SimpleCookie fails to parse any cookie if an entry has whitespace in the name

[AdamDavis]

BPO	31456
Nosy	@vadmium, @infinitewarp, @remilapeyre

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2017-09-13.18:46:23.437>
labels = ['type-bug', 'library']
title = 'SimpleCookie fails to parse any cookie if an entry has whitespace in the name'
updated_at = <Date 2019-11-29.06:58:01.169>
user = 'https://bugs.python.org/AdamDavis'

bugs.python.org fields:

activity = <Date 2019-11-29.06:58:01.169>
actor = 'Joel Rosdahl'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2017-09-13.18:46:23.437>
creator = 'Adam Davis'
dependencies = []
files = []
hgrepos = []
issue_num = 31456
keywords = []
message_count = 5.0
messages = ['302105', '304102', '304104', '334414', '334472']
nosy_count = 5.0
nosy_names = ['martin.panter', 'Adam Davis', 'infinitewarp', 'remi.lapeyre', 'Joel Rosdahl']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue31456'
versions = ['Python 3.6']

[AdamDavis]

>>> cookie_string = "ASDF=stuff; ASDF space=more stuff"
>>> cookie = SimpleCookie()
>>> cookie.load(cookie_string)
>>> cookie.items()
dict_items([])
>>> cookie_string = "ASDF=stuff"
>>> cookie.load(cookie_string)
>>> cookie.items()
dict_items([('ASDF', <Morsel: ASDF=stuff>)])```

cookie.load should throw an error, or at least parse the cookies it can parse.

[infinitewarp]

According to RFC-6265 (which also references RFC-2616 to define "tokens"), the space character (and whitespace in general) is not valid in cookie-names or cookie-values.

RFC-6265: https://tools.ietf.org/html/rfc6265#section-4.1.1
RFC-2616: https://tools.ietf.org/html/rfc2616#section-2.2

I think it's reasonable for Python to quietly throw away malformed NAME=VALUE pairs since web browsers are likely doing the same.

[AdamDavis]

Quietly throw out the one bad value, sure. You lose all cookies in your cookie string in this scenario.

I'd expect "ASDF=stuff; ASDF space=more stuff" to at least kick out the values that are legal.

[vadmium]

The main cause of this behaviour is that whitespace (matching the ASCII RE “\s”) is treated as separation between cookie “morsels”. It looks like this has always been the behaviour, but I’m not sure it was intended.

>>> print(BaseCookie('first=morsel second=morsel'))
Set-Cookie: first=morsel
Set-Cookie: second=morsel

This could be a security problem, if an attacker managed to inject a CSRF token as the second “morsel”. This was mentioned in <https://translate.google.com/translate?u=https://habr.com/en/post/272187/\>.

IMO it would be better to not split off a second morsel. Either keep it as one long morsel value with spaces in, or skip over it to the next semicolon (;).

The reason why the whole cookie string is lost is due to the behaviour of cookie morsels without equals signs:

>>> BaseCookie('cookie=lost; ignore').items()
dict_items([])

IMO it would be better to skip over these to the next semicolon as well. It looks like this is a regression in Python 3.5+ caused by bpo-22796.

[remilapeyre]

It may be relevant: Ruby accept whitespaces in the name of the morsel:

➜ ~ irb
irb(main):002:0> require "cgi"
=> true
irb(main):003:0> CGI::Cookie::parse "ASDF=stuff; ASDF space=more stuff"
=> {"ASDF"=>#<CGI::Cookie: "ASDF=stuff; path=">, "ASDF space"=>#<CGI::Cookie: "ASDF space=more+stuff; path=">}
irb(main):004:0>

[teodorescuserban]

This is still ongoing. I give you that devs that use cookies with blank spaces in the value without enclosing the value somehow need to be put in the corner, but SimpleCookie should be able to navigate around that. I encountered this issue preventing a login process because the login login / session cookie happened to be after another cookie with space in the value. Splitting by semicolon seems reasonable enough. I am fine even dropping that blank space cookie entirely, that would teach the devs a lesson :)