#26158: cookie parsing fails with python 3.x if request contains unnamed cookie
--------------------------------+-------------------------------------
Reporter: Treverix | Owner: timgraham
Type: Bug | Status: assigned
Component: HTTP handling | Version: 1.8
Severity: Normal | Resolution:
Keywords: cookie python3 | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
--------------------------------+-------------------------------------
Comment (by collinanderson):
It should be safe to hard split on semicolon. `name="some;value"` is not
valid, even though it's quoted. I think raw double quotes, commas,
semicolons and backslashes are _always_ invalid characters in cookie
values.
From https://tools.ietf.org/html/rfc6265:
{{{
cookie-value = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
; US-ASCII characters excluding CTLs,
; whitespace DQUOTE, comma, semicolon,
; and backslash
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/26158#comment:7>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/066.546d2d65fe68e827d219cf9dad7ec88a%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
