Skip to content

[3.11] gh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar.save() (GH-93463) #93636

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ambv merged 2 commits into from
Jun 9, 2022
Merged

[3.11] gh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar.save() (GH-93463) #93636

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9c5364a
gh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar.save(…
pSub Jun 7, 2022
4619b2e
gh-79096: Fix/improve http cookiejar tests (GH-93614)
tiran Jun 8, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
gh-79096: Fix/improve http cookiejar tests (GH-93614) 
Fixup of GH-93463:
- remove stray print
- use proper way to check file mode
- add working chmod decorator

Co-authored-by: Łukasz Langa <lukasz@langa.pl>
  • Loading branch information
@tiran @ambv
tiran and ambv committed Jun 9, 2022
commit 4619b2eb5071f06dc4de5b7ab849252cf6db3947
32 changes: 14 additions & 18 deletions Lib/test/test_http_cookiejar.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
"""Tests for http/cookiejar.py."""

import os
import stat
import sys
import re
import test.support
Expand Down Expand Up @@ -366,38 +367,36 @@ def test_lwp_valueless_cookie(self):
c = LWPCookieJar()
c.load(filename, ignore_discard=True)
finally:
try: os.unlink(filename)
except OSError: pass
os_helper.unlink(filename)
self.assertEqual(c._cookies["www.acme.com"]["/"]["boo"].value, None)

@unittest.skipIf(mswindows, "windows file permissions are incompatible with file modes")
@os_helper.skip_unless_working_chmod
def test_lwp_filepermissions(self):
# Cookie file should only be readable by the creator
filename = os_helper.TESTFN
c = LWPCookieJar()
interact_netscape(c, "http://www.acme.com/", 'boo')
try:
c.save(filename, ignore_discard=True)
status = os.stat(filename)
print(status.st_mode)
self.assertEqual(oct(status.st_mode)[-3:], '600')
st = os.stat(filename)
self.assertEqual(stat.S_IMODE(st.st_mode), 0o600)
finally:
try: os.unlink(filename)
except OSError: pass
os_helper.unlink(filename)

@unittest.skipIf(mswindows, "windows file permissions are incompatible with file modes")
@os_helper.skip_unless_working_chmod
def test_mozilla_filepermissions(self):
# Cookie file should only be readable by the creator
filename = os_helper.TESTFN
c = MozillaCookieJar()
interact_netscape(c, "http://www.acme.com/", 'boo')
try:
c.save(filename, ignore_discard=True)
status = os.stat(filename)
self.assertEqual(oct(status.st_mode)[-3:], '600')
st = os.stat(filename)
self.assertEqual(stat.S_IMODE(st.st_mode), 0o600)
finally:
try: os.unlink(filename)
except OSError: pass
os_helper.unlink(filename)

def test_bad_magic(self):
# OSErrors (eg. file doesn't exist) are allowed to propagate
Expand All @@ -422,8 +421,7 @@ def test_bad_magic(self):
c = cookiejar_class()
self.assertRaises(LoadError, c.load, filename)
finally:
try: os.unlink(filename)
except OSError: pass
os_helper.unlink(filename)

class CookieTests(unittest.TestCase):
# XXX
Expand Down Expand Up @@ -527,7 +525,7 @@ def test_missing_value(self):
c = MozillaCookieJar(filename)
c.revert(ignore_expires=True, ignore_discard=True)
finally:
os.unlink(c.filename)
os_helper.unlink(c.filename)
# cookies unchanged apart from lost info re. whether path was specified
self.assertEqual(
repr(c),
Expand Down Expand Up @@ -1797,8 +1795,7 @@ def test_rejection(self):
c = LWPCookieJar(policy=pol)
c.load(filename, ignore_discard=True)
finally:
try: os.unlink(filename)
except OSError: pass
os_helper.unlink(filename)

self.assertEqual(old, repr(c))

Expand Down Expand Up @@ -1857,8 +1854,7 @@ def save_and_restore(cj, ignore_discard):
DefaultCookiePolicy(rfc2965=True))
new_c.load(ignore_discard=ignore_discard)
finally:
try: os.unlink(filename)
except OSError: pass
os_helper.unlink(filename)
return new_c

new_c = save_and_restore(c, True)
Expand Down