gh-154546: Validate cookie key before applying in BaseCookie.load()

Author: tonghuaroot

Lib/http/cookies.py

@@ -618,6 +618,8 @@ def __parse_string(self, str, patt=_CookiePattern):
                 else:
                     parsed_items.append((TYPE_ATTRIBUTE, key, _unquote(value)))
             elif value is not None:
+                if not _is_legal_key(key):
+                    raise CookieError('Illegal key %r' % (key,))
                 parsed_items.append((TYPE_KEYVALUE, key, self.value_decode(value)))
                 morsel_seen = True
             else:

Lib/test/test_http_cookies.py

@@ -320,6 +320,12 @@ def test_illegal_chars(self):
         with self.assertRaises(cookies.CookieError):
             C.load(rawdata)
 
+    def test_illegal_key_no_partial_state(self):
+        C = cookies.SimpleCookie()
+        with self.assertRaises(cookies.CookieError):
+            C.load("a=1; b,c=2; d=3")
+        self.assertEqual(len(C), 0)
+
     def test_comment_quoting(self):
         c = cookies.SimpleCookie()
         c['foo'] = '\N{COPYRIGHT SIGN}'

Misc/NEWS.d/next/Library/2026-07-18-12-00-00.gh-issue-154546.CkPrt5.rst

@@ -0,0 +1,4 @@
+Validate cookie key characters during parsing in
+:meth:`http.cookies.BaseCookie.load` so that an illegal key raises
+:exc:`~http.cookies.CookieError` before any cookies are applied.  Patch by
+tonghuaroot.