[issue4860] js_output wrong for cookies with " characters

Senthil added the comment: Because SimpleCookie class is still usable (that is not deprecated), it makes sense to back port to Py2.7. Applied the patches in revision 71030 and r71029. Thanks. -- status: open -> closed versions: +Python 3.1 ___ Python

[issue4860] js_output wrong for cookies with " characters

Senthil added the comment: Cookie.Cookie is deprecated in Py2k. In Py3k, it is http.cookies.SimpleCookie. The bug was present in Py3k, the attached patch fixes it. -- assignee: -> orsenthil nosy: +orsenthil resolution: -> accepted Added file: http://bugs.python.org/file13564/issue4860

[issue4860] js_output wrong for cookies with " characters

STINNER Victor added the comment: > What's wrong with < and >? >>> c=Cookie.Cookie('Customer="";'); print c.js_output() It allows HTML/Javascript injection. Well, Python 2.5 already

[issue4860] js_output wrong for cookies with " characters

Noufal added the comment: What's wrong with < and >? I can see the issues with ; though. ___ Python tracker ___ ___ Python-bugs-list mailing l

[issue4860] js_output wrong for cookies with " characters

STINNER Victor added the comment: The characters <>& should also be escaped. ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscri

[issue4860] js_output wrong for cookies with " characters

Noufal added the comment: A lot of the cookie tests need to be updated. A separate bug was filed regarding this. http://bugs.python.org/issue3788. I'm working on that now and will apply your patch there as well. ___ Python tracker

[issue4860] js_output wrong for cookies with " characters

STINNER Victor added the comment: The patch looks correct but it breaks the unit test: updated patch fixes Lib/test/test_cookie.py. -- nosy: +haypo Added file: http://bugs.python.org/file12632/cookie-2.patch ___ Python tracker

[issue4860] js_output wrong for cookies with " characters

New submission from Noufal : If a cookie is created with a " character in the content, the js_output which is emitted is bad javascript. eg. >>> import Cookie >>> c=Cookie.Cookie('Customer="WILE_E_COYOTE"; Version=1; Path=/acme') >>> print c Set-Cookie: Customer="WILE_E_COYOTE"; Path=/acme; Versi