Blame SOURCES/00330-CVE-2018-20852.patch

b7e076
diff --git a/Lib/http/cookiejar.py b/Lib/http/cookiejar.py
b7e076
index adf956d..97599d4 100644
b7e076
--- a/Lib/http/cookiejar.py
b7e076
+++ b/Lib/http/cookiejar.py
b7e076
@@ -1148,6 +1148,11 @@ class DefaultCookiePolicy(CookiePolicy):
b7e076
         req_host, erhn = eff_request_host(request)
b7e076
         domain = cookie.domain
b7e076
 
b7e076
+        if domain and not domain.startswith("."):
b7e076
+            dotdomain = "." + domain
b7e076
+        else:
b7e076
+            dotdomain = domain
b7e076
+
b7e076
         # strict check of non-domain cookies: Mozilla does this, MSIE5 doesn't
b7e076
         if (cookie.version == 0 and
b7e076
             (self.strict_ns_domain & self.DomainStrictNonDomain) and
b7e076
@@ -1160,7 +1165,7 @@ class DefaultCookiePolicy(CookiePolicy):
b7e076
             _debug("   effective request-host name %s does not domain-match "
b7e076
                    "RFC 2965 cookie domain %s", erhn, domain)
b7e076
             return False
b7e076
-        if cookie.version == 0 and not ("."+erhn).endswith(domain):
b7e076
+        if cookie.version == 0 and not ("."+erhn).endswith(dotdomain):
b7e076
             _debug("   request-host %s does not match Netscape cookie domain "
b7e076
                    "%s", req_host, domain)
b7e076
             return False
b7e076
@@ -1174,7 +1179,11 @@ class DefaultCookiePolicy(CookiePolicy):
b7e076
             req_host = "."+req_host
b7e076
         if not erhn.startswith("."):
b7e076
             erhn = "."+erhn
b7e076
-        if not (req_host.endswith(domain) or erhn.endswith(domain)):
b7e076
+        if domain and not domain.startswith("."):
b7e076
+            dotdomain = "." + domain
b7e076
+        else:
b7e076
+            dotdomain = domain
b7e076
+        if not (req_host.endswith(dotdomain) or erhn.endswith(dotdomain)):
b7e076
             #_debug("   request domain %s does not match cookie domain %s",
b7e076
             #       req_host, domain)
b7e076
             return False
b7e076
diff --git a/Lib/test/test_http_cookiejar.py b/Lib/test/test_http_cookiejar.py
b7e076
index abc625d..6e1b308 100644
b7e076
--- a/Lib/test/test_http_cookiejar.py
b7e076
+++ b/Lib/test/test_http_cookiejar.py
b7e076
@@ -415,6 +415,7 @@ class CookieTests(unittest.TestCase):
b7e076
             ("http://foo.bar.com/", ".foo.bar.com", True),
b7e076
             ("http://foo.bar.com/", "foo.bar.com", True),
b7e076
             ("http://foo.bar.com/", ".bar.com", True),
b7e076
+            ("http://foo.bar.com/", "bar.com", True),
b7e076
             ("http://foo.bar.com/", "com", True),
b7e076
             ("http://foo.com/", "rhubarb.foo.com", False),
b7e076
             ("http://foo.com/", ".foo.com", True),
b7e076
@@ -425,6 +426,8 @@ class CookieTests(unittest.TestCase):
b7e076
             ("http://foo/", "foo", True),
b7e076
             ("http://foo/", "foo.local", True),
b7e076
             ("http://foo/", ".local", True),
b7e076
+            ("http://barfoo.com", ".foo.com", False),
b7e076
+            ("http://barfoo.com", "foo.com", False),
b7e076
             ]:
b7e076
             request = urllib.request.Request(url)
b7e076
             r = pol.domain_return_ok(domain, request)
b7e076
@@ -959,6 +962,33 @@ class CookieTests(unittest.TestCase):
b7e076
         c.add_cookie_header(req)
b7e076
         self.assertFalse(req.has_header("Cookie"))
b7e076
 
b7e076
+        c.clear()
b7e076
+
b7e076
+        pol.set_blocked_domains([])
b7e076
+        req = urllib.request.Request("http://acme.com/")
b7e076
+        res = FakeResponse(headers, "http://acme.com/")
b7e076
+        cookies = c.make_cookies(res, req)
b7e076
+        c.extract_cookies(res, req)
b7e076
+        self.assertEqual(len(c), 1)
b7e076
+
b7e076
+        req = urllib.request.Request("http://acme.com/")
b7e076
+        c.add_cookie_header(req)
b7e076
+        self.assertTrue(req.has_header("Cookie"))
b7e076
+
b7e076
+        req = urllib.request.Request("http://badacme.com/")
b7e076
+        c.add_cookie_header(req)
b7e076
+        self.assertFalse(pol.return_ok(cookies[0], req))
b7e076
+        self.assertFalse(req.has_header("Cookie"))
b7e076
+
b7e076
+        p = pol.set_blocked_domains(["acme.com"])
b7e076
+        req = urllib.request.Request("http://acme.com/")
b7e076
+        c.add_cookie_header(req)
b7e076
+        self.assertFalse(req.has_header("Cookie"))
b7e076
+
b7e076
+        req = urllib.request.Request("http://badacme.com/")
b7e076
+        c.add_cookie_header(req)
b7e076
+        self.assertFalse(req.has_header("Cookie"))
b7e076
+
b7e076
     def test_secure(self):
b7e076
         for ns in True, False:
b7e076
             for whitespace in " ", "":