From 811f8df8521b0850f5c79931e2e8c17113dda421 Mon Sep 17 00:00:00 2001 From: Gyorgy Sarvari Date: Sat, 3 Jan 2026 02:53:03 +0000 Subject: [PATCH] Log once per cookie header (#11909) From: patchback[bot] <45432694+patchback[bot]@users.noreply.github.com> **This is a backport of PR #11890 as merged into master (384a173022c9d057110c1418c5c4ff83a321900f).** Co-authored-by: Sam Bull CVE: CVE-2025-69230 Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/64629a0834f94e46d9881f4e99c41a137e1f3326] Signed-off-by: Gyorgy Sarvari --- aiohttp/_cookie_helpers.py | 8 +++++++- tests/test_cookie_helpers.py | 8 ++++++-- tests/test_web_request.py | 17 +++++++++++++++++ 3 files changed, 30 insertions(+), 3 deletions(-) diff --git a/aiohttp/_cookie_helpers.py b/aiohttp/_cookie_helpers.py index 4e9fc96..4edaa31 100644 --- a/aiohttp/_cookie_helpers.py +++ b/aiohttp/_cookie_helpers.py @@ -181,6 +181,7 @@ def parse_cookie_header(header: str) -> List[Tuple[str, Morsel[str]]]: i = 0 n = len(header) + invalid_names = [] while i < n: # Use the same pattern as parse_set_cookie_headers to find cookies match = _COOKIE_PATTERN.match(header, i) @@ -193,7 +194,7 @@ def parse_cookie_header(header: str) -> List[Tuple[str, Morsel[str]]]: # Validate the name if not key or not _COOKIE_NAME_RE.match(key): - internal_logger.warning("Can not load cookie: Illegal cookie name %r", key) + invalid_names.append(key) continue # Create new morsel @@ -209,6 +210,11 @@ def parse_cookie_header(header: str) -> List[Tuple[str, Morsel[str]]]: cookies.append((key, morsel)) + if invalid_names: + internal_logger.debug( + "Cannot load cookie. Illegal cookie names: %r", invalid_names + ) + return cookies diff --git a/tests/test_cookie_helpers.py b/tests/test_cookie_helpers.py index 6deef65..28addb2 100644 --- a/tests/test_cookie_helpers.py +++ b/tests/test_cookie_helpers.py @@ -1,5 +1,7 @@ """Tests for internal cookie helper functions.""" +import logging + from http.cookies import ( CookieError, Morsel, @@ -1374,14 +1376,16 @@ def test_parse_cookie_header_illegal_names(caplog: pytest.LogCaptureFixture) -> """Test parse_cookie_header warns about illegal cookie names.""" # Cookie name with comma (not allowed in _COOKIE_NAME_RE) header = "good=value; invalid,cookie=bad; another=test" - result = parse_cookie_header(header) + with caplog.at_level(logging.DEBUG): + result = parse_cookie_header(header) # Should skip the invalid cookie but continue parsing assert len(result) == 2 assert result[0][0] == "good" assert result[0][1].value == "value" assert result[1][0] == "another" assert result[1][1].value == "test" - assert "Can not load cookie: Illegal cookie name 'invalid,cookie'" in caplog.text + assert "Cannot load cookie. Illegal cookie name" in caplog.text + assert "'invalid,cookie'" in caplog.text @pytest.mark.parametrize(