Chrome API chrome.cookies.set allows setting cookies for TLDs
Reported by
prakash0...@gmail.com,
Jul 28
|
||||||
Issue description
UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75 Safari/537.36
Steps to reproduce the problem:
1. Create an extension with "cookies" permission for "<all_urls>"
2. Execute the following code and watch your extension's console
```
const domain = 'com';
const cookieName = 'foobar';
chrome.cookies.set({
url: `http://${domain}`,
name: cookieName,
value: 'true',
domain: domain
}, cookie => {
console.log('set', domain, cookie);
});
chrome.cookies.get({url: `http://${domain}`, name: cookieName}, cookie => {
console.log('get', domain, cookie);
});
```
What is the expected behavior?
Error that cookies cannot be set for TLDs
What went wrong?
Cookies got set for TLDs which aren't actually valid domains
Did this work before? N/A
Chrome version: 68.0.3440.75 Channel: stable
OS Version:
Flash Version:
Though, cookies are set as seen by chrome.cookies.get, we cannot see them in requests to other subdomains or in cookie jar.
,
Jul 31
prakash0x00@ Thanks for the issue. Request you to provide a sample extension where this issue can be reproduced, which will help in further triaging. Thanks..
,
Jul 31
Here, I am uploading manifest.json and background.js which should be enough to reproduce the issue. Please enable "Developer mode" and load this extension from "Load unpacked". When the extension is loaded, click on "background inspect", you should observe 2 messages in your console. Then, you can try reloading the extension cookies being set and get for "com" domain. The code is simple and is trivial to change as you require.
,
Jul 31
Thank you for providing more feedback. Adding the requester to the cc list. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Aug 3
Able to reproduce the issue on Mac 10.13.3, Win-10 and Ubuntu 17.10 using chrome reported version #68.0.3440.84 and latest canary #70.0.3509.0. This is a non-regression issue as it is observed from M60 old builds. Hence, marking it as untriaged to get more inputs from dev team. Thanks...!!
,
Sep 14
Assigning to mkwst@ as owner of the cookies API. Agreed that, while not a security risk, there isn't really any good reason to allow this.
,
Oct 4
Seems like a thing we should prevent. I do not have bandwidth to fix it, but it would be lovely if someone did. |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by mbarbe...@chromium.org
, Jul 30Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Type-Bug