1777206 - document.cookie does not reject invalid control characters

Status: RESOLVED DUPLICATE of bug 1797235

(Core :: Networking: Cookies, defect, P2)

Description

[haxatron1]

A sibling domain or a MITM can set cookies containing invalid control characters such as \f. On most server technology, such as Apache, requests containing illegal control characters will return a 400 Bad Request. As such attacker that can control sibling domain (eTLD+1) can inject such cookies into the cookie store and cause a situation where the Firefox client can no longer communicate with the main domain

Steps to reproduce:

1. Set cookie using document.cookie = "a=b\f"
2. Visit a website running Apache httpd.
3. Receive 400 Bad request. The Firefox client can no longer communicate with the Apache server so long as there is a current cookie store.

For reference, Chrome will now reject cookies set via document.cookie containing such control characters.

Comment 1

[haxatron1]

Notes: May be regarded as an annoyance, as a user can clear the cookie store containing the illegal cookie via a click of a button, but am submitting here just in case.

Comment 2

[haxatron1]

the current illegal charset also doesn't include the \x7f character which also causes problems with Apache, while chrome rejects \x7f from cookies.

Comment 3

[Daniel Veditz [:dveditz]]

There's been a big difference between early HTTP specs (headers must be only ASCII!) and what browsers and servers have accepted because we want to support a world audience has been pretty vast. But there are more modern specs (converging on allowing UTF-8) and we definitely shouldn't be allowing control characters.

Not sure this needs to be a hidden bug -- its been known for a while.

Comment 4

[Daniel Veditz [:dveditz]]

If we don't already have this on file as part of our efforts to match RFC 6265bis then we can use this for it.

Comment 5

[haxatron1]

Relevant part of the spec: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis/#section-5.4

Comment 6

[Daniel Veditz [:dveditz]]

I'm sorry, we lost track of this one (my fault, see comment 4). We will match the bounty of the bug that was filed after yours

Comment 7

[haxatron1]

The bounty is much appreciated! Thanks alot!