gh-143919: Reject control characters in http cookies by sethmlarson · Pull Request #143920 · python/cpython · GitHub
Skip to content

gh-143919: Reject control characters in http cookies - #143920

Merged
sethmlarson merged 5 commits into
python:mainfrom
sethmlarson:reject-control-characters-http-cookies
Jan 20, 2026
Merged

sethmlarson merged 5 commits into
python:mainfrom
sethmlarson:reject-control-characters-http-cookies

Conversation

@sethmlarson

@sethmlarson sethmlarson commented Jan 16, 2026

Copy link
Copy Markdown
Contributor

@sethmlarson
sethmlarson requested a review from gpshead January 16, 2026 17:33
@sethmlarson sethmlarson added type-security A security issue needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Jan 16, 2026
Comment thread Lib/test/test_http_cookies.py
Co-authored-by: Bartosz Sławecki <bartosz@ilikepython.com>
Comment thread Lib/http/cookies.py Outdated
Co-authored-by: sobolevn <mail@sobolevn.me>
@Yhg1s Yhg1s changed the title gh-143919: Reject control characters http cookies gh-143919: Reject control characters in http cookies Jan 19, 2026
@sethmlarson
sethmlarson enabled auto-merge (squash) January 20, 2026 20:58
@sethmlarson
sethmlarson merged commit 95746b3 into python:main Jan 20, 2026
47 checks passed
@miss-islington-app

Copy link
Copy Markdown

@miss-islington-app

Copy link
Copy Markdown

@sethmlarson
sethmlarson deleted the reject-control-characters-http-cookies branch January 20, 2026 21:35
@sethmlarson sethmlarson removed needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes labels Jan 20, 2026
@sethmlarson sethmlarson removed needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Jan 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

type-security A security issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants