Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

RFC 6265bis: Truncating cookie values may enable attack #1531

Closed
chlily1 opened this issue Jun 4, 2021 · 5 comments
Closed

RFC 6265bis: Truncating cookie values may enable attack #1531

chlily1 opened this issue Jun 4, 2021 · 5 comments
Assignees
@chlily1
Labels
6265bis

Comments

@chlily1
Copy link
Contributor

chlily1 commented Jun 4, 2021

In #1420, RFC 6265bis was modified to specify truncation of set-cookie-lines at the first {CR, LF, NUL} byte. This is consistent with Chrome's current behavior.

@annevk points out that this may enable an attack where an attacker may inject a CR, LF, or NUL byte into a cookie value to cause its truncation, thus changing the value of the cookie.

Investigate interop/web compatibility and consider rejecting all cookies containing any control character (rather than truncating).
@chlily1 chlily1 added the 6265bis label Jun 4, 2021
@chlily1 chlily1 self-assigned this Jun 4, 2021
@chlily1 chlily1 mentioned this issue Jul 19, 2021
Merged
chlily1 added a commit that referenced this issue Jul 20, 2021
@chlily1
RFC 6265bis: Reject cookies with CTL characters (#1576)
ab8c088 
Reject cookies with any CTL characters, instead of truncating them. Addresses #1531.

Co-authored-by: Lily Chen <chlily@google.com>
chlily1 added a commit that referenced this issue Aug 4, 2021
@chlily1
RFC 6265bis: Exclude HTAB from CTLs that cause cookie rejection
49d816c 
This excludes HTAB (%x09) from the CTL characters that normally cause cookie rejection. HTAB is considered whitespace and is handled separately at a later step in the algorithm. Related to #1531
@chlily1 chlily1 mentioned this issue Aug 4, 2021
Merged
chlily1 added a commit that referenced this issue Aug 5, 2021
@chlily1
RFC 6265bis: Exclude HTAB from CTLs that cause cookie rejection (#1589)
c48d25c 
This excludes HTAB (%x09) from the CTL characters that normally cause cookie rejection. HTAB is considered whitespace and is handled separately at a later step in the algorithm. Related to #1531
@chlily1
Copy link
Contributor Author

chlily1 commented Aug 5, 2021

Addressed by #1576 and #1589.

@chlily1 chlily1 closed this as completed Aug 5, 2021
@annevk
Copy link

annevk commented Aug 6, 2021

Thanks @chlily1! Do you know if tests have been updated as well and implementations bugs have been filed against browsers that do not do this (yet)?

@recvfrom
Copy link
Contributor

recvfrom commented Aug 10, 2021 •
edited

@annevk I just submitted for review an update to the tests, and will soon file bugs based on the findings from running those. I'll post back here with links to any tickets I open. Thanks for asking about this

For reference: web-platform-tests/wpt#29965

@recvfrom
Copy link
Contributor

@annevk FYI, here are the corresponding bugs:

@annevk
Copy link

annevk commented Aug 30, 2021

Thanks @recvfrom for your work on this!

achristensen07 added a commit to achristensen07/wpt that referenced this issue May 2, 2022
@achristensen07
Update document.cookie test to reflect httpwg/http-extensions#1531
07b6c1b 
This should have been included in e87cd77
cdumez pushed a commit to web-platform-tests/wpt that referenced this issue May 2, 2022
@achristensen07
Update document.cookie test to reflect httpwg/http-extensions#1531 (#…
bd1da48 
…33898)

This should have been included in e87cd77
webkit-commit-queue pushed a commit to WebKit/WebKit that referenced this issue May 2, 2022
@achristensen07
Update some wpt tests with control characters in cookies
6fb9f95 
https://bugs.webkit.org/show_bug.cgi?id=239966
<rdar://92300855>

Reviewed by Chris Dumez.

This reflects a change in httpwg/http-extensions#1531

* web-platform-tests/cookies/name/name-ctl-expected.txt:
* web-platform-tests/cookies/name/name-ctl.html:
* web-platform-tests/cookies/resources/cookie-test.js:
* web-platform-tests/cookies/value/value-ctl-expected.txt:
* web-platform-tests/cookies/value/value-ctl.html:
* web-platform-tests/html/dom/documents/resource-metadata-management/document-cookie-expected.txt:
* web-platform-tests/html/dom/documents/resource-metadata-management/document-cookie.html:

Canonical link: https://commits.webkit.org/250188@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293691 268f45cc-cd09-0410-ab3c-d52691b4dbfc
moz-v2v-gh pushed a commit to mozilla/gecko-dev that referenced this issue May 16, 2022
@achristensen07 @moz-wptsync-bot
Bug 1767301 [wpt PR 33898] - Update document.cookie test to reflect h…
14389fe 
…ttps://github.com/httpwg/http…, a=testonly

Automatic update from web-platform-tests
Update document.cookie test to reflect httpwg/http-extensions#1531 (#33898)

This should have been included in e87cd7738787efea77b379fb594a2c3d8a676e9f
--

wpt-commits: bd1da4818624af1b890daf7842a48fbdd6a27a04
wpt-pr: 33898
jamienicol pushed a commit to jamienicol/gecko that referenced this issue May 25, 2022
@achristensen07 @moz-wptsync-bot
Bug 1767301 [wpt PR 33898] - Update document.cookie test to reflect h…
a1117ba 
…ttps://github.com/httpwg/http…, a=testonly

Automatic update from web-platform-tests
Update document.cookie test to reflect httpwg/http-extensions#1531 (#33898)

This should have been included in e87cd7738787efea77b379fb594a2c3d8a676e9f
--

wpt-commits: bd1da4818624af1b890daf7842a48fbdd6a27a04
wpt-pr: 33898
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@chlily1 chlily1

Labels
6265bis
Milestone
No milestone
Development

No branches or pull requests
3 participants
@annevk @recvfrom @chlily1