Bug description
http.cookiejar.http2time() documents that it returns None for an
unrecognized date format, but its STRICT_DATE_RE fast path raises a raw
ValueError when the month field matches the pattern [JFMASOND][a-z][a-z]
yet names a month that does not exist:
>>> from http.cookiejar import http2time
>>> http2time('Wed, 09 Foo 1994 22:23:32 GMT')
Traceback (most recent call last):
...
ValueError: 'foo' is not in list
>>> http2time('Wed, 09 Feb 1994 22:23:32 GMT') # a real month still works
760832612.0
The slower parser (_str2time) already handles the same input via
try/except and returns None; only the strict fast path leaks. It is
reachable from parse_ns_headers() through a cookie's expires= attribute,
e.g. Set-Cookie: x=y; expires=Wed, 09 Foo 1994 22:23:32 GMT.
gh-60385 previously established the "returns None, never raises" contract
for a different http2time code path; the later STRICT_DATE_RE fast path
reintroduced a leak on this separate path.
CPython versions tested on
3.13, 3.14, 3.15
Operating systems tested on
Linux, macOS
Linked PRs
Bug description
http.cookiejar.http2time()documents that it returnsNonefor anunrecognized date format, but its
STRICT_DATE_REfast path raises a rawValueErrorwhen the month field matches the pattern[JFMASOND][a-z][a-z]yet names a month that does not exist:
The slower parser (
_str2time) already handles the same input viatry/exceptand returnsNone; only the strict fast path leaks. It isreachable from
parse_ns_headers()through a cookie'sexpires=attribute,e.g.
Set-Cookie: x=y; expires=Wed, 09 Foo 1994 22:23:32 GMT.gh-60385 previously established the "returns
None, never raises" contractfor a different
http2timecode path; the laterSTRICT_DATE_REfast pathreintroduced a leak on this separate path.
CPython versions tested on
3.13, 3.14, 3.15
Operating systems tested on
Linux, macOS
Linked PRs