For Morsel cookies requests expects wrong Expires time format

Abierto
  • ¿Algo no está bien?
#6,004 9 comentarios 3 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

  • #7541 de @lin-hongkuan — cerrado sin fusionar

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
48/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Estancado
Stack tecnológico
python
Área
backend

Línea de trabajo

Inspecciona requests/cookie.py, especialmente morsel_to_cookie y su formato time_template. Reproduce el fallo con el ejemplo proporcionado de SimpleCookie y RequestsCookieJar; la tarea estará terminada cuando las cookies Morsel que usan el formato Expires descrito por RFC y separado por espacios se acepten sin ValueError.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

I'm not sure about this, but it looks that requests is expecting invalid date format in Expires section in Cookies passed as Morsel objects.

morsel_to_cookie (from requests/cookie.py) function parse expires attr if there is no max-age (which is OK) using format from time_template. However this format is set as '%a, %d-%b-%Y %H:%M:%S GMT' which is none of allowed expires section date value described in RFC (https://www.rfc-editor.org/rfc/rfc6265#section-4.1.1).

The nearest format is the first choice from https://www.rfc-editor.org/rfc/rfc2616#section-3.3.1. The difference is that between date parts there should be a space, but requests expects dash.

See Reproduction Steps for very simple example which bases on Python std libs only and crashes.

Expected Result

It's expected that requests properly accepts Morsel cookies when expires follows RFC https://www.rfc-editor.org/rfc/rfc2616#section-3.3.1.

Actual Result

There is ValueError raised by strptime that passed value does not match format.
Example:
ValueError: time data 'Thu, 01 Jan 1970 00:00:00 GMT' does not match format '%a, %d-%b-%Y %H:%M:%S GMT'

Reproduction Steps

    from http.cookies import SimpleCookie
    from requests.cookies import RequestsCookieJar
    cookies = SimpleCookie()
    cookies.load('auth_session=null; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; httponly; samesite=strict')

    jar = RequestsCookieJar()
    jar.update(cookies)

Example above is a simplified case of using async_asgi_testclient to test application written with Starlette with SessionMiddleware. The async_asgi_testclient collects cookies using SimpleCookie class from standard http lib and then pass them to requests lib which is used to perform client test requests.

But this issue is not related to these packages as I reproduced it using only Python standard http lib and requests as above.

System Information

$ python -m requests.help

{
  "chardet": {
    "version": "4.0.0"
  },
  "charset_normalizer": {
    "version": "2.0.9"
  },
  "cryptography": {
    "version": ""
  },
  "idna": {
    "version": "3.3"
  },
  "implementation": {
    "name": "CPython",
    "version": "3.9.9"
  },
  "platform": {
    "release": "5.15.0-1-amd64",
    "system": "Linux"
  },
  "pyOpenSSL": {
    "openssl_version": "",
    "version": null
  },
  "requests": {
    "version": "2.26.0"
  },
  "system_ssl": {
    "version": "101010cf"
  },
  "urllib3": {
    "version": "1.26.7"
  },
  "using_charset_normalizer": false,
  "using_pyopenssl": false
}
Lenguaje dominante
Python
Estrellas
54.7k
Forks
10.8k
Merge medio
18 min
PR fusionados (30 d)
1

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de psf/requests

Todos los issues de psf/requests

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.