jamur2
commented
9 years ago This is partially the fault of https://github.com/zopefoundation/zope.publisher/pull/2 which was a hack that is way too tightly coupled to the stdlib Cookie internals.
Even with that change backed out (or updated to work with the latest Python releases), the stricter cookie implementation changed behavior between 2.7.8 and 2.7.9 (and presumably between 3.3.5 and 3.3.6 as well), so existing tests will probably need to be updated with a stricter cookie string (and cookies that were accepted even before LenientCookie would stop being accepted--although that may be considered a security feature):
Python 2.7.8:
>>> import Cookie
>>> Cookie.SimpleCookie('foo=bar; path=/; spam="eggs", this="Should be fine"')
<SimpleCookie: foo='bar' spam='eggs' this='Should be fine'>Python 2.7.9
>>> import Cookie
>>> Cookie.SimpleCookie('foo=bar; path=/; spam="eggs", this="Should be fine"')
<SimpleCookie: foo='bar'>The LenientCookie was an attempt to follow "Practicality Beats Purity" and "Be conservative in what you do, be liberal in what you accept from others", because we were seeing bogus (but not malicious) cookies being set by 3rd parties that were breaking sessions on some sites by invalidating all cookies. If this is a real security concern (as https://hg.python.org/cpython/rev/9e765e65e5cb makes it look), maybe it's not worth trying to be accepting of invalid cookies (although one might consider setting an invalid cookie a denial of service attack against browser sessions I guess).
I dunno, I won't be too sad if LenientCookie got ripped out and we updated our tests to include only valid cookies as defined by the latest Python Cookie module implementation. @freddrake?
mgedmin
tseaver
tox -e py33: