gh-123067: Denial of Service Vulnerability in http.cookies._unquote() #123066
Conversation
| All commit authors signed the Contributor License Agreement. |
| Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
| Oh, I'm sorry for missing to create an issue. |
ch4n3-yoon changed the title http.cookies._unquote()http.cookies._unquote() | Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
picnixz added needs backport to 3.8 needs backport to 3.10 
| @ch4n3-yoon Can you create a news entry for this change with blurb? |
| j = o_match.start(0) | ||
| if q_match: | ||
| k = q_match.start(0) | ||
| if q_match and (not o_match or k < j): # QuotePatt matched |
There was a problem hiding this comment.
This appears to be removing all backslashes from the cookie, where the new behavior is only removing backslashes in front of quotes. Is that what we're expecting to change with this PR?
There was a problem hiding this comment.
From reading the RFC, I think we should preserve the original behavior of unquoting all single-character preceded by a backslash. If you agree, can we add a test case that ensures this behavior is preserved.
serhiy-storchaka left a comment
serhiy-storchaka left a comment There was a problem hiding this comment.
_quate() can produce not only \", but also \\.
Both octal encoding and simple backslash-escaping should be handled at the same pass. Your code produces incorrect value for \134\042.
I created an alternative PR #123075 which handles such cases correctly and has some tests.
| Closing since #123075 was considered instead. |
picnixz removed type-security 4 participants
Summary
Refactor and improve the
_unquote()method inhttp.cookiesto address the performance issues identified in CVE-2024-7592, enhancing the handling of escape sequences to prevent potential DoS vulnerabilities.Changes
Context
This update comes after the Django team acknowledged the potential for a DoS vulnerability within their use of the
http.cookiesmodule. The vulnerability has been formally reserved CVE-2024-7592.Please review these changes and provide your feedback.
http.cookies._unquote()#123067