[3.8] gh-123067: Fix quadratic complexity in parsing "-quoted cookie … · python/cpython@a77ab24 · GitHub
Skip to content

Commit a77ab24

Browse files
[3.8] gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes (GH-123075) (#123108)
This fixes CVE-2024-7592. (cherry picked from commit 44e4583) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
1 parent b158a76 commit a77ab24

3 files changed

Lines changed: 47 additions & 26 deletions

File tree

Lib/http/cookies.py

Lines changed: 8 additions & 26 deletions

Lib/test/test_http_cookies.py

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
import unittest
66
from http import cookies
77
import pickle
8+
from test import support
89

910

1011
class CookieTests(unittest.TestCase):
@@ -58,6 +59,43 @@ def test_basic(self):
5859
for k, v in sorted(case['dict'].items()):
5960
self.assertEqual(C[k].value, v)
6061

62+
def test_unquote(self):
63+
cases = [
64+
(r'a="b=\""', 'b="'),
65+
(r'a="b=\\"', 'b=\\'),
66+
(r'a="b=\="', 'b=='),
67+
(r'a="b=\n"', 'b=n'),
68+
(r'a="b=\042"', 'b="'),
69+
(r'a="b=\134"', 'b=\\'),
70+
(r'a="b=\377"', 'b=\xff'),
71+
(r'a="b=\400"', 'b=400'),
72+
(r'a="b=\42"', 'b=42'),
73+
(r'a="b=\\042"', 'b=\\042'),
74+
(r'a="b=\\134"', 'b=\\134'),
75+
(r'a="b=\\\""', 'b=\\"'),
76+
(r'a="b=\\\042"', 'b=\\"'),
77+
(r'a="b=\134\""', 'b=\\"'),
78+
(r'a="b=\134\042"', 'b=\\"'),
79+
]
80+
for encoded, decoded in cases:
81+
with self.subTest(encoded):
82+
C = cookies.SimpleCookie()
83+
C.load(encoded)
84+
self.assertEqual(C['a'].value, decoded)
85+
86+
@support.requires_resource('cpu')
87+
def test_unquote_large(self):
88+
n = 10**6
89+
for encoded in r'\\', r'\134':
90+
with self.subTest(encoded):
91+
data = 'a="b=' + encoded*n + ';"'
92+
C = cookies.SimpleCookie()
93+
C.load(data)
94+
value = C['a'].value
95+
self.assertEqual(value[:3], 'b=\\')
96+
self.assertEqual(value[-2:], '\\;')
97+
self.assertEqual(len(value), n + 3)
98+
6199
def test_load(self):
62100
C = cookies.SimpleCookie()
63101
C.load('Customer="WILE_E_COYOTE"; Version=1; Path=/acme')
Lines changed: 1 addition & 0 deletions

0 commit comments

Comments
 (0)