http.cookies: parser accepts key characters that Morsel.set then rejects

[UnitedMarsupials]

Bug report

Bug description:

SimpleCookie.load() extracts cookie names using _LegalKeyChars, which deliberately admits characters RFC 6265 forbids in a token — the comment above it cites MSIE non-compliance as the reason. Morsel.set() then validates with _is_legal_key, built from _LegalChars, which excludes them. Twelve separator characters differ, so any Set-Cookie whose name contains one raises CookieError even though the module's own parser accepted it.

Encountered in the wild: F5 BIG-IP load balancers emit a persistence cookie named for the partition path, /Common/.app/--pool. Browsers accept this...

from http.cookies import SimpleCookie
SimpleCookie('/a/b=1')      # also a@b=1, a,b=1, a(b)=1

CPython versions tested on:

3.14

Operating systems tested on:

Linux

[JC230903]

Hi, could anyone assign me this issue? I would love to work on this.

[lazerg]

I think we shouldn't fix this, at least not as a quick patch. The bug is real: the parser's _LegalKeyChars accepts separators like @ , / ( ) = that Morsel.set's _LegalChars then rejects, so parsing accepts keys the apply step turns around and raises CookieError on.

Every fix I can think of runs into a policy call that's already been rejected once. Widening _LegalChars changes Set-Cookie output and goes against bpo-26302, which specifically bans comma as a legal name character. Narrowing _LegalKeyChars was proposed before and closed as "a pragmatic choice" pending real-world browser evidence. Skipping the bad cookie instead of raising was rejected too, and it breaks the documented contract that CookieError gets raised.

http.cookies has had three CVEs recently, and the last regex change here (gh-92936) had to be fully reverted after becoming a ReDoS release blocker. This feels like something that needs a core dev's call, not a drive-by PR, so I'm stepping back from it.

[UnitedMarsupials]

At the very least, the _LegalChars and the _LegalKeyChars should be the same set of characters, whatever it is... Preferably, the same variable.

I'm also wondering, why check the name at all -- why not accept whatever the server chooses to present?