LWPCookieJar.save() creates *.lwp file in 644 mode

[aleskva]

BPO	34915
Nosy	@vadmium, @tirkarthi

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2018-10-06.13:58:56.935>
labels = ['type-security', '3.8', '3.9', 'expert-IO', '3.7', 'library', '3.10']
title = 'LWPCookieJar.save() creates *.lwp file in 644 mode'
updated_at = <Date 2021-03-14.06:38:53.953>
user = 'https://bugs.python.org/aleskva'

bugs.python.org fields:

activity = <Date 2021-03-14.06:38:53.953>
actor = 'martin.panter'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)', 'IO']
creation = <Date 2018-10-06.13:58:56.935>
creator = 'aleskva'
dependencies = []
files = []
hgrepos = []
issue_num = 34915
keywords = []
message_count = 4.0
messages = ['327246', '339126', '341422', '388664']
nosy_count = 3.0
nosy_names = ['martin.panter', 'aleskva', 'xtreak']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue34915'
versions = ['Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']

[aleskva]

The LWPCookieJar.save() creates an *.lwp file containing session cookies in non-safe 644 mode (everyone can read it). This is not a secure behavior, especially for storing session keys or session cookies. The file should be created in 600 mode in my opinion.

https://github.com/python/cpython/blob/3.7/Lib/http/cookiejar.py#L1872

[tirkarthi]

I guess this is a good choice and distutils stores .pypirc [0] in this manner that has username and password.

[0]

cpython/Lib/distutils/config.py

Line 45 in 2f54908

with os.fdopen(os.open(rc, os.O_CREAT | os.O_WRONLY, 0o600), 'w') as f:

[tirkarthi]

Martin, any thoughts on this change?

[vadmium]

I don't have a strong opinion, but it does seem a sensible change that matches the high-level nature of the "cookiejar" module, with low risk of users relying on the current file permissions. On the other hand, the "curl" command seems to use the default mode when creating a cookies file (in Netscape a.k.a. Mozilla format):

$ curl --cookie-jar cookies https://www.google.com/
[. . .]
$ ls -l cookies
-rw-r--r-- 1 vadmium vadmium 418 Mar 14 17:12 cookies

The MozillaCookieJar class also seems to use the default file mode. I suppose it should be changed as well as the LWP class.