Repository navigation
gh-160300: Reject cookies with a negative version in http.cookiejar - #160301
Merged
Merged
Conversation
gpshead
added
needs backport to 3.11
gpshead
marked this pull request as ready for review
October 22, 2026 18:46
JelleZijlstra
approved these changes
Oct 22, 2026
…ejar DefaultCookiePolicy only applied its domain checks to cookies with version 0 or a positive version. ANT-2026-TA36I7V7
Match the domains used by test_negative_version.
gpshead
force-pushed
the
scanfix-cookiejar-ta36i7v7
branch
from
October 25, 2026 06:25
f561420 to
4b129a7
Compare
gpshead
enabled auto-merge (squash)
October 25, 2026 06:36
|
Thanks @gpshead for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11, 3.12, 3.13, 3.14, 3.15. |
|
GH-160645 is a backport of this pull request to the 3.15 branch. |
|
GH-160646 is a backport of this pull request to the 3.14 branch. |
|
GH-160647 is a backport of this pull request to the 3.13 branch. |
|
GH-160648 is a backport of this pull request to the 3.12 branch. |
|
GH-160649 is a backport of this pull request to the 3.11 branch. |
gpshead
added a commit
that referenced
this pull request
Oct 25, 2026
…iejar (GH-160301) (#160645) gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301) DefaultCookiePolicy only applied its domain checks to cookies with version 0 or a positive version. ANT-2026-TA36I7V7 (cherry picked from commit d59d968) Co-authored-by: Gregory P. Smith <[email protected]>
gpshead
added a commit
that referenced
this pull request
Oct 25, 2026
…iejar (GH-160301) (#160646) gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301) DefaultCookiePolicy only applied its domain checks to cookies with version 0 or a positive version. ANT-2026-TA36I7V7 (cherry picked from commit d59d968) Co-authored-by: Gregory P. Smith <[email protected]>
Member
There was a problem hiding this comment.
@gpshead can we please try to include the CVE number in the entry in the future, for people downstream?
Yhg1s
pushed a commit
that referenced
this pull request
Oct 25, 2026
…iejar (GH-160301) (#160647) gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301) DefaultCookiePolicy only applied its domain checks to cookies with version 0 or a positive version. ANT-2026-TA36I7V7 (cherry picked from commit d59d968) Co-authored-by: Gregory P. Smith <[email protected]>
Yhg1s
pushed a commit
that referenced
this pull request
Oct 25, 2026
…iejar (GH-160301) (#160648) gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301) DefaultCookiePolicy only applied its domain checks to cookies with version 0 or a positive version. ANT-2026-TA36I7V7 (cherry picked from commit d59d968) Co-authored-by: Gregory P. Smith <[email protected]>
pablogsal
pushed a commit
that referenced
this pull request
Oct 25, 2026
…iejar (GH-160301) (#160649) gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301) DefaultCookiePolicy only applied its domain checks to cookies with version 0 or a positive version. ANT-2026-TA36I7V7 (cherry picked from commit d59d968) Co-authored-by: Gregory P. Smith <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DefaultCookiePolicyonly applied its domain checks to cookies with version 0 or a positive version, so a cookie with a negativeVersionattribute was accepted for, and returned to, a domain unrelated to the server that set it. Negative versions are now treated as invalid: theSet-Cookieheader is ignored when parsed, like a non-numeric version already is, andset_ok_version()andreturn_ok_version()return false, which also covers cookies added withset_cookie()or loaded from a file saved earlier.ANT-2026-TA36I7V7
http.cookiejarskips domain checks for cookies with a negativeVersion#160300