Skip to content

SimpleCookie.js_output is vulnerable to HTML injection #90309

Closed
Closed
SimpleCookie.js_output is vulnerable to HTML injection#90309
Labels
stdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

Description

@trungpaaa
trungpaaa
mannequin
opened on Dec 22, 2021
BPO 46151

Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2021-12-22.13:26:50.501>
labels = ['type-security', 'library', '3.11']
title = 'SimpleCookie.js_output is vulnerable to HTML injection'
updated_at = <Date 2021-12-22.13:26:50.501>
user = 'https://bugs.python.org/trungpaaa'

bugs.python.org fields:

activity = <Date 2021-12-22.13:26:50.501>
actor = 'trungpaaa'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2021-12-22.13:26:50.501>
creator = 'trungpaaa'
dependencies = []
files = []
hgrepos = []
issue_num = 46151
keywords = []
message_count = 1.0
messages = ['409035']
nosy_count = 1.0
nosy_names = ['trungpaaa']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue46151'
versions = ['Python 3.11']

Linked PRs

Activity

  1. trungpaaa commented on Dec 22, 2021

    @trungpaaa
    trungpaaamannequin
    on Dec 22, 2021
    MannequinAuthor

    In /Lib/http/cookies.py, the output from SimpleCookie.js_output might be parsed as HTML if it contained < and >.

    from http import cookies
c = cookies.SimpleCookie()
c["fig"] = "newton</script><script>alert(document.domain)</script>";

// c.js_output()

<script type="text/javascript">
<!-- begin hiding
document.cookie = "fig=\"newton</script><script>alert(document.domain)</script>\"";
// end hiding -->
</script>

    We can't simply escape all the special characters because the encoding method is treated differently depending on the document types. For example, the following snippet (from The Tangled Web) is safe in HTML but not in XHTML:

    <script type="text/javascript">
    var tmp = 'I am harmless! &#x27;+alert(1);// Or am I?';
</script>

    To avoid messing with the encoding methods, we could encode the cookie string in base64 and let the browser decode it.

    // c.js_output()
<script type="text/javascript">
document.cookie = base64decode(<ENCODED>);
</script>

    After searching around on Github, I think this function is rarely used so making it deprecated is also an option.

  2. trungpaaa
    added
    3.11only security fixes
    stdlibStandard Library Python modules in the Lib/ directory
    type-securityA security issue
    on Dec 22, 2021
  3. ezio-melotti
    transferred this issue fromon Apr 10, 2022
  4. serhiy-storchaka
    added this to Cookies issues 🍪on May 20, 2022
  5. StanFromIreland
    removed
    3.11only security fixes
    on Apr 9, 2026

  6. serhiy-storchaka commented on Apr 9, 2026

    @serhiy-storchaka
    serhiy-storchaka
    on Apr 9, 2026
    Member

    I have not found any use of that method on GitHub. Only forks of the stdlib and typeshed, and variables with accidentally same name.

    It seems that it was written when support of <script> in browsers was rare. I do not think that "<!-- begin hiding" is valid JavaScript. This code will likely does not work in modern browsers.

    I support deprecation of js_output().

  7. sethmlarson commented on Apr 10, 2026

    @sethmlarson
    sethmlarson
    on Apr 10, 2026
    Contributor

    I also support deprecation of this function.

  8. sethmlarson
    added 2 commits that reference this issue on Apr 21, 2026

    pythongh-90309: Base64-encode cookie values embedded in JS

    b8dd6e4

    gh-90309: Base64-encode cookie values embedded in JS

    76b3923
  9. encukou
    added 2 commits that reference this issue on Apr 23, 2026

    [3.14] gh-90309: Base64-encode cookie values embedded in JS (GH-148889)

    f795e04

    [3.13] gh-90309: Base64-encode cookie values embedded in JS (GH-148888)

    3c59b8b
  10. ljfp
    added a commit that references this issue on Apr 25, 2026

    pythongh-90309: Base64-encode cookie values embedded in JS

    bd575cd
  11. bmwiedemann
    added 4 commits that reference this issue on Apr 28, 2026

    Update python315 to version 3.15.0~a8 / rev 12 via SR 1349644

    62afcad

    Update python310 to version 3.10.20 / rev 77 via SR 1349663

    279e0dd

    Update python315 to version 3.15.0~a8 / rev 13 via SR 1349863

    e0f2724

    Update python313 to version 3.13.13 / rev 41 via SR 1349656

    efb1aca
  12. StanFromIreland
    closed this as completedon May 9, 2026
  13. github-project-automation
    moved this to Done in Cookies issues 🍪on May 9, 2026
  14. bmwiedemann
    added a commit that references this issue on Jun 22, 2026

    Update python312 to version 3.12.13 / rev 49 via SR 1360565

    0e1eb21
  15. mcepl
    added 3 commits that reference this issue on Sep 18, 2026

    [CVE-2026-6019] Base64-encode cookie values embedded in JS

    fd7e602

    [CVE-2026-6019] Base64-encode cookie values embedded in JS

    aab212f

    [CVE-2026-6019] Base64-encode cookie values embedded in JS

    d3c95e7
  16. mcepl
    added 3 commits that reference this issue on Oct 1, 2026

    [CVE-2026-6019] Base64-encode cookie values embedded in JS

    9ef320f

    [CVE-2026-6019] Base64-encode cookie values embedded in JS

    92a96a8

    [CVE-2026-6019] Base64-encode cookie values embedded in JS

    b5f6e5d
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    stdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions