Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

gh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar.save() #93463

Merged
merged 2 commits into from
Jun 7, 2022
Merged

gh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar.save() #93463

merged 2 commits into from
Jun 7, 2022

Commits on Jun 3, 2022

  1. pythongh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar… 

    ….save()

Note: This change is not effective on Microsoft Windows.

Cookies can store sensitive information and should therefore be protected
against unauthorized third parties. This is also described in issue python#79096.

The filesystem permissions are currently set to 644, everyone can read the
file. This commit changes the permissions to 600, only the creater of the file
can read and modify it. This improves security, because it reduces the attack
surface. Now the attacker needs control of the user that created the cookie or
a ways to circumvent the filesystems permissions.

This change is backwards incompatible. Systems that rely on world-readable
cookies will breake. However, one could argue that those are misconfigured in
the first place.
    @pSub
    pSub committed Jun 3, 2022
    Configuration menu
    Copy the full SHA
    ce998c0 View commit details
    Browse the repository at this point in the history

  2. 📜🤖 Added by blurb_it.

    @blurb-it @pSub
    blurb-it[bot] authored and pSub committed Jun 3, 2022
    Configuration menu
    Copy the full SHA
    d590fad View commit details
    Browse the repository at this point in the history