Message 334414 - Python tracker (original) (raw)

The main cause of this behaviour is that whitespace (matching the ASCII RE “\s”) is treated as separation between cookie “morsels”. It looks like this has always been the behaviour, but I’m not sure it was intended.

print(BaseCookie('first=morsel second=morsel')) Set-Cookie: first=morsel Set-Cookie: second=morsel

This could be a security problem, if an attacker managed to inject a CSRF token as the second “morsel”. This was mentioned in <https://translate.google.com/translate?u=https://habr.com/en/post/272187/>.

IMO it would be better to not split off a second morsel. Either keep it as one long morsel value with spaces in, or skip over it to the next semicolon (;).

The reason why the whole cookie string is lost is due to the behaviour of cookie morsels without equals signs:

BaseCookie('cookie=lost; ignore').items() dict_items([])

IMO it would be better to skip over these to the next semicolon as well. It looks like this is a regression in Python 3.5+ caused by Issue 22796.