Repository navigation
set_cookie: normalize max_age through int() to prevent cookie attribute injection - #3763
Merged
bdarnell merged 3 commits intoOct 6, 2026
Merged
Conversation
…te injection The max_age parameter was assigned to the cookie Morsel outside the attribute-allowlist validation loops (added for CVE-2026-35536 and CVE-2026-91991), so a non-int max_age containing ";" would inject arbitrary cookie attributes into the Set-Cookie header verbatim. Normalizing through int() rejects such values. Refs GHSA-c6v4-qj2h-f748
The test deliberately passes a non-int max_age (the injection payload from GHSA-c6v4-qj2h-f748), which mypy rightly flags against the int | None signature.
Same injection payload semantics, shorter string.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RequestHandler.set_cookieassigns the keyword-onlymax_ageparameter to the cookie Morsel outside the attribute-allowlist validation loops that were added in 6.5.5 (CVE-2026-35536) and extended in 6.5.8 (CVE-2026-91991). A non-intmax_agecontaining;is therefore written into theSet-Cookieheader verbatim, injecting arbitrary cookie attributes (Path, Domain, SameSite, Secure, ...) — a third residual entry point of the same incomplete-fix chain.As discussed in GHSA-c6v4-qj2h-f748, the fix is to normalize through
int(), so a value that is not a valid integer is rejected rather than trusted:This is safe for all legitimate callers (ints, bools, and int-valued objects pass through unchanged; floats truncate as before) and consistent with the existing loud-rejection behavior for invalid attribute names/values.
Test included:
test_set_cookie_max_age_sanitizedverifies that amax_agepayload containing cookie attributes is rejected withValueErrorand nothing is smuggled into the header.Refs GHSA-c6v4-qj2h-f748