From 4f43832180a144d9c4494bec69842df09118890e Mon Sep 17 00:00:00 2001 From: Ashley Harvey Date: Tue, 3 Sep 2019 20:33:21 -0700 Subject: [PATCH 1/5] Patch cookiejar.py; relax case-sensitive regex on an inconsequential line in the cookie file. --- Lib/http/cookiejar.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Lib/http/cookiejar.py b/Lib/http/cookiejar.py index db8238235718133..e07a4cb1bc37ecc 100644 --- a/Lib/http/cookiejar.py +++ b/Lib/http/cookiejar.py @@ -1999,7 +1999,7 @@ class MozillaCookieJar(FileCookieJar): header by default (Mozilla can cope with that). """ - magic_re = re.compile("#( Netscape)? HTTP Cookie File") + magic_re = re.compile("#( Netscape)? HTTP Cookie File", re.IGNORECASE) header = """\ # Netscape HTTP Cookie File # http://curl.haxx.se/rfc/cookie_spec.html From 7e6523e010cb7dbb0ce6bf01857af9abe82c62a0 Mon Sep 17 00:00:00 2001 From: Ashley Harvey Date: Tue, 3 Sep 2019 20:45:07 -0700 Subject: [PATCH 2/5] Added self to ACKS. --- Misc/ACKS | 1 + 1 file changed, 1 insertion(+) diff --git a/Misc/ACKS b/Misc/ACKS index ce8b144900ebc02..eeb50e6f414a4b0 100644 --- a/Misc/ACKS +++ b/Misc/ACKS @@ -1888,3 +1888,4 @@ Robert Leenders Tim Hopper Dan Lidral-Porter Ngalim Siregar +Ashley Harvey From 5181e0f2a1660f8f71e02f3b0482a1d46bacdb9e Mon Sep 17 00:00:00 2001 From: Ashley Harvey Date: Wed, 4 Sep 2019 14:14:23 -0700 Subject: [PATCH 3/5] Change position of name to comply with sorting in Misc/ACKs --- Misc/ACKS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Misc/ACKS b/Misc/ACKS index eeb50e6f414a4b0..36da1fceb39141f 100644 --- a/Misc/ACKS +++ b/Misc/ACKS @@ -646,6 +646,7 @@ David Harrigan Brian Harring Jonathan Hartley Travis B. Hartwell +Ashley Harvey Shane Harvey Larry Hastings Tim Hatch @@ -1888,4 +1889,3 @@ Robert Leenders Tim Hopper Dan Lidral-Porter Ngalim Siregar -Ashley Harvey From b37b256abfad87da96977af732c618c2ad9d0f61 Mon Sep 17 00:00:00 2001 From: Oleg Iarygin Date: Sat, 11 Feb 2023 09:49:59 +0400 Subject: [PATCH 4/5] Add a news entry --- .../next/Library/2023-02-11-09-49-49.gh-issue-82039.caTE7O.rst | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 Misc/NEWS.d/next/Library/2023-02-11-09-49-49.gh-issue-82039.caTE7O.rst diff --git a/Misc/NEWS.d/next/Library/2023-02-11-09-49-49.gh-issue-82039.caTE7O.rst b/Misc/NEWS.d/next/Library/2023-02-11-09-49-49.gh-issue-82039.caTE7O.rst new file mode 100644 index 000000000000000..cb75ae83780eaf6 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2023-02-11-09-49-49.gh-issue-82039.caTE7O.rst @@ -0,0 +1,2 @@ +:meth:`http.cookiejar.FileCookieJar.load` now checks the first, format +signature line in a case-insensitive manner. Patch by Ashley Harvey. From 5f6f42a82ec7cd1b380d738cfd795ed005be330a Mon Sep 17 00:00:00 2001 From: Serhiy Storchaka Date: Tue, 11 Aug 2026 19:25:29 +0300 Subject: [PATCH 5/5] Match the signature line only in ASCII, and add tests --- Lib/http/cookiejar.py | 2 +- Lib/test/test_http_cookiejar.py | 25 +++++++++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/Lib/http/cookiejar.py b/Lib/http/cookiejar.py index 29ee436f71afe14..302bd3676a8144d 100644 --- a/Lib/http/cookiejar.py +++ b/Lib/http/cookiejar.py @@ -54,7 +54,7 @@ def _debug(*args): HTTPONLY_PREFIX = "#HttpOnly_" DEFAULT_HTTP_PORT = str(http.client.HTTP_PORT) NETSCAPE_MAGIC_RGX = re.compile("#( Netscape)? HTTP Cookie File", - re.IGNORECASE) + re.IGNORECASE | re.ASCII) MISSING_FILENAME_TEXT = ("a filename was not supplied (nor was the CookieJar " "instance initialised with one)") NETSCAPE_HEADER_TEXT = """\ diff --git a/Lib/test/test_http_cookiejar.py b/Lib/test/test_http_cookiejar.py index 04cb440cd4ccf66..7f39b5c772bd10f 100644 --- a/Lib/test/test_http_cookiejar.py +++ b/Lib/test/test_http_cookiejar.py @@ -459,6 +459,31 @@ def test_bad_magic(self): finally: os_helper.unlink(filename) + def test_magic_ignores_case(self): + filename = os_helper.TESTFN + self.addCleanup(os_helper.unlink, filename) + for magic in ("# Netscape HTTP Cookie File", + "# netscape http cookie file", + "# HTTP Cookie File", + "# http cookie file"): + with self.subTest(magic=magic): + with open(filename, "w") as f: + f.write(magic + "\n") + MozillaCookieJar().load(filename) + + def test_magic_is_not_unicode(self): + # Unicode case folding must not be used: 'ſ' (U+017F) and 'K' + # (U+212A) are case-insensitively equal to 's' and 'k' in Unicode. + filename = os_helper.TESTFN + self.addCleanup(os_helper.unlink, filename) + for magic in ("# Netſcape HTTP Cookie File", + "# Netscape HTTP CooKie File"): + with self.subTest(magic=magic): + with open(filename, "w", encoding="utf-8") as f: + f.write(magic + "\n") + self.assertRaises(LoadError, MozillaCookieJar().load, filename) + + class CookieTests(unittest.TestCase): # XXX # Get rid of string comparisons where not actually testing str / repr.