Skype WISPr and iPassConnect (and maybe other bots) return cookies as a comma separated list. It's not a comma + space (which works). C = cookies.SimpleCookie() C.load('a=b,z=zz') >>> C['a'] <Morsel: a='b,z=zz'> I wonder what would those bots do if there was a comma in a cookie value.
,)" # Ending either at space, semicolon, or EOS. ( or comma...) I remember running into this same problem like 5 years ago. I added a comma as a valid regexp for ending the pattern, and removed it as a valid _LegalKeyChars I also think adding the "Priority" reserved key might make sense (or at least have options for handling it)
This is not a valid cookie string and I think neither Django nor Nginx would understand this cookie correctly. On the other hand, per RFC 6265 the comma is a forbidden character in a cookie value (https://tools.ietf.org/html/rfc6265#section-4.1.1): cookie-pair = cookie-name "=" cookie-value cookie-name = token cookie-value = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE ) cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E ; US-ASCII characters excluding CTLs, ; whitespace DQUOTE, comma, semicolon, ; and backslash so there is no official way to parse the given string (when a comma is present in the value, the cookie should be encoded as base 64). Since this is not a valid cookie string anyway, I think the solution proposed by Kyle is appropriate.
I think making a comma start a new cookie is dangerous, and perhaps this proposal should be rejected. I’m not an expert on web programming, but this reminds me of some security problems that already affected Python: <https://translate.google.com/translate?u=https://habr.com/en/post/272187/>. In a web page, Java Script could set a cookie with a single name and a comma in the value. document.cookie = 'a=b,csrftoken=INJECTED' Currently, Python in the server would parse that the way the script intended: >>> C = BaseCookie('a=b,csrftoken=INJECTED') >>> C['a'].value 'b,csrftoken=INJECTED' >>> C['csrftoken'].value KeyError: 'csrftoken' But with the proposed change, Python would be tricked into parsing it as two separate “morsels”: >>> C['csrftoken'].value 'INJECTED'
