]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
gh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar.save() (GH-93463)
authorPascal Wittmann <mail@pascal-wittmann.de>
Tue, 7 Jun 2022 08:11:03 +0000 (10:11 +0200)
committerGitHub <noreply@github.com>
Tue, 7 Jun 2022 08:11:03 +0000 (10:11 +0200)
commitc6f6ede728df144c6c39858f558ea65a2aac7cda
treef7e53a912a6e5fb0cb85d8cabcc92cdb1f26b005
parent57e8ee7086bf3f5c50c901e9d5896275644bbb54
gh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar.save() (GH-93463)

Note: This change is not effective on Microsoft Windows.

Cookies can store sensitive information and should therefore be protected
against unauthorized third parties. This is also described in issue #79096.

The filesystem permissions are currently set to 644, everyone can read the
file. This commit changes the permissions to 600, only the creater of the file
can read and modify it. This improves security, because it reduces the attack
surface. Now the attacker needs control of the user that created the cookie or
a ways to circumvent the filesystems permissions.

This change is backwards incompatible. Systems that rely on world-readable
cookies will breake. However, one could argue that those are misconfigured in
the first place.
Lib/http/cookiejar.py
Lib/test/test_http_cookiejar.py
Misc/NEWS.d/next/Security/2022-06-03-12-52-53.gh-issue-79096.YVoxgC.rst [new file with mode: 0644]