GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-161707: Refuse `;` in all cookie attributes except Comment by brettcs · Pull Request #161711 · python/cpython

Conversation

@brettcs

@brettcs brettcs commented Nov 9, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

See #161707 (comment) for an explanation of why I chose this approach.

  • Issue: Cookie Attribute Injection via Unescaped Semicolons in http.cookies.Morsel.OutputString() #161707

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@brettcs
pythongh-161707: Refuse ; in all cookie attributes except Comment
95a73b6
@bedevere-app bedevere-app Bot mentioned this pull request Nov 9, 2026
Cookie Attribute Injection via Unescaped Semicolons in http.cookies.Morsel.OutputString() #161707
Open
@bedevere-app bedevere-app Bot added the awaiting review label Nov 9, 2026
@read-the-docs-community

read-the-docs-community Bot commented Nov 9, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #35814070 | 📁 Comparing 1937b34 against main (78407da)

  🔍 Preview build  

46 files changed · ± 46 modified

± Modified

  • glossary.html
  • index.html
  • c-api/code.html
  • c-api/conversion.html
  • c-api/dict.html
  • c-api/exceptions.html
  • c-api/file.html
  • c-api/frame.html
  • c-api/init_config.html
  • c-api/profiling.html
  • and 36 more...
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
brettcs added 2 commits November 10, 2026 08:38
@brettcs
pythongh-161707: Fix reference in NEWS entry
ab8bcb8
@brettcs
pythongh-161707: Return the lowercase key from validation
610dafc 
This makes the API easier to use well: the caller and the validator don't both
have to call `key.lower()`.
sethmlarson
sethmlarson reviewed Nov 10, 2026
View reviewed changes

@sethmlarson sethmlarson left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Implementation LGTM, one comment on the documentation.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread Doc/library/http.cookies.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread Doc/library/http.cookies.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.
@sethmlarson

sethmlarson commented Nov 10, 2026

Copy link
Copy Markdown
Contributor

@vstinner You reviewed my previous change in this area, could I ask for a second-set of eyes?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
brettcs added 2 commits November 10, 2026 15:49
@brettcs
pythongh-161707: Refine doc markup
84264de
@brettcs
pythongh-161707: Explain that comment is an exception because it's es…
981a55f 
…caped
@brettcs
brettcs requested a review from orsenthil as a code owner November 10, 2026 20:56
@brettcs
pythongh-161707: Correct blurb markup
a7ffa89
vstinner
vstinner approved these changes Nov 10, 2026
View reviewed changes

@vstinner vstinner left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mostly LGTM, I have a few minor suggestions.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread Lib/test/test_http_cookies.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread Lib/test/test_http_cookies.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread Lib/http/cookies.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting review labels Nov 10, 2026
@brettcs @vstinner
Apply suggestions from code review
1937b34 
Co-authored-by: Victor Stinner <[email protected]>
@brettcs

brettcs commented Nov 11, 2026

Copy link
Copy Markdown
Contributor Author

All those changes sound good to me, thanks. I've updated the branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
orsenthil
orsenthil approved these changes Nov 11, 2026
View reviewed changes

@orsenthil orsenthil left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Rebase against the main will get CI to green here.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@brettcs
Merge branch 'main' into reject-semicolon-attribute-values
b5ac6eb
@sethmlarson sethmlarson added the type-security A security issue label Nov 12, 2026
sethmlarson
sethmlarson approved these changes Nov 12, 2026
View reviewed changes

@sethmlarson sethmlarson left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks! Will merge once CI is all green.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@brettcs

brettcs commented Nov 12, 2026

Copy link
Copy Markdown
Contributor Author

readthedocs CI appears to be stuck. GitHub is waiting for status but the details say it was aborted early for inactivity (?).
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@StanFromIreland

StanFromIreland commented Nov 12, 2026

Copy link
Copy Markdown
Member

It’s fine to merge, RTD can be flakey like this, but the docs CI passed.
sethmlarson reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@sethmlarson
sethmlarson merged commit 2702684 into python:main Nov 12, 2026
54 of 55 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting merge label Nov 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vstinner vstinner vstinner approved these changes
@orsenthil orsenthil orsenthil approved these changes
@sethmlarson sethmlarson sethmlarson approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

5 participants

@brettcs @sethmlarson @StanFromIreland @vstinner @orsenthil
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.