diff --git a/Lib/http/cookies.py b/Lib/http/cookies.py index fb9589c6aa7..93da62791df 100644 --- a/Lib/http/cookies.py +++ b/Lib/http/cookies.py @@ -173,6 +173,11 @@ class CookieError(Exception): '\033' : '\\033', '\034' : '\\034', '\035' : '\\035', '\036' : '\\036', '\037' : '\\037', + # Because of the way browsers really handle cookies (as opposed + # to what the RFC says) we also encode , and ; + + ',' : '\\054', ';' : '\\073', + '"' : '\\"', '\\' : '\\\\', '\177' : '\\177', '\200' : '\\200', '\201' : '\\201', diff --git a/Lib/test/test_http_cookies.py b/Lib/test/test_http_cookies.py index b008e0ff2a5..f9a98c4ae14 100644 --- a/Lib/test/test_http_cookies.py +++ b/Lib/test/test_http_cookies.py @@ -69,6 +69,14 @@ def test_load(self): """) + def test_extended_encode(self): + # Issue 9824: some browsers don't follow the standard; we now + # encode , and ; to keep them from tripping up. + C = cookies.SimpleCookie() + C['val'] = "some,funky;stuff" + self.assertEqual(C.output(['val']), + 'Set-Cookie: val="some\\054funky\\073stuff"') + def test_special_attrs(self): # 'expires' C = cookies.SimpleCookie('Customer="WILE_E_COYOTE"') diff --git a/Misc/NEWS b/Misc/NEWS index f69abcf1d1a..8eec18e3216 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -20,6 +20,9 @@ Core and Builtins Library ------- +- Issue 9824: SimpleCookie now encodes , and ; in values to cater to how + browsers actually parse cookies. + - Issue 9333: os.symlink now available regardless of user privileges. The function now raises OSError on Windows >=6.0 when the user is unable to create symbolic links. XP and 2003 still raise NotImplementedError.