CookieJar - return 'best-match' and not LIFO#7577
CookieJar - return 'best-match' and not LIFO#7577Dreamsorcerer merged 7 commits intoaio-libs:masterfrom marq24:return-best-match
Conversation
…ESSIONID) in different paths The filtered result should always return the best-matching cookie for a given (in contrast to the last inserted)
Codecov Report
@@ Coverage Diff @@
## master #7577 +/- ##
==========================================
+ Coverage 97.26% 97.35% +0.09%
==========================================
Files 106 106
Lines 31485 31502 +17
Branches 2917 3586 +669
==========================================
+ Hits 30623 30668 +45
+ Misses 646 630 -16
+ Partials 216 204 -12
Flags with carried forward coverage won't be shown. Click here to find out more.
... and 10 files with indirect coverage changes 📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more |
Backport to 3.8: 💔 cherry-picking failed — conflicts found❌ Failed to cleanly apply 9c932f7 on top of patchback/backports/3.8/9c932f71ec5a450954cee92ff9450974414ac1d8/pr-7577 Backporting merged PR #7577 into master
🤖 @patchback |
Backport to 3.9: 💔 cherry-picking failed — conflicts found❌ Failed to cleanly apply 9c932f7 on top of patchback/backports/3.9/9c932f71ec5a450954cee92ff9450974414ac1d8/pr-7577 Backporting merged PR #7577 into master
🤖 @patchback |
Co-authored-by: marq24 <[email protected]> (cherry picked from commit 9c932f7)
Co-authored-by: marq24 <[email protected]> (cherry picked from commit 9c932f7)
|
Thanks a lot. I've sorted out the backports, so it'll be in the next release. |
Co-authored-by: Matthias Marquardt <[email protected]>
Co-authored-by: marq24 <[email protected]> (cherry picked from commit 9c932f7) Co-authored-by: Matthias Marquardt <[email protected]>
[](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [aiohttp](https://togithub.com/aio-libs/aiohttp) | `==3.8.5` -> `==3.8.6` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>aio-libs/aiohttp (aiohttp)</summary> ### [`v3.8.6`](https://togithub.com/aio-libs/aiohttp/blob/HEAD/CHANGES.rst#386-2023-10-07) [Compare Source](https://togithub.com/aio-libs/aiohttp/compare/v3.8.5...v3.8.6) \================== ## Security bugfixes - Upgraded the vendored copy of llhttp\_ to v9.1.3 -- by :user:`Dreamsorcerer` Thanks to :user:`kenballus` for reporting this, see GHSA-pjjw-qhg8-p2p9. .. \_llhttp: https://llhttp.org `#​7647 <https://github.com/aio-libs/aiohttp/issues/7647>`\_ - Updated Python parser to comply with RFCs 9110/9112 -- by :user:`Dreamorcerer` Thanks to :user:`kenballus` for reporting this, see GHSA-gfw2-4jvh-wgfg. `#​7663 <https://github.com/aio-libs/aiohttp/issues/7663>`\_ ## Deprecation - Added `fallback_charset_resolver` parameter in `ClientSession` to allow a user-supplied character set detection function. Character set detection will no longer be included in 3.9 as a default. If this feature is needed, please use `fallback_charset_resolver <https://docs.aiohttp.org/en/stable/client_advanced.html#character-set-detection>`\_. `#​7561 <https://github.com/aio-libs/aiohttp/issues/7561>`\_ ## Features - Enabled lenient response parsing for more flexible parsing in the client (this should resolve some regressions when dealing with badly formatted HTTP responses). -- by :user:`Dreamsorcerer` `#​7490 <https://github.com/aio-libs/aiohttp/issues/7490>`\_ ## Bugfixes - Fixed `PermissionError` when `.netrc` is unreadable due to permissions. `#​7237 <https://github.com/aio-libs/aiohttp/issues/7237>`\_ - Fixed output of parsing errors pointing to a `\n`. -- by :user:`Dreamsorcerer` `#​7468 <https://github.com/aio-libs/aiohttp/issues/7468>`\_ - Fixed `GunicornWebWorker` max_requests_jitter not working. `#​7518 <https://github.com/aio-libs/aiohttp/issues/7518>`\_ - Fixed sorting in `filter_cookies` to use cookie with longest path. -- by :user:`marq24`. `#​7577 <https://github.com/aio-libs/aiohttp/issues/7577>`\_ - Fixed display of `BadStatusLine` messages from llhttp\_. -- by :user:`Dreamsorcerer` `#​7651 <https://github.com/aio-libs/aiohttp/issues/7651>`\_ *** </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/allenporter/pyrainbird). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4wLjMiLCJ1cGRhdGVkSW5WZXIiOiIzNy4wLjMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIn0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
What do these changes do?
The CookieJAR can contain multiple cookies with the identical name (e.g. JSESSIONID) for different paths of the same domain
the
filter_cookieshave to make sure that the cookie with the best-matching path will be returned. In the current implementation that last matching cookie that was inserted into the JAR will return...I came across this issue in the situation, that a request to
/authset a SESSION_A, then redirected to/set another (different SESSION_B), redirected me again to/authwhere the current implementation returned the SESSION_B for/(instead of the SESSION_A for/authI might do things here completely wrong - please excuse - I am far from being a python expert (I consider myself more a newbie)
Tests?
I added an additional test in the cookiejar.py
test_path_filter_diff_folder_same_name_return_best_match_independent_from_put_orderthat fail with the current implementation, but with the change/fix it test is passedAre there changes in behavior for the user?
IMHO - nope
Related issue number
PRNUM: #7577
Checklist
CONTRIBUTORS.txtCHANGESfolder<issue_id>.<type>for example (588.bugfix)issue_idchange it to the pr id after creating the pr.feature: Signifying a new feature..bugfix: Signifying a bug fix..doc: Signifying a documentation improvement..removal: Signifying a deprecation or removal of public API..misc: A ticket has been closed, but it is not of interest to users.