gh-79096: Protect cookie file created by {LWP,Mozilla}CookieJar.save()

Lib/http/cookiejar.py

@@ -1890,7 +1890,7 @@ def save(self, filename=None, ignore_discard=False, ignore_expires=False):
             if self.filename is not None: filename = self.filename
             else: raise ValueError(MISSING_FILENAME_TEXT)
 
-        with open(filename, "w") as f:
+        with os.fdopen(os.open(filename, os.O_CREAT | os.O_WRONLY, 0o600), 'w') as f:
             # There really isn't an LWP Cookies 2.0 format, but this indicates
             # that there is extra information in here (domain_dot and
             # port_spec) while still being compatible with libwww-perl, I hope.
@@ -2086,7 +2086,7 @@ def save(self, filename=None, ignore_discard=False, ignore_expires=False):
             if self.filename is not None: filename = self.filename
             else: raise ValueError(MISSING_FILENAME_TEXT)
 
-        with open(filename, "w") as f:
+        with os.fdopen(os.open(filename, os.O_CREAT | os.O_WRONLY, 0o600), 'w') as f:
             f.write(NETSCAPE_HEADER_TEXT)
             now = time.time()
             for cookie in self:

Lib/test/test_http_cookiejar.py

@@ -1,6 +1,7 @@
 """Tests for http/cookiejar.py."""
 
 import os
+import sys
 import re
 import test.support
 from test.support import os_helper
@@ -17,6 +18,7 @@
      reach, is_HDN, domain_match, user_domain_match, request_path,
      request_port, request_host)
 
+mswindows = (sys.platform == "win32")
 
 class DateTimeTests(unittest.TestCase):
 
@@ -368,6 +370,35 @@ def test_lwp_valueless_cookie(self):
             except OSError: pass
         self.assertEqual(c._cookies["www.acme.com"]["/"]["boo"].value, None)
 
+    @unittest.skipIf(mswindows, "windows file permissions are incompatible with file modes")
+    def test_lwp_filepermissions(self):
+        # Cookie file should only be readable by the creator
+        filename = os_helper.TESTFN
+        c = LWPCookieJar()
+        interact_netscape(c, "http://www.acme.com/", 'boo')
+        try:
+            c.save(filename, ignore_discard=True)
+            status = os.stat(filename)
+            print(status.st_mode)
+            self.assertEqual(oct(status.st_mode)[-3:], '600')
+        finally:
+            try: os.unlink(filename)
+            except OSError: pass
+
+    @unittest.skipIf(mswindows, "windows file permissions are incompatible with file modes")
+    def test_mozilla_filepermissions(self):
+        # Cookie file should only be readable by the creator
+        filename = os_helper.TESTFN
+        c = MozillaCookieJar()
+        interact_netscape(c, "http://www.acme.com/", 'boo')
+        try:
+            c.save(filename, ignore_discard=True)
+            status = os.stat(filename)
+            self.assertEqual(oct(status.st_mode)[-3:], '600')
+        finally:
+            try: os.unlink(filename)
+            except OSError: pass
+
     def test_bad_magic(self):
         # OSErrors (eg. file doesn't exist) are allowed to propagate
         filename = os_helper.TESTFN

Misc/NEWS.d/next/Security/2022-06-03-12-52-53.gh-issue-79096.YVoxgC.rst

@@ -0,0 +1 @@
+LWPCookieJar and MozillaCookieJar create files with file mode 600 instead of 644 (Microsoft Windows is not affected)