Description

assignee = None
closed_at = None
created_at = <Date 2018-10-06.13:58:56.935>
labels = ['type-security', '3.8', '3.9', 'expert-IO', '3.7', 'library', '3.10']
title = 'LWPCookieJar.save() creates *.lwp file in 644 mode'
updated_at = <Date 2021-03-14.06:38:53.953>
user = 'https://bugs.python.org/aleskva'

activity = <Date 2021-03-14.06:38:53.953>
actor = 'martin.panter'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)', 'IO']
creation = <Date 2018-10-06.13:58:56.935>
creator = 'aleskva'
dependencies = []
files = []
hgrepos = []
issue_num = 34915
keywords = []
message_count = 4.0
messages = ['327246', '339126', '341422', '388664']
nosy_count = 3.0
nosy_names = ['martin.panter', 'aleskva', 'xtreak']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue34915'
versions = ['Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']

Activity

1. aleskva commented on Oct 6, 2018

   

   aleskvamannequin

   on Oct 6, 2018

   MannequinAuthor

   More actions

   The LWPCookieJar.save() creates an *.lwp file containing session cookies in non-safe 644 mode (everyone can read it). This is not a secure behavior, especially for storing session keys or session cookies. The file should be created in 600 mode in my opinion.

   https://github.com/python/cpython/blob/3.7/Lib/http/cookiejar.py#L1872
2. aleskva

   assigned

   tiran

   on Oct 6, 2018
3. aleskva

   added

   topic-SSL

   3.7 (EOL)end of lifeend of life

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   topic-IO

   type-securityA security issueA security issue

   on Oct 6, 2018
4. tirkarthi commented on Mar 29, 2019

   

   tirkarthi

   on Mar 29, 2019

   Member

   More actions

   I guess this is a good choice and distutils stores .pypirc [0] in this manner that has username and password.

   [0]

   cpython/Lib/distutils/config.py

   Line 45 in 2f54908

   with os.fdopen(os.open(rc, os.O_CREAT | os.O_WRONLY, 0o600), 'w') as f:
5. tirkarthi commented on May 5, 2019

   

   tirkarthi

   on May 5, 2019

   Member

   More actions

   Martin, any thoughts on this change?
6. tiran

   added

   3.8 (EOL)end of lifeend of life

   3.9 (EOL)end of lifeend of life

   3.10 (EOL)end of lifeend of life

   on Oct 21, 2020
7. tiran

   removed their assignment

   on Oct 21, 2020
8. vadmium commented on Mar 14, 2021

   

   vadmium

   on Mar 14, 2021

   Member

   More actions

   I don't have a strong opinion, but it does seem a sensible change that matches the high-level nature of the "cookiejar" module, with low risk of users relying on the current file permissions. On the other hand, the "curl" command seems to use the default mode when creating a cookies file (in Netscape a.k.a. Mozilla format):

   $ curl --cookie-jar cookies https://www.google.com/
   [. . .]
   $ ls -l cookies
   -rw-r--r-- 1 vadmium vadmium 418 Mar 14 17:12 cookies

   The MozillaCookieJar class also seems to use the default file mode. I suppose it should be changed as well as the LWP class.
9. vadmium

   removed

   topic-SSL

   on Mar 14, 2021
10. 18 remaining items

11. ambv commented on Jun 9, 2022

    

    ambv

    on Jun 9, 2022

    Contributor

    More actions

    @pablogsal, let us know if you'd agree for this to still land in 3.11. Otherwise this can be closed.
12. pablogsal commented on Jun 9, 2022

    

    pablogsal

    on Jun 9, 2022

    Member

    More actions

    I'm fine landing this in 3.11 as long as it goes in before next beta
13. ambv commented on Jun 9, 2022

    

    ambv

    on Jun 9, 2022

    Contributor

    More actions

    Alright, I'll do the backport now in one commit.
14. ambv

    added 3 commits that reference this issue on Jun 9, 2022

    pythongh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar…

    9c5364a

    pythongh-79096: Fix/improve http cookiejar tests (pythonGH-93614)

    4619b2e

    [3.11] gh-79096: Protect cookie file created by {LWP,Mozilla}CookieJa…

    2084f94
15. ambv commented on Jun 9, 2022

    

    ambv

    on Jun 9, 2022

    Contributor

    More actions

    Alright, this is landed to 3.11 and 3.12. Thanks, @pSub! ✨ 🍰 ✨

    Reacted by Pascal Wittmann

    Reacted by Pascal Wittmann
16. ambv

    closed this as completedon Jun 9, 2022
17. ambv

    moved this to Done in Cookies issues 🍪on Jun 9, 2022
18. serhiy-storchaka

    added a commit that references this issue on Jun 26, 2022

    Revert 30935 defer bpo45162 to 312 (#94285)

    1ffde3e
19. gentoo-bot

    added 2 commits that reference this issue on May 21, 2024

    pythongh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar…

    006db80

    pythongh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar…

    061e81a
20. gentoo-bot

    added 2 commits that reference this issue on Sep 19, 2024

    pythongh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar…

    d055b66

    pythongh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar…

    ee5def7
21. gentoo-bot

    added a commit that references this issue on Jul 30, 2025

    pythongh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar…

    a0c21ea

Issue actions