<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><br></div><div><br>On Feb 6, 2013, at 6:32 PM, Donald Stufft <<a href="mailto:donald.stufft@gmail.com">donald.stufft@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div>
<div><span style="color: rgb(160, 160, 168); ">On Wednesday, February 6, 2013 at 6:26 PM, <a href="mailto:martin@v.loewis.de">martin@v.loewis.de</a> wrote:</span></div><blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px;">
<span><div><div><blockquote type="cite"><div><blockquote type="cite"><div><div>No, it doesn't. Cookies for "<a href="http://python.org">python.org</a>" are not available to </div><div>"<a href="http://packages.python.org">packages.python.org</a>".</div><div>It would have to be a cookie for ".<a href="http://python.org">python.org</a>". We don't issue such cookies.</div></div></blockquote><div><br></div><div>Regards,</div><div>Martin</div></div></blockquote><div><br></div><blockquote type="cite"><div>We probably will on the new site.</div></blockquote><div><br></div><div>How can you know already? It would be a mistake that's easy to avoid.</div><div><br></div></div></div></span></blockquote><div>Doesn't matter either way, they are functionally equivalent.
</div>
</div></blockquote><div><br></div><div>We at very least have to strip out JavaScript completely from uploads. And form elements; any browser things that allow local storage - the list goes on.</div><div><br></div><div>Even if we don't have cookies on the main site; you can hijack sessions/cookies/etc from *.<a href="http://python.org">python.org</a> via a malicious upload. This probably includes the wiki. </div><div><br></div><div>This doesn't even touch on the fact the pypi mirrors need to have proper ssl security in place lest different hijacking occurs as well.</div><div><br></div><div><br></div><br><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Catalog-SIG mailing list</span><br><span><a href="mailto:Catalog-SIG@python.org">Catalog-SIG@python.org</a></span><br><span><a href="http://mail.python.org/mailman/listinfo/catalog-sig">http://mail.python.org/mailman/listinfo/catalog-sig</a></span><br></div></blockquote></body></html>