From 9e1a427d2f047439d0320defe1593e6352595788 Mon Sep 17 00:00:00 2001 From: Alynx Zhou Date: Sat, 11 Oct 2025 15:52:47 +0800 Subject: [PATCH] cookies: Avoid expires attribute if date is invalid According to CVE-2025-11021, we may get invalid on processing date string with timezone offset, this commit will ignore it. Closes #459 --- libsoup/cookies/soup-cookie.c | 9 +++++---- libsoup/soup-date-utils.c | 3 +++ 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/libsoup/cookies/soup-cookie.c b/libsoup/cookies/soup-cookie.c index ba949239..df446e40 100644 --- a/libsoup/cookies/soup-cookie.c +++ b/libsoup/cookies/soup-cookie.c @@ -758,12 +758,13 @@ serialize_cookie (SoupCookie *cookie, GString *header, gboolean set_cookie) if (cookie->expires) { char *timestamp; - - g_string_append (header, "; expires="); timestamp = soup_date_time_to_string (cookie->expires, SOUP_DATE_COOKIE); - g_string_append (header, timestamp); - g_free (timestamp); + if (timestamp) { + g_string_append (header, "; expires="); + g_string_append (header, timestamp); + g_free (timestamp); + } } if (cookie->path) { g_string_append (header, "; path="); diff --git a/libsoup/soup-date-utils.c b/libsoup/soup-date-utils.c index 73f80ab6..71160e73 100644 --- a/libsoup/soup-date-utils.c +++ b/libsoup/soup-date-utils.c @@ -95,6 +95,9 @@ soup_date_time_to_string (GDateTime *date, char *date_format; char *formatted_date; + if (!utcdate) + return NULL; + // We insert days/months ourselves to avoid locale specific formatting if (format == SOUP_DATE_HTTP) { /* "Sun, 06 Nov 1994 08:49:37 GMT" */ -- GitLab From 51665d6b87c6a0084d5acb7aeeefc591c66dc2cd Mon Sep 17 00:00:00 2001 From: Michael Catanzaro Date: Wed, 15 Oct 2025 14:38:28 -0500 Subject: [PATCH 1/2] server: null-check soup_date_time_to_string() Since 9e1a427d2f047439d0320defe1593e6352595788 this function can now fail. --- libsoup/server/soup-server.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libsoup/server/soup-server.c b/libsoup/server/soup-server.c index ba2f2b0b..6b5ab21e 100644 --- a/libsoup/server/soup-server.c +++ b/libsoup/server/soup-server.c @@ -852,6 +852,11 @@ got_headers (SoupServer *server, date = g_date_time_new_now_utc (); date_string = soup_date_time_to_string (date, SOUP_DATE_HTTP); + if (!date_string) { + g_date_time_unref (date); + return; + } + soup_message_headers_replace_common (headers, SOUP_HEADER_DATE, date_string); g_free (date_string); g_date_time_unref (date); -- GitLab From cc1d4389ffd1b70f7eaee3cecfa66664aff2a5ef Mon Sep 17 00:00:00 2001 From: Michael Catanzaro Date: Wed, 15 Oct 2025 16:56:46 -0500 Subject: [PATCH 2/2] cookies-test: add test for invalid timezone Note this test does NOT currently fail because it was already previously fixed by 8988379984e33dcc7d3aa58551db13e48755959f. --- tests/cookies-test.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/tests/cookies-test.c b/tests/cookies-test.c index 18c9b60d..27cf6d9b 100644 --- a/tests/cookies-test.c +++ b/tests/cookies-test.c @@ -470,6 +470,16 @@ do_cookies_parsing_int32_overflow (void) soup_cookie_free (cookie); } +static void +do_cookies_parsing_invalid_timezone (void) +{ + SoupCookie *cookie = soup_cookie_parse ("NAME=VALUE;expires=Mon, 31 Dec 9999 23:59:59 -1000", NULL); + g_test_bug ("https://gitlab.gnome.org/GNOME/libsoup/-/issues/459"); + g_assert_nonnull (cookie); + g_assert_null (soup_cookie_get_expires (cookie)); + soup_cookie_free (cookie); +} + static void do_cookies_equal_nullpath (void) { @@ -729,6 +739,7 @@ main (int argc, char **argv) g_test_add_func ("/cookies/parsing/max-age-int32-overflow", do_cookies_parsing_max_age_int32_overflow); g_test_add_func ("/cookies/parsing/max-age-long-overflow", do_cookies_parsing_max_age_long_overflow); g_test_add_func ("/cookies/parsing/int32-overflow", do_cookies_parsing_int32_overflow); + g_test_add_func ("/cookies/parsing/invalid-timezone", do_cookies_parsing_invalid_timezone); g_test_add_func ("/cookies/parsing/equal-nullpath", do_cookies_equal_nullpath); g_test_add_func ("/cookies/parsing/control-characters", do_cookies_parsing_control_characters); g_test_add_func ("/cookies/parsing/name-value-max-size", do_cookies_parsing_name_value_max_size); -- GitLab