text: Opened 3 years ago
  Closed 3 years ago
  Last modified 3 years ago
  #26158 closed Bug (fixed)
  cookie parsing fails with python 3.x if request contains unnamed cookie
  Description
  Example:
  from http import cookies good_cookie = 'csrftoken=5lkzK7FCI2iWy2xi7wbZPI7P26qbspIE; django_language=en' print(cookies.parse_cookie(good_cookie)) bad_cookie = 'csrftoken=5lkzK7FCI2iWy2xi7wbZPI7P26qbspIE; unnamed; django_language=en' print(cookies.parse_cookie(bad_cookie))
  Output:
  {'csrftoken': '5lkzK7FCI2iWy2xi7wbZPI7P26qbspIE', 'django_language': 'en'} {}
  This parsing method is used during processing WSGI requests (see: django.core.handlers.wsgi.py)
  If a request contains at least one nameless cookie, then the parser result is an empty dictionary. The nameless cookie may be present in the client (browser) and this cause at least two serious problems for django:
  - django will not see the session cookie (user is asked to login again)
  - csrf validation fails with an error message (csrf cookie not set - because the middleware doesn't see it)
  It worked, btw., with python 2.7.
  Remark:
  Nameless cookies shouldn't happen - but in our case there's a different web application on the parent domain that sometimes sets a nameless cookie. Even though that this is a bug, it makes our django app quite unusable due to the cookie parsing and we'd have to ask the users to constantly delete the cookies on their browsers (or avoid the other app). Those cookies are evil but we have to expect them in real life :/
  Change History (13)
  comment:1 Changed 3 years ago by
  comment:2 Changed 3 years ago by
  Django relies on the python core module http.cookies for parsing the cookie strings. Right now, django apps that run with python 3.x are vulnerable and stop working, if the request contains a nameless cookie. It would be great, if the python devs accepted this as a bug (i.e. ignore unnamed cookies and create all the others instead on none). But there's no guarantee and in the ends, it's not python but our django app (and our clients) that stops working...
  An alternative could be to split the cookie at ';' and load the cookies one by one. As far as I understand, the correct cookies will be created, the unnamed ones ignored.
  So instead of doing
  c.load(cookie)
  something like
  [c.load(_cookie) for _cookie in cookie.split(';')]
  (Just for the idea, don't know if escaped semicolons are allowed in cookie values - but it would do the trick of filtering the unnamed cookies and keeping the correct ones)
  comment:3 Changed 3 years ago by
  As mentioned in the upstream ticket, blindly splitting on
  ; could be a problem because an attacker might sent semicolons inside the cookie itself. Example from upstream:
  name="some;value".
  comment:4 Changed 3 years ago by
  I'll assign this to myself for further investigation.
  comment:5 Changed 3 years ago by
  comment:6 Changed 3 years ago by
  comment:7 Changed 3 years ago by
  It should be safe to hard split on semicolon.
  name="some;value" is not valid, even though it's quoted. I think raw double quotes, commas, semicolons and backslashes are _always_ invalid characters in cookie values.
  From:
  comment:8 Changed 3 years ago by
  Collin proposed to remove Django's reliance on Python's cookie parsing.
  This is likely due to. A related report in Django is #25458, but I transferred it to a Python ticket:. I guess any changes to mitigate this issue should probably handled in Python as well. I'm not sure it can be fixed without reintroduced the security issue fixed in Python, but my understanding of the issue is limited.