nojhan/weboob-devel
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

browser2: Fix cookie security in redirections

Browse source 
With tests (another reason why it's good to write them).
This commit is contained in:
Laurent Bachelier 2012-04-16 18:06:55 +02:00 • committed by Romain Bignon
commit ef379f830e
2 changed files with 67 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
weboob/tools/browser2/browser.py
View file

@ -333,6 +333,9 @@ class BaseBrowser(object):
if cookies is None:
cookies = self.cookies.for_request(url)
kwargs['cookies'] = cookies
# erase all cookies, python-requests does not handle them securely
# and tries to merge them with provided cookies!
self.session.cookies.clear()
# call python-requests
response = self.session.request(method, url, **kwargs)
@ -343,7 +346,8 @@ class BaseBrowser(object):
if allow_redirects:
response = self.follow_redirects(response, orig_args)
# erase all cookies, python-requests does not handle them securely
# erase all cookies again
# to prevent leakage when using session.request() directly
self.session.cookies.clear()
return response