psf / psf/requests

Cookie with empty value crashes when wrapping jar into dict

Open
#5,348 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
54.3k
Forks
10.4k
Avg merge
16h 43m
Merged PRs (30d)
3

Description

KeyError is raised instead of returning the single cookie, if the cookie value is empty.

From the source code it is obvious that it will fail like that. Specifically, line https://github.com/psf/requests/blob/master/requests/cookies.py#L397 says:

        if toReturn:
            return toReturn

Which mean empty value will be considered as invalid (RFC allows empty cookie value).

The fix is simple - make the check if toReturn is not None.

Expected Result

Expected to get dict printed.

Actual Result

KeyError: "name='authCke', domain=None, path=None" raised

Reproduction Steps

Bear with bootstrapping, I made it to avoid actual network code that needs to authenticate first.

from http.client import HTTPMessage

from requests import PreparedRequest
from requests.cookies import RequestsCookieJar, MockResponse, MockRequest

raw = 'authCke=; domain=.opentable.com; expires=Mon, 18-May-2020 08:38:10 GMT; path=/;SameSite=None'
headers = HTTPMessage()
headers.add_header('set-cookie', raw)
jar = RequestsCookieJar()
resp = MockResponse(headers)
req = PreparedRequest()
req.headers = {}
req.url = 'https://opentable.com/'
req = MockRequest(req)
jar.extract_cookies(resp, req)
print(dict(jar))

System Information

$ python -m requests.help
{
  "chardet": {
    "version": "3.0.4"
  },
  "cryptography": {
    "version": "2.1.4"
  },
  "idna": {
    "version": "2.8"
  },
  "implementation": {
    "name": "CPython",
    "version": "3.6.9"
  },
  "platform": {
    "release": "4.15.0-76-generic",
    "system": "Linux"
  },
  "pyOpenSSL": {
    "openssl_version": "1010100f",
    "version": "18.0.0"
  },
  "requests": {
    "version": "2.22.0"
  },
  "system_ssl": {
    "version": "1010100f"
  },
  "urllib3": {
    "version": "1.25.7"
  },
  "using_pyopenssl": true
}

This command is only available on Requests v2.16.4 and greater. Otherwise,
please provide some basic information about your system (Python version,
operating system, &c).

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in requests/cookies.py around line 397, focusing on the RequestsCookieJar conversion used by dict(jar). Run the provided empty-value cookie reproduction and confirm that it returns a dictionary containing the cookie rather than raising KeyError; the change is complete when this behavior is covered and remains correct.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.