diff -r cdfcd00873cd Lib/Cookie.py --- a/Lib/Cookie.py Tue Jun 28 20:13:03 2011 -0700 +++ b/Lib/Cookie.py Wed Jun 29 15:29:20 2011 +0100 @@ -662,8 +662,13 @@ M[ K ] = _unquote(V) else: rval, cval = self.value_decode(V) - self.__set(K, rval, cval) - M = self[K] + try: + self.__set(K, rval, cval) + M = self[K] + except CookieError: + # Postel's law - ignore error. + # Any attributes for an invalid name should also be dropped. + M = None # end __ParseString # end BaseCookie class diff -r cdfcd00873cd Lib/test/test_cookie.py --- a/Lib/test/test_cookie.py Tue Jun 28 20:13:03 2011 -0700 +++ b/Lib/test/test_cookie.py Wed Jun 29 15:29:20 2011 +0100 @@ -80,6 +80,21 @@ self.assertEqual(C.output(['val']), 'Set-Cookie: val="some\\054funky\\073stuff"') + def test_illegal_names(self): + # Issue 2193: various servers/browsers use/support cookies with ':' in + # the name (RFC2109 notwithstanding). We should deal with them + # gracefully. This means we silently ignore when loading, but raise + # exception when setting in other situations. + + C = Cookie.SimpleCookie() + self.assertRaises(Cookie.CookieError, + C.__setitem__, 'invalid:name', 'a value') + + C.load('validname=value; invalid:name=value; expires=Wed, 01-Jan-2010 00:00:00 GMT;') + self.assertEqual(repr(C), "") + # Ensure the 'expires' is not attached to 'validname' + self.assertEqual(C.output(), "Set-Cookie: validname=value") + def test_quoted_meta(self): # Try cookie with quoted meta-data C = Cookie.SimpleCookie()