FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

gh-90309: Base64-encode cookie values embedded in JS by sethmlarson · Pull Request #148848 · python/cpython · GitHub

  1. python
  2. cpython

Repository navigation

gh-90309: Base64-encode cookie values embedded in JS - #148848

Merged
sethmlarson merged 3 commits into
python:mainfrom
sethmlarson:morsel-js-output
Apr 22, 2026
ConversationCommits (3)ChecksFiles changed
Merged

gh-90309: Base64-encode cookie values embedded in JS#148848
sethmlarson merged 3 commits into
python:mainfrom
sethmlarson:morsel-js-output

Conversation

sethmlarson commented Apr 21, 2026 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Contributor

Avoids problems arising from embedding arbitrary characters in JavaScript in .js_output() method. I'll be submitting a follow-up issue and PR to deprecate the function as suggested in #90309 cc @komi22

bedevere-app Bot mentioned this pull request Apr 21, 2026
Closed
sethmlarson added the type-security A security issue label Apr 21, 2026
StanFromIreland reviewed Apr 21, 2026
View reviewed changes
Comment thread Lib/http/cookies.py
serhiy-storchaka reviewed Apr 21, 2026
View reviewed changes

serhiy-storchaka left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

LGTM, but I am not expert in JavaScript.

How old is the atob() function? Can we be sure that it is supported absolutely everywhere, not only in Firefox/Chromium clones?

Comment thread Lib/http/cookies.py
encukou approved these changes Apr 22, 2026
View reviewed changes

encukou left a comment •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

How old is the atob() function?

Chrome and Firefox always had it. Internet Explorer added it in version 10 (2012). (see caniuse)

sethmlarson commented Apr 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

How old is the atob() function?

Chrome and Firefox always had it. Internet Explorer added it in version 10 (2012). (see caniuse)

This is the earliest date I was able to find, too. There are some references that it was a part of Netscape as well but nothing conclusive.

StanFromIreland approved these changes Apr 22, 2026
View reviewed changes

StanFromIreland left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

LGTM, one little note for the blurb as it's a bit vague.

Comment thread Misc/NEWS.d/next/Security/2026-04-21-13-46-30.gh-issue-90309.srvj9q.rst Outdated
sethmlarson merged commit 76b3923 into python:main Apr 22, 2026
51 checks passed

miss-islington-app Bot commented Apr 22, 2026

Copy link
Copy Markdown

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖

miss-islington-app Bot commented Apr 22, 2026

Copy link
Copy Markdown

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

miss-islington-app Bot commented Apr 22, 2026

Copy link
Copy Markdown

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖

miss-islington-app Bot commented Apr 22, 2026

Copy link
Copy Markdown

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

miss-islington-app Bot commented Apr 22, 2026

Copy link
Copy Markdown

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

sethmlarson deleted the morsel-js-output branch April 22, 2026 19:30

miss-islington-app Bot commented Apr 22, 2026

Copy link
Copy Markdown

Sorry, @sethmlarson, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 76b3923d688c0efc580658476c5f525ec8735104 3.10

miss-islington-app Bot commented Apr 22, 2026

Copy link
Copy Markdown

Sorry, @sethmlarson, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 76b3923d688c0efc580658476c5f525ec8735104 3.11

miss-islington-app Bot commented Apr 22, 2026

Copy link
Copy Markdown

Sorry, @sethmlarson, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 76b3923d688c0efc580658476c5f525ec8735104 3.12

sethmlarson commented Apr 22, 2026

Copy link
Copy Markdown
Contributor Author

This is such a low severity and unlikely to be used that I'm going to forgo backporting to 3.12-3.10 unless someone asks for this.

StanFromIreland removed needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes labels Apr 22, 2026

StanFromIreland commented Apr 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

3.14 and 3.13 succeeded automatically: #148889 / #148888

sethmlarson mentioned this pull request Apr 29, 2026
Merged

elboulangero commented May 12, 2026 •
edited
Loading

Copy link
Copy Markdown

FWIW, the automatic backport failed because #145599 needs to be merged first. After that the automatic backport should work.

xnox commented Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown

FWIW, the automatic backport failed because #145599 needs to be merged first. After that the automatic backport should work.

@elboulangero @sethmlarson the above is now merged, would it be possible to attempt again automatic backport of this CVE for 3.10, 3.11, 3.12?

This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

serhiy-storchaka serhiy-storchaka left review comments
encukou encukou approved these changes
StanFromIreland StanFromIreland approved these changes

Assignees

sethmlarson

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

Back | FazBrowse Home | New Git URL