Repository navigation
Cross-origin cookie mishandling #705
Description
Hey there!
I belong to an open source security research community, and a member (@ranjit-git) has found an issue, but doesn’t know the best way to disclose it.
If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.
Thank you for your consideration, and I look forward to hearing from you!
(cc @huntr-helper)
Activity
tarcieri commentedon Jan 6, 2022
Please email me at bascule@gmail.com to follow up.
A SECURITY.md is a good idea as well.
JamieSlome commentedon Jan 7, 2022
@tarcieri - thanks for the response!
If you prefer, you can view the report directly here:
https://huntr.dev/bounties/2282338f-f8f6-436c-92c7-fab8da8ff3ab/
It is private and only accessible to maintainers with repository write permissions 🤝
tarcieri commentedon Jan 8, 2022
Can you go ahead and open a public issue for this?
Since it relies on a trusted site redirecting to a potentially malicious site, it doesn't seem particularly exploitable to me.
cc @ranjit-git
tarcieri commentedon Jan 8, 2022
I also thought we were relying on
HTTP::CookieJar's scoping rules... curious if it's actually an upstream bug in that? https://github.com/httprb/http/pull/613/filesAlso related: #631
ixti commentedon Jan 8, 2022
I'll take a look this weekend.
tarcieri commentedon Dec 13, 2023
Whatever behavior might be incorrect here was probably implemented in #613
sferik commentedon Mar 12, 2026
I can’t see the issue on huntr.dev despite being a maintainer of this repo and authenticating with GitHub, but I gather the issue is similar to #516, which has been resolved. Please reopen if this is actually about something else.
Also SECURITY.md has been added, which is a positive that resulted from this issue. Thank you for reporting this @JamieSlome!
[-]Found a possible security concern[/-][+]Cross-origin cookie mishandling[/+]