/cookiejar.py b/Lib/http/cookiejar.py
|
|
index 6d4572af03..1cc9378ae4 100644
|
|
--- a/Lib/http/cookiejar.py
|
|
+++ b/Lib/http/cookiejar.py
|
|
@@ -1148,6 +1148,11 @@ class DefaultCookiePolicy(CookiePolicy):
|
|
req_host, erhn = eff_request_host(request)
|
|
domain = cookie.domain
|
|
|
|
+ if domain and not domain.startswith("."):
|
|
+ dotdomain = "." + domain
|
|
+ else:
|
|
+ dotdomain = domain
|
|
+
|
|
# strict check of non-domain cookies: Mozilla does this, MSIE5 doesn't
|
|
if (cookie.version == 0 and
|
|
(self.strict_ns_domain & self.DomainStrictNonDomain) and
|
|
@@ -1160,7 +1165,7 @@ class DefaultCookiePolicy(CookiePolicy):
|
|
_debug(" effective request-host name %s does not domain-match "
|
|
"RFC 2965 cookie domain %s", erhn, domain)
|
|
return False
|
|
- if cookie.version == 0 and not ("."+erhn).endswith(domain):
|
|
+ if cookie.version == 0 and not ("."+erhn).endswith(dotdomain):
|
|
_debug(" request-host %s does not match Netscape cookie domain "
|
|
"%s", req_host, domain)
|
|
return False
|
|
@@ -1174,7 +1179,11 @@ class DefaultCookiePolicy(CookiePolicy):
|
|
req_host = "."+req_host
|
|
if not erhn.startswith("."):
|
|
erhn = "."+erhn
|
|
- if not (req_host.endswith(domain) or erhn.endswith(domain)):
|
|
+ if domain and not domain.startswith("."):
|
|
+ dotdomain = "." + domain
|
|
+ else:
|
|
+ dotdomain = domain
|
|
+ if not (req_host.endswith(dotdomain) or erhn.endswith(dotdomain)):
|
|
#_debug(" request domain %s does not match cookie domain %s",
|
|
# req_host, domain)
|
|
return False
|
|
diff --git a/Lib/test/test_http_cookiejar.py b/Lib/test/test_http_cookiejar.py
|
|
index 49c01ae489..e67e6ae780 100644
|
|
--- a/Lib/test/test_http_cookiejar.py
|
|
+++ b/Lib/test/test_http_cookiejar.py
|
|
@@ -417,6 +417,7 @@ class CookieTests(unittest.TestCase):
|
|
("http://foo.bar.com/", ".foo.bar.com", True),
|
|
("http://foo.bar.com/", "foo.bar.com", True),
|
|
("http://foo.bar.com/", ".bar.com", True),
|
|
+ ("http://foo.bar.com/", "bar.com", True),
|
|
("http://foo.bar.com/", "com", True),
|
|
("http://foo.com/", "rhubarb.foo.com", False),
|
|
("http://foo.com/", ".foo.com", True),
|
|
@@ -427,6 +428,8 @@ class CookieTests(unittest.TestCase):
|
|
("http://foo/", "foo", True),
|
|
("http://foo/", "foo.local", True),
|
|
("http://foo/", ".local", True),
|
|
+ ("http://barfoo.com", ".foo.com", False),
|
|
+ ("http://barfoo.com", "foo.com", False),
|
|
]:
|
|
request = urllib.request.Request(url)
|
|
r = pol.domain_return_ok(domain, request)
|
|
@@ -961,6 +964,33 @@ class CookieTests(unittest.TestCase):
|
|
c.add_cookie_header(req)
|
|
self.assertFalse(req.has_header("Cookie"))
|
|
|
|
+ c.clear()
|
|
+
|
|
+ pol.set_blocked_domains([])
|
|
+ req = urllib.request.Request("http://acme.com/")
|
|
+ res = FakeResponse(headers, "http://acme.com/")
|
|
+ cookies = c.make_cookies(res, req)
|
|
+ c.extract_cookies(res, req)
|
|
+ self.assertEqual(len(c), 1)
|
|
+
|
|
+ req = urllib.request.Request("http://acme.com/")
|
|
+ c.add_cookie_header(req)
|
|
+ self.assertTrue(req.has_header("Cookie"))
|
|
+
|
|
+ req = urllib.request.Request("http://badacme.com/")
|
|
+ c.add_cookie_header(req)
|
|
+ self.assertFalse(pol.return_ok(cookies[0], req))
|
|
+ self.assertFalse(req.has_header("Cookie"))
|
|
+
|
|
+ p = pol.set_blocked_domains(["acme.com"])
|
|
+ req = urllib.request.Request("http://acme.com/")
|
|
+ c.add_cookie_header(req)
|
|
+ self.assertFalse(req.has_header("Cookie"))
|
|
+
|
|
+ req = urllib.request.Request("http://badacme.com/")
|
|
+ c.add_cookie_header(req)
|
|
+ self.assertFalse(req.has_header("Cookie"))
|
|
+
|
|
def test_secure(self):
|
|
for ns in True, False:
|
|
for whitespace in " ", "":
|
|
diff --git a/Misc/NEWS.d/next/Security/2018-10-31-15-39-17.bpo-35121.EgHv9k.rst b/Misc/NEWS.d/next/Security/2018-10-31-15-39-17.bpo-35121.EgHv9k.rst
|
|
new file mode 100644
|
|
index 0000000000..d2eb8f1f35
|
|
--- /dev/null
|
|
+++ b/Misc/NEWS.d/next/Security/2018-10-31-15-39-17.bpo-35121.EgHv9k.rst
|
|
@@ -0,0 +1,4 @@
|
|
+Don't send cookies of domain A without Domain attribute to domain B
|
|
+when domain A is a suffix match of domain B while using a cookiejar
|
|
+with :class:`http.cookiejar.DefaultCookiePolicy` policy. Patch by
|
|
+Karthikeyan Singaravelan.
|
|
--
|
|
2.22.0.vfs.1.1.57.gbaf16c8
|
|
|