Skip to content

gh-90309: Base64-encode cookie values embedded in JS#148848

Merged
sethmlarson merged 3 commits intopython:mainfrom
sethmlarson:morsel-js-output
Apr 22, 2026
Merged

gh-90309: Base64-encode cookie values embedded in JS#148848
sethmlarson merged 3 commits intopython:mainfrom
sethmlarson:morsel-js-output

Conversation

@sethmlarson
Copy link
Copy Markdown
Contributor

@sethmlarson sethmlarson commented Apr 21, 2026 •
edited by bedevere-app Bot
Loading

Avoids problems arising from embedding arbitrary characters in JavaScript in .js_output() method. I'll be submitting a follow-up issue and PR to deprecate the function as suggested in #90309 cc @komi22

@bedevere-app bedevere-app Bot mentioned this pull request Apr 21, 2026
Open
@sethmlarson sethmlarson added the type-security A security issue label Apr 21, 2026
StanFromIreland
StanFromIreland reviewed Apr 21, 2026
View reviewed changes
Comment thread Lib/http/cookies.py
serhiy-storchaka
serhiy-storchaka reviewed Apr 21, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@serhiy-storchaka serhiy-storchaka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, but I am not expert in JavaScript.

How old is the atob() function? Can we be sure that it is supported absolutely everywhere, not only in Firefox/Chromium clones?

Comment thread Lib/http/cookies.py
encukou
encukou approved these changes Apr 22, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@encukou encukou left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How old is the atob() function?

Chrome and Firefox always had it. Internet Explorer added it in version 10 (2012). (see caniuse)

@sethmlarson
Copy link
Copy Markdown
Contributor Author

sethmlarson commented Apr 22, 2026 •
edited
Loading

How old is the atob() function?

Chrome and Firefox always had it. Internet Explorer added it in version 10 (2012). (see caniuse)

This is the earliest date I was able to find, too. There are some references that it was a part of Netscape as well but nothing conclusive.

StanFromIreland
StanFromIreland approved these changes Apr 22, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@StanFromIreland StanFromIreland left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, one little note for the blurb as it's a bit vague.

Comment thread Misc/NEWS.d/next/Security/2026-04-21-13-46-30.gh-issue-90309.srvj9q.rst Outdated
@sethmlarson sethmlarson merged commit 76b3923 into python:main Apr 22, 2026
51 checks passed
@sethmlarson sethmlarson added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Apr 22, 2026
@miss-islington-app
Copy link
Copy Markdown

miss-islington-app Bot commented Apr 22, 2026

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app Bot commented Apr 22, 2026

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app Bot commented Apr 22, 2026

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app Bot commented Apr 22, 2026

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app Bot commented Apr 22, 2026

Thanks @sethmlarson for the PR 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

@sethmlarson sethmlarson deleted the morsel-js-output branch April 22, 2026 19:30
@miss-islington-app
Copy link
Copy Markdown

miss-islington-app Bot commented Apr 22, 2026

Sorry, @sethmlarson, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 76b3923d688c0efc580658476c5f525ec8735104 3.10

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app Bot commented Apr 22, 2026

Sorry, @sethmlarson, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 76b3923d688c0efc580658476c5f525ec8735104 3.11

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app Bot commented Apr 22, 2026

Sorry, @sethmlarson, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 76b3923d688c0efc580658476c5f525ec8735104 3.12

@sethmlarson sethmlarson removed needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes labels Apr 22, 2026
@sethmlarson
Copy link
Copy Markdown
Contributor Author

sethmlarson commented Apr 22, 2026

This is such a low severity and unlikely to be used that I'm going to forgo backporting to 3.12-3.10 unless someone asks for this.

@StanFromIreland StanFromIreland removed needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Apr 22, 2026
@StanFromIreland
Copy link
Copy Markdown
Member

StanFromIreland commented Apr 22, 2026 •
edited
Loading

3.14 and 3.13 succeeded automatically: #148889 / #148888

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@serhiy-storchaka serhiy-storchaka serhiy-storchaka left review comments

@encukou encukou encukou approved these changes

@StanFromIreland StanFromIreland StanFromIreland approved these changes

Assignees

@sethmlarson sethmlarson

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@sethmlarson @StanFromIreland @encukou @serhiy-storchaka