diff options
| author | dirkf <fieldhouse@gmx.net> | 2023-06-07 19:38:54 +0100 |
|---|---|---|
| committer | dirkf <fieldhouse@gmx.net> | 2023-07-18 10:50:46 +0100 |
| commit | b383be98874d4dded67ee8a679fae30340722709 (patch) | |
| tree | e9da83eb42785c0fd1e0927bac3f3e85b58d2894 /test/test_http.py | |
| parent | 46fde7caeeab13a6277aab22a0e8a29e10c30cc3 (diff) | |
[core] Remove `Cookie` header on redirect to prevent leaks
Adated from yt-dlp/yt-dlp-ghsa-v8mc-9377-rwjj/pull/1/commits/101caac
Thx coletdjnz
Diffstat (limited to 'test/test_http.py')
| -rw-r--r-- | test/test_http.py | 32 |
1 files changed, 30 insertions, 2 deletions
diff --git a/test/test_http.py b/test/test_http.py index 1a65df9e0..cd180b51f 100644 --- a/test/test_http.py +++ b/test/test_http.py @@ -183,6 +183,11 @@ class HTTPTestRequestHandler(compat_http_server.BaseHTTPRequestHandler): self._method('GET') elif self.path.startswith('/headers'): self._headers() + elif self.path.startswith('/308-to-headers'): + self.send_response(308) + self.send_header('Location', '/headers') + self.send_header('Content-Length', '0') + self.end_headers() elif self.path == '/trailing_garbage': payload = b'<html><video src="/vid.mp4" /></html>' compressed = gzip_compress(payload) + b'trailing garbage' @@ -385,8 +390,31 @@ class TestHTTP(unittest.TestCase): ydl.cookiejar.set_cookie(compat_http_cookiejar_Cookie( 0, 'test', 'ytdl', None, False, '127.0.0.1', True, False, '/headers', True, False, None, False, None, None, {})) - data = ydl.urlopen(sanitized_Request(self._test_url('headers'))).read() - self.assertIn(b'Cookie: test=ytdl', data) + data = ydl.urlopen(sanitized_Request( + self._test_url('headers'))).read().decode('utf-8') + self.assertIn('Cookie: test=ytdl', data) + + def test_passed_cookie_header(self): + # We should accept a Cookie header being passed as in normal headers and handle it appropriately. + with FakeYDL() as ydl: + # Specified Cookie header should be used + res = ydl.urlopen(sanitized_Request( + self._test_url('headers'), headers={'Cookie': 'test=test'})).read().decode('utf-8') + self.assertIn('Cookie: test=test', res) + + # Specified Cookie header should be removed on any redirect + res = ydl.urlopen(sanitized_Request( + self._test_url('308-to-headers'), headers={'Cookie': 'test=test'})).read().decode('utf-8') + self.assertNotIn('Cookie: test=test', res) + + # Specified Cookie header should override global cookiejar for that request + ydl.cookiejar.set_cookie(compat_http_cookiejar_Cookie( + 0, 'test', 'ytdlp', None, False, '127.0.0.1', True, + False, '/headers', True, False, None, False, None, None, {})) + data = ydl.urlopen(sanitized_Request( + self._test_url('headers'), headers={'Cookie': 'test=test'})).read().decode('utf-8') + self.assertNotIn('Cookie: test=ytdlp', data) + self.assertIn('Cookie: test=test', data) def test_no_compression_compat_header(self): with FakeYDL() as ydl: |