mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-09-01 16:10:25 +00:00
Darsh Kelaiya
1936909624
This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478 [2] https://github.com/advisories/GHSA-hg6j-4rv6-33pg Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
65 lines
2.5 KiB
Diff
65 lines
2.5 KiB
Diff
From 54aaf333cfe59f62d01ed06c8951da268ab2fb18 Mon Sep 17 00:00:00 2001
|
|
From: Sam Bull <git@sambull.org>
|
|
Date: Tue, 19 May 2026 01:23:00 +0100
|
|
Subject: [PATCH] Drop cookies on redirect (#12550) (#12640)
|
|
|
|
CVE: CVE-2026-47265
|
|
Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478]
|
|
|
|
(cherry picked from commit d57efb05f5073071ceb2d3b35d72d9d0bc4512a2)
|
|
(cherry picked from commit f54c40851b0d6c4bbdab97ba518a223adda32478)
|
|
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
|
|
---
|
|
CHANGES/12540.bugfix.rst | 1 +
|
|
aiohttp/client.py | 1 +
|
|
tests/test_client_functional.py | 16 ++++++++++++++--
|
|
3 files changed, 16 insertions(+), 2 deletions(-)
|
|
create mode 100644 CHANGES/12540.bugfix.rst
|
|
|
|
diff --git a/CHANGES/12540.bugfix.rst b/CHANGES/12540.bugfix.rst
|
|
new file mode 100644
|
|
index 000000000..dfd98129e
|
|
--- /dev/null
|
|
+++ b/CHANGES/12540.bugfix.rst
|
|
@@ -0,0 +1 @@
|
|
+Fixed per-request ``cookies`` not being dropped on cross-origin redirects -- by :user:`Dreamsorcerer`.
|
|
diff --git a/aiohttp/client.py b/aiohttp/client.py
|
|
index 5d10d3e43..0637eff6b 100644
|
|
--- a/aiohttp/client.py
|
|
+++ b/aiohttp/client.py
|
|
@@ -892,6 +892,7 @@ class ClientSession:
|
|
|
|
if url.origin() != redirect_origin:
|
|
auth = None
|
|
+ cookies = None
|
|
headers.pop(hdrs.AUTHORIZATION, None)
|
|
headers.pop(hdrs.COOKIE, None)
|
|
headers.pop(hdrs.PROXY_AUTHORIZATION, None)
|
|
diff --git a/tests/test_client_functional.py b/tests/test_client_functional.py
|
|
index 118ce19ca..ea31567c4 100644
|
|
--- a/tests/test_client_functional.py
|
|
+++ b/tests/test_client_functional.py
|
|
@@ -3564,8 +3564,20 @@ async def test_auth_persist_on_redirect_to_other_host_with_global_auth(
|
|
async with aiohttp.ClientSession(
|
|
connector=connector, auth=aiohttp.BasicAuth("user", "pass")
|
|
) as client:
|
|
- resp = await client.get(url_from)
|
|
- assert resp.status == 200
|
|
+ async with client.get(
|
|
+ url_from,
|
|
+ headers={
|
|
+ "Proxy-Authorization": "Basic dXNlcjpwYXNz",
|
|
+ "Cookie": "a=b",
|
|
+ },
|
|
+ ) as resp:
|
|
+ assert resp.status == 200
|
|
+ async with client.get(
|
|
+ url_from,
|
|
+ headers={"Proxy-Authorization": "Basic dXNlcjpwYXNz"},
|
|
+ cookies={"a": "b"},
|
|
+ ) as resp:
|
|
+ assert resp.status == 200
|
|
|
|
|
|
async def test_drop_auth_on_redirect_to_other_host_with_global_auth_and_base_url(
|