File 3_5_BRANCH_707375.diff of Package kdelibs3

Overview Repositories Revisions Requests Users Attributes Meta

File 3_5_BRANCH_707375.diff of Package kdelibs3 (Revision 109acfd7b6c104d87751d0befd8b9bfd)

Currently displaying revision 109acfd7b6c104d87751d0befd8b9bfd , Show latest

------------------------------------------------------------------------
r707375 | adawit | 2007-09-01 19:19:13 +0200 (Sat, 01 Sep 2007) | 3 lines

- Fix BR# 134421 and as a result fix a cross-site cookie injection vulnerability.
- Simplyfy the code that saves the contents of the cookiejar in KCookieServer.

------------------------------------------------------------------------
--- kioslave/http/kcookiejar/kcookiejar.cpp
+++ kioslave/http/kcookiejar/kcookiejar.cpp
@@ -981,44 +981,27 @@ void KCookieJar::addCookie(KHttpCookiePt
 //
 KCookieAdvice KCookieJar::cookieAdvice(KHttpCookiePtr cookiePtr)
 {
-    QStringList domains;
-
     if (m_rejectCrossDomainCookies && cookiePtr->isCrossDomain())
        return KCookieReject;
 
-    if (m_autoAcceptSessionCookies && (cookiePtr->expireDate() == 0 ||
-        m_ignoreCookieExpirationDate))
-       return KCookieAccept;
+    QStringList domains;
 
     extractDomains(cookiePtr->host(), domains);
 
-    // If the cookie specifies a domain, check whether it is valid and
-    // correct otherwise.
+    // If the cookie specifies a domain, check whether it is valid. Otherwise,
+    // accept the cookie anyways but removes the domain="" value to prevent
+    // cross-site cookie injection.
     if (!cookiePtr->domain().isEmpty())
     {
-       bool valid = false;
-
-       // This checks whether the cookie is valid based on
-       // what ::extractDomains returns
-       if (!valid)
-       {
-          if (domains.contains(cookiePtr->domain()))
-             valid = true;
-       }
-
-       if (!valid)
-       {
-          // Maybe it points to a sub-domain
-          if (cookiePtr->domain().endsWith("."+cookiePtr->host()))
-             valid = true;
-       }
-
-       if (!valid)
-       {
+      if (!domains.contains(cookiePtr->domain()) && 
+          !cookiePtr->domain().endsWith("."+cookiePtr->host()))
           cookiePtr->fixDomain(QString::null);
-       }
     }
 
+    if (m_autoAcceptSessionCookies && (cookiePtr->expireDate() == 0 ||
+        m_ignoreCookieExpirationDate))
+       return KCookieAccept;
+
     KCookieAdvice advice = KCookieDunno;
     bool isFQDN = true; // First is FQDN
     QStringList::Iterator it = domains.begin(); // Start with FQDN which first in the list.
--- kioslave/http/kcookiejar/tests/cookie.test
+++ kioslave/http/kcookiejar/tests/cookie.test
@@ -144,3 +144,8 @@ CHECK http://y.z.foobar.com/
 CHECK http://z.foobar.com/
 CHECK http://www.foobar.com/
 CHECK http://foobar.com/
+CLEAR COOKIES
+## Check domain restrictions #8
+CONFIG AcceptSessionCookies true
+COOKIE ACCEPT http://www.foobar.com Set-Cookie: from=foobar.com; domain=bar.com; Path="/"
+CHECK http://bar.com
--- kioslave/http/kcookiejar/kcookieserver.cpp
+++ kioslave/http/kcookiejar/kcookieserver.cpp
@@ -86,7 +86,8 @@ KCookieServer::KCookieServer(const QCStr
    mPendingCookies->setAutoDelete(true);
    mRequestList = new RequestList;
    mAdvicePending = false;
-   mTimer = 0;
+   mTimer = new QTimer();
+   connect( mTimer, SIGNAL( timeout()), SLOT( slotSave()));
    mConfig = new KConfig("kcookiejarrc");
    mCookieJar->loadConfig( mConfig );
 
@@ -186,6 +187,7 @@ void KCookieServer::checkCookies( KHttpC
     KHttpCookiePtr cookie = list->first();
     while (cookie)
     {
+        kdDebug(7104) << "checkCookies: Asking cookie advice for " << cookie->host() << endl;
         KCookieAdvice advice = mCookieJar->cookieAdvice(cookie);
         switch(advice)
         {
@@ -256,7 +258,7 @@ void KCookieServer::checkCookies( KHttpC
                break;
 
            default:
-               qWarning(__FILE__":%d Problen!", __LINE__);
+               qWarning(__FILE__":%d Problem!", __LINE__);
                cookie = mPendingCookies->next();
                break;
            }
@@ -292,26 +294,22 @@ void KCookieServer::checkCookies( KHttpC
           request = mRequestList->next();
         }
     }
-    if (mCookieJar->changed() && !mTimer)
+    if (mCookieJar->changed())
         saveCookieJar();
 }
 
 void KCookieServer::slotSave()
 {
-   delete mTimer;
-   mTimer = 0;
    QString filename = locateLocal("data", "kcookiejar/cookies");
    mCookieJar->saveCookies(filename);
 }
 
 void KCookieServer::saveCookieJar()
 {
-    if( mTimer )
+    if( mTimer->isActive() )
         return;
 
-    mTimer = new QTimer();
-    connect( mTimer, SIGNAL( timeout()), SLOT( slotSave()));
-    mTimer->start( 1000*60*SAVE_DELAY );
+    mTimer->start( 1000*60*SAVE_DELAY, true );
 }
 
 void KCookieServer::putCookie( QStringList& out, KHttpCookie *cookie,
@@ -391,12 +389,12 @@ KCookieServer::findCookies(QString url, 
       mRequestList->append( request );
       return QString::null; // Talk to you later :-)
    }
-   
+
    QString cookies = mCookieJar->findCookies(url, false, windowId);
-   
-   if (mCookieJar->changed() && !mTimer)
+
+   if (mCookieJar->changed())
       saveCookieJar();
-   
+
    return cookies;
 }
 
@@ -491,8 +489,7 @@ KCookieServer::deleteCookie(QString doma
          if( cookieMatches(it.current(), domain, fqdn, path, name) )
          {
             mCookieJar->eatCookie( it.current() );
-            if (!mTimer)
-               saveCookieJar();
+            saveCookieJar();
             break;
          }
       }
@@ -504,8 +501,7 @@ void
 KCookieServer::deleteCookiesFromDomain(QString domain)
 {
    mCookieJar->eatCookiesForDomain(domain);
-   if (!mTimer)
-      saveCookieJar();
+   saveCookieJar();
 }
 
 
@@ -521,16 +517,14 @@ void
 KCookieServer::deleteSessionCookies( long windowId )
 {
   mCookieJar->eatSessionCookies( windowId );
-  if(!mTimer)
-    saveCookieJar();
+  saveCookieJar();
 }
 
 void
 KCookieServer::deleteSessionCookiesFor(QString fqdn, long windowId)
 {
   mCookieJar->eatSessionCookies( fqdn, windowId );
-  if(!mTimer)
-    saveCookieJar();
+  saveCookieJar();
 }
 
 // DCOP function
@@ -538,8 +532,7 @@ void
 KCookieServer::deleteAllCookies()
 {
    mCookieJar->eatAllCookies();
-   if (!mTimer)
-      saveCookieJar();
+   saveCookieJar();
 }
 
 // DCOP function

Places

File 3_5_BRANCH_707375.diff of Package kdelibs3 (Revision 109acfd7b6c104d87751d0befd8b9bfd)

Places