1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
|
From 811f8df8521b0850f5c79931e2e8c17113dda421 Mon Sep 17 00:00:00 2001
From: Gyorgy Sarvari <skandigraun@gmail.com>
Date: Sat, 3 Jan 2026 02:53:03 +0000
Subject: [PATCH] Log once per cookie header (#11909)
From: patchback[bot] <45432694+patchback[bot]@users.noreply.github.com>
**This is a backport of PR #11890 as merged into master
(384a173022c9d057110c1418c5c4ff83a321900f).**
Co-authored-by: Sam Bull <git@sambull.org>
CVE: CVE-2025-69230
Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/64629a0834f94e46d9881f4e99c41a137e1f3326]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
aiohttp/_cookie_helpers.py | 8 +++++++-
tests/test_cookie_helpers.py | 8 ++++++--
tests/test_web_request.py | 17 +++++++++++++++++
3 files changed, 30 insertions(+), 3 deletions(-)
diff --git a/aiohttp/_cookie_helpers.py b/aiohttp/_cookie_helpers.py
index 4e9fc96..4edaa31 100644
--- a/aiohttp/_cookie_helpers.py
+++ b/aiohttp/_cookie_helpers.py
@@ -181,6 +181,7 @@ def parse_cookie_header(header: str) -> List[Tuple[str, Morsel[str]]]:
i = 0
n = len(header)
+ invalid_names = []
while i < n:
# Use the same pattern as parse_set_cookie_headers to find cookies
match = _COOKIE_PATTERN.match(header, i)
@@ -193,7 +194,7 @@ def parse_cookie_header(header: str) -> List[Tuple[str, Morsel[str]]]:
# Validate the name
if not key or not _COOKIE_NAME_RE.match(key):
- internal_logger.warning("Can not load cookie: Illegal cookie name %r", key)
+ invalid_names.append(key)
continue
# Create new morsel
@@ -209,6 +210,11 @@ def parse_cookie_header(header: str) -> List[Tuple[str, Morsel[str]]]:
cookies.append((key, morsel))
+ if invalid_names:
+ internal_logger.debug(
+ "Cannot load cookie. Illegal cookie names: %r", invalid_names
+ )
+
return cookies
diff --git a/tests/test_cookie_helpers.py b/tests/test_cookie_helpers.py
index 6deef65..28addb2 100644
--- a/tests/test_cookie_helpers.py
+++ b/tests/test_cookie_helpers.py
@@ -1,5 +1,7 @@
"""Tests for internal cookie helper functions."""
+import logging
+
from http.cookies import (
CookieError,
Morsel,
@@ -1374,14 +1376,16 @@ def test_parse_cookie_header_illegal_names(caplog: pytest.LogCaptureFixture) ->
"""Test parse_cookie_header warns about illegal cookie names."""
# Cookie name with comma (not allowed in _COOKIE_NAME_RE)
header = "good=value; invalid,cookie=bad; another=test"
- result = parse_cookie_header(header)
+ with caplog.at_level(logging.DEBUG):
+ result = parse_cookie_header(header)
# Should skip the invalid cookie but continue parsing
assert len(result) == 2
assert result[0][0] == "good"
assert result[0][1].value == "value"
assert result[1][0] == "another"
assert result[1][1].value == "test"
- assert "Can not load cookie: Illegal cookie name 'invalid,cookie'" in caplog.text
+ assert "Cannot load cookie. Illegal cookie name" in caplog.text
+ assert "'invalid,cookie'" in caplog.text
@pytest.mark.parametrize(
|
