Control: severity -1 normal
On 2014-10-15 14:41:06, Yavuz Selim Komur wrote:
> Package: python3-tornado
> Version: 3.2.2-1
> Severity: critical
> Justification: breaks unrelated software
>
> Dear Maintainer,
>
> class abc(tornado.web.RequestHandler):
> def get(self):
> (stat, user) = self.check_remember()
> if stat:
> do_action()
> else:
> self.clear_cookie('remember')
> self.render('remember-post.html')
>
> def post(self):
> username = self.get_body_argument('username'):
> if self.get_body_argument('remember'):
> val = json.dumps({'username': username, 'time': time.time()})
> self.set_secure_cookie('remember', value=val, expires_days=7)
>
> def check_remember(self):
> try:
> remember_cookie = self.get_secure_cookie('remember',
> max_age_days=7)
> except ValueError:
> print('try get_cookie')
> return False, ''
>
> if remember_cookie is None:
> return False, ''
>
> try:
> remember = json.loads(remember_cookie.decode())
> except ValueError:
> print('try json')
> return False, ''
>
> ret = (False, '')
> if 'username' in remember and 'time' in remember:
> if time.time() - remember['time'] > 7 * 24 * 60 * 60:
> self.clear_cookie('remember')
> ret = (False, '')
> else:
> username = remember['username']
> val = json.dumps({'username': username, 'time': time.time()})
> self.set_secure_cookie('remember', value=val, expires_days=7)
> ret = (True, username)
> return ret
>
>
> Always get an Exception ValueError in json.loads print try json and return
Looks like one needs to care of encoding / decoding the value properly.
The following example just works fine:
import tornado
import tornado.web
import tornado.ioloop
import json
value = { "foo": "bar" }
class MainHandler(tornado.web.RequestHandler):
def get(self):
if not self.get_secure_cookie("mycookie2"):
self.set_secure_cookie("mycookie2",
json.dumps(value).encode('utf-8'))
self.write("Your cookie was not set yet!")
else:
data = self.get_secure_cookie("mycookie2")
self.write("Your cookie was set!\n" +
str(json.loads(data.decode('utf-8'))))
application = tornado.web.Application([
(r"/", MainHandler),
], cookie_secret="bla")
application.listen(8888)
tornado.ioloop.IOLoop.instance().start()
Reducing the severity since a workaround exists and it's still unclear
which unrelated software would be broken by this issue.
Cheers
--
Sebastian Ramacher
signature.asc
Description: Digital signature
_______________________________________________ Python-modules-team mailing list Python-modules-team@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/python-modules-team
