diff -r 80c7d63325f6 Lib/http/cookies.py --- a/Lib/http/cookies.py Wed Jun 29 13:44:05 2011 +0200 +++ b/Lib/http/cookies.py Wed Jun 29 15:27:30 2011 +0100 @@ -552,8 +552,13 @@ M[key] = _unquote(value) else: rval, cval = self.value_decode(value) - self.__set(key, rval, cval) - M = self[key] + try: + self.__set(key, rval, cval) + M = self[key] + except CookieError: + # Postel's law - ignore error. + # Any attributes for an invalid name should also be dropped. + M = None class SimpleCookie(BaseCookie): diff -r 80c7d63325f6 Lib/test/test_http_cookies.py --- a/Lib/test/test_http_cookies.py Wed Jun 29 13:44:05 2011 +0200 +++ b/Lib/test/test_http_cookies.py Wed Jun 29 15:27:30 2011 +0100 @@ -77,6 +77,21 @@ self.assertEqual(C.output(['val']), 'Set-Cookie: val="some\\054funky\\073stuff"') + def test_illegal_names(self): + # Issue 2193: various servers/browsers use/support cookies with ':' in + # the name (RFC2109 notwithstanding). We should deal with them + # gracefully. This means we silently ignore when loading, but raise + # exception when setting in other situations. + + C = cookies.SimpleCookie() + self.assertRaises(cookies.CookieError, + C.__setitem__, 'invalid:name', 'a value') + + C.load('validname=value; invalid:name=value; expires=Wed, 01-Jan-2010 00:00:00 GMT;') + self.assertEqual(repr(C), "") + # Ensure the 'expires' is not attached to 'validname' + self.assertEqual(C.output(), "Set-Cookie: validname=value") + def test_special_attrs(self): # 'expires' C = cookies.SimpleCookie('Customer="WILE_E_COYOTE"')