[Python-checkins] cpython (3.5): Issue #26302: Correctly identify comma as an invalid character for a cookie

[jason.coombs]

https://hg.python.org/cpython/rev/758cb13aaa2c
changeset:   100316:758cb13aaa2c
branch:      3.5
parent:      100314:9bffe39e8273
user:        Anish Shah <anish.shah>
date:        Sun Feb 07 05:36:00 2016 +0500
summary:
  Issue #26302: Correctly identify comma as an invalid character for a cookie (correcting regression in Python 3.5).

files:
  Lib/http/cookies.py           |  2 +-
  Lib/test/test_http_cookies.py |  6 ++++++
  Misc/NEWS                     |  3 +++
  3 files changed, 10 insertions(+), 1 deletions(-)


diff --git a/Lib/http/cookies.py b/Lib/http/cookies.py
--- a/Lib/http/cookies.py
+++ b/Lib/http/cookies.py
@@ -174,7 +174,7 @@
     ord('\\'): '\\\\',
 })
 
-_is_legal_key = re.compile('[%s]+' % _LegalChars).fullmatch
+_is_legal_key = re.compile('[%s]+' % re.escape(_LegalChars)).fullmatch
 
 def _quote(str):
     r"""Quote a string for use in a cookie header.
diff --git a/Lib/test/test_http_cookies.py b/Lib/test/test_http_cookies.py
--- a/Lib/test/test_http_cookies.py
+++ b/Lib/test/test_http_cookies.py
@@ -210,6 +210,12 @@
                 C1 = pickle.loads(pickle.dumps(C, protocol=proto))
                 self.assertEqual(C1.output(), expected_output)
 
+    def test_illegal_chars(self):
+        rawdata = "a=b; c,d=e"
+        C = cookies.SimpleCookie()
+        with self.assertRaises(cookies.CookieError):
+            C.load(rawdata)
+
 
 class MorselTests(unittest.TestCase):
     """Tests for the Morsel object."""
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@
 Core and Builtins
 -----------------
 
+- Issue #26302: Correct behavior to reject comma as a legal character for
+  cookie names.
+
 - Issue #4806: Avoid masking the original TypeError exception when using star
   (*) unpacking in function calls.  Based on patch by Hagen Fürstenau and
   Daniel Urban.

-- 
Repository URL: https://hg.python.org/cpython