tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

setSameSiteMultiAttribute.py (3460B)


      1 from cookies.resources.helpers import makeCookieHeader, setNoCacheAndCORSHeaders
      2 
      3 from wptserve.utils import isomorphic_encode
      4 
      5 def main(request, response):
      6    """Respond to `/cookie/set/samesite?{value}` by setting the following combination of cookies:
      7    1. `samesite_unsupported={value};SameSite=Unsupported;path=/;Secure`
      8    2. `samesite_unsupported_none={value};SameSite=Unsupported;SameSite=None;path=/;Secure`
      9    3. `samesite_unsupported_lax={value};SameSite=Unsupported;SameSite=Lax;path=/`
     10    4. `samesite_unsupported_strict={value};SameSite=Unsupported;SameSite=Strict;path=/`
     11    5. `samesite_none_unsupported={value};SameSite=None;SameSite=Unsupported;path=/;Secure`
     12    6. `samesite_lax_unsupported={value};SameSite=Lax;SameSite=Unsupported;path=/;Secure`
     13    7. `samesite_strict_unsupported={value};SameSite=Strict;SameSite=Unsupported;path=/;Secure`
     14    8. `samesite_lax_none={value};SameSite=Lax;SameSite=None;path=/;Secure`
     15    9. `samesite_lax_strict={value};SameSite=Lax;SameSite=Strict;path=/`
     16    10. `samesite_strict_lax={value};SameSite=Strict;SameSite=Lax;path=/`
     17    Then navigate to a page that will post a message back to the opener with the set cookies"""
     18    headers = setNoCacheAndCORSHeaders(request, response)
     19    value = isomorphic_encode(request.url_parts.query)
     20 
     21    headers.append((b"Content-Type", b"text/html; charset=utf-8"))
     22    # Unknown value; single attribute
     23    headers.append(makeCookieHeader(
     24        b"samesite_unsupported", value, {b"SameSite":b"Unsupported", b"path":b"/", b"Secure":b""}))
     25 
     26    # Multiple attributes; first attribute unknown
     27    headers.append(makeCookieHeader(
     28        b"samesite_unsupported_none", value, {b"SameSite":b"Unsupported", b"SameSite":b"None", b"path":b"/", b"Secure":b""}))
     29    headers.append(makeCookieHeader(
     30        b"samesite_unsupported_lax", value, {b"SameSite":b"Unsupported", b"SameSite":b"Lax", b"path":b"/"}))
     31    headers.append(makeCookieHeader(
     32        b"samesite_unsupported_strict", value, {b"SameSite":b"Unsupported", b"SameSite":b"Strict", b"path":b"/"}))
     33 
     34    # Multiple attributes; second attribute unknown
     35    headers.append(makeCookieHeader(
     36        b"samesite_none_unsupported", value, {b"SameSite":b"None", b"SameSite":b"Unsupported", b"path":b"/", b"Secure":b""}))
     37    headers.append(makeCookieHeader(
     38        b"samesite_lax_unsupported", value, {b"SameSite":b"Lax", b"SameSite":b"Unsupported", b"path":b"/", b"Secure":b""}))
     39    headers.append(makeCookieHeader(
     40        b"samesite_strict_unsupported", value, {b"SameSite":b"Strict", b"SameSite":b"Unsupported", b"path":b"/", b"Secure":b""}))
     41 
     42    # Multiple attributes; both known
     43    headers.append(makeCookieHeader(
     44        b"samesite_lax_none", value, {b"SameSite":b"Lax", b"SameSite":b"None", b"path":b"/", b"Secure":b""}))
     45    headers.append(makeCookieHeader(
     46        b"samesite_lax_strict", value, {b"SameSite":b"Lax", b"SameSite":b"Strict", b"path":b"/"}))
     47    headers.append(makeCookieHeader(
     48        b"samesite_strict_lax", value, {b"SameSite":b"Strict", b"SameSite":b"Lax", b"path":b"/"}))
     49 
     50    document = b"""
     51 <!DOCTYPE html>
     52 <script>
     53  // A same-site navigation, which should attach all cookies including SameSite ones.
     54  // This is necessary because this page may have been reached via a cross-site navigation, so
     55  // we might not have access to some SameSite cookies from here.
     56  window.location = "../samesite/resources/echo-cookies.html";
     57 </script>
     58 """
     59 
     60    return headers, document