LWPCookieJar.save() creates *.lwp file in 644 mode

@vadmium

BPO	34915
Nosy	@vadmium, @tirkarthi

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2018-10-06.13:58:56.935>
labels = ['type-security', '3.8', '3.9', 'expert-IO', '3.7', 'library', '3.10']
title = 'LWPCookieJar.save() creates *.lwp file in 644 mode'
updated_at = <Date 2021-03-14.06:38:53.953>
user = 'https://bugs.python.org/aleskva'

bugs.python.org fields:

activity = <Date 2021-03-14.06:38:53.953>
actor = 'martin.panter'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)', 'IO']
creation = <Date 2018-10-06.13:58:56.935>
creator = 'aleskva'
dependencies = []
files = []
hgrepos = []
issue_num = 34915
keywords = []
message_count = 4.0
messages = ['327246', '339126', '341422', '388664']
nosy_count = 3.0
nosy_names = ['martin.panter', 'aleskva', 'xtreak']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue34915'
versions = ['Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']

The LWPCookieJar.save() creates an *.lwp file containing session cookies in non-safe 644 mode (everyone can read it). This is not a secure behavior, especially for storing session keys or session cookies. The file should be created in 600 mode in my opinion.

https://github.com/python/cpython/blob/3.7/Lib/http/cookiejar.py#L1872

I guess this is a good choice and distutils stores .pypirc [0] in this manner that has username and password.

[0]

cpython/Lib/distutils/config.py

Line 45 in 2f54908

with os.fdopen(os.open(rc, os.O_CREAT | os.O_WRONLY, 0o600), 'w') as f:

Martin, any thoughts on this change?

I don't have a strong opinion, but it does seem a sensible change that matches the high-level nature of the "cookiejar" module, with low risk of users relying on the current file permissions. On the other hand, the "curl" command seems to use the default mode when creating a cookies file (in Netscape a.k.a. Mozilla format):

$ curl --cookie-jar cookies https://www.google.com/
[. . .]
$ ls -l cookies
-rw-r--r-- 1 vadmium vadmium 418 Mar 14 17:12 cookies

The MozillaCookieJar class also seems to use the default file mode. I suppose it should be changed as well as the LWP class.

@pablogsal

@pablogsal, let us know if you'd agree for this to still land in 3.11. Otherwise this can be closed.

I'm fine landing this in 3.11 as long as it goes in before next beta

Alright, I'll do the backport now in one commit.

pythongh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar…

pythongh-79096: Fix/improve http cookiejar tests (pythonGH-93614)

[3.11] gh-79096: Protect cookie file created by {LWP,Mozilla}CookieJa…

@pSub

Alright, this is landed to 3.11 and 3.12. Thanks, @pSub! ✨ 🍰 ✨

Revert 30935 defer bpo45162 to 312 (#94285)

pythongh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar…

Navigation Menu

Repository navigation

LWPCookieJar.save() creates *.lwp file in 644 mode #79096

18 remaining items

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

LWPCookieJar.save() creates *.lwp file in 644 mode #79096

Description

Activity

aleskva commented on Oct 6, 2018

tirkarthi commented on Mar 29, 2019

tirkarthi commented on May 5, 2019

vadmium commented on Mar 14, 2021

18 remaining items

ambv commented on Jun 9, 2022

pablogsal commented on Jun 9, 2022

ambv commented on Jun 9, 2022

ambv commented on Jun 9, 2022

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions