From: Yusuf Simonson <simonson@gmail.com>
Date: Wed, 7 Jan 2015 16:01:55 +0000 (-0500)
Subject: Handle bad xsrf tokens more gracefully
X-Git-Tag: v4.1.0b1~32^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7ae9f48542dd98bd89879282833d9c85a1ddc505;p=thirdparty%2Ftornado.git

Handle bad xsrf tokens more gracefully
---

diff --git a/tornado/web.py b/tornado/web.py
index 2d1dac0fd..717518483 100644
--- a/tornado/web.py
+++ b/tornado/web.py
@@ -1124,7 +1124,11 @@ class RequestHandler(object):
         if m:
             version = int(m.group(1))
             if version == 2:
-                _, mask, masked_token, timestamp = cookie.split("|")
+                try:
+                    _, mask, masked_token, timestamp = cookie.split("|")
+                except ValueError:
+                    return None, None, None
+
                 mask = binascii.a2b_hex(utf8(mask))
                 token = _websocket_mask(
                     mask, binascii.a2b_hex(utf8(masked_token)))