You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Make join_header_words() more similar to the original #130631
Currently http.cookiejar.join_header_words() uses re.search(r"^\w+$", v) to check whether the value can be represented as a token, unquoted. There are some red flags here:
\w looks arbitrary. And it is. The original Perl implementation (it is now in HTTP::Headers::Util) uses a set of characters documented in the split_header_words() docstring. On one side, it allows more characters (like "." or "-") be unquoted, on other hand, it requires quoting non-ASCII letters and digits.
$ matches not only the end of the string, but also a position just before \n. So this pattern does not work for value containing \n. I do not know whether such values are supported at higher level, but currently that code is prone to header injection.
Using search() with anchors at both ends for testing the whole string is very outdated, this patterns precedes the current re module. First, match() was added to testing the match from beginning, and later fullmatch() was added for testing the whole string.
Activity
pythongh-130631: Make join_header_words() more similar to the origina…
gh-130631: Make join_header_words() more similar to the original Perl…
[3.13] pythongh-130631: Make join_header_words() more similar to the …
[3.13] gh-130631: Make join_header_words() more similar to the origin…
Fix CookieTests following fix for CPython #130631
tests: Fix cookie test compatibility with Python 3.13.4+
tests: Fix cookie test compatibility with Python 3.13.4+