nebius/SWE-bench-extra huggingface dataset:
Repository: encode/starlette

Issue:
Dangerous example regex for CORS Middleware?
Looking at the docs for CORS Middlware here: https://www.starlette.io/middleware/#corsmiddleware , under the `allow_origin_regex` attribute, the example value is `https://.*\.example\.org`.

However, based on the handler code for this at https://github.com/encode/starlette/blob/ab86530eddfcf56e0f7e5ca56f6ab69c15594a7d/starlette/middleware/cors.py#L90 , it appears `https://www.example.org.hacker.com` would pass as a valid origin, right?

It seems like the example should be `https://.*\.example\.org$`, yes?

Comments:

Patch:
diff --git a/starlette/middleware/cors.py b/starlette/middleware/cors.py
index ad2eeff..90ba180 100644
--- a/starlette/middleware/cors.py
+++ b/starlette/middleware/cors.py
@@ -87,7 +87,7 @@ class CORSMiddleware:
         if self.allow_all_origins:
             return True
 
-        if self.allow_origin_regex is not None and self.allow_origin_regex.match(
+        if self.allow_origin_regex is not None and self.allow_origin_regex.fullmatch(
             origin
         ):
             return True


Test patch:
diff --git a/tests/middleware/test_cors.py b/tests/middleware/test_cors.py
index bcba704..e8bf72f 100644
--- a/tests/middleware/test_cors.py
+++ b/tests/middleware/test_cors.py
@@ -122,7 +122,7 @@ def test_cors_allow_origin_regex():
     app.add_middleware(
         CORSMiddleware,
         allow_headers=["X-Example", "Content-Type"],
-        allow_origin_regex="https://*",
+        allow_origin_regex="https://.*",
     )
 
     @app.route("/")
@@ -171,6 +171,39 @@ def test_cors_allow_origin_regex():
     assert "access-control-allow-origin" not in response.headers
 
 
+def test_cors_allow_origin_regex_fullmatch():
+    app = Starlette()
+
+    app.add_middleware(
+        CORSMiddleware,
+        allow_headers=["X-Example", "Content-Type"],
+        allow_origin_regex="https://.*\.example.org",
+    )
+
+    @app.route("/")
+    def homepage(request):
+        return PlainTextResponse("Homepage", status_code=200)
+
+    client = TestClient(app)
+
+    # Test standard response
+    headers = {"Origin": "https://subdomain.example.org"}
+    response = client.get("/", headers=headers)
+    assert response.status_code == 200
+    assert response.text == "Homepage"
+    assert (
+        response.headers["access-control-allow-origin"]
+        == "https://subdomain.example.org"
+    )
+
+    # Test diallowed standard response
+    headers = {"Origin": "https://subdomain.example.org.hacker.com"}
+    response = client.get("/", headers=headers)
+    assert response.status_code == 200
+    assert response.text == "Homepage"
+    assert "access-control-allow-origin" not in response.headers
+
+
 def test_cors_credentialed_requests_return_specific_origin():
     app = Starlette()
Repository: encode/starlette

Issue:
[bug] Invalid cookie name leads to exception
When handling a request with an invalid cookie name (does not conform to RFC2109) starlette raises an exception. i.e iam/cookiename
This is because Starlette uses Python's stdlib cookie library, which is very strict.
I do understand the strictness, but in real life scenarios you receive such malformed cookies and I want to handle those requests.
My suggestion for a solution would be to catch those exceptions and ignore the invalid cookie. 
** EDIT **
I just realized stdlib is used for the whole cookie header, hence can't ignore only one cookie.
I'll create a PR for ignoring the whole cookie on such case, but maybe we should create our own Cookie/Morsel class and override the methods to ignore such error in the inbound case?

Comments:

Patch:
diff --git a/docs/requests.md b/docs/requests.md
index f0ffc66..a72cb75 100644
--- a/docs/requests.md
+++ b/docs/requests.md
@@ -73,6 +73,8 @@ Cookies are exposed as a regular dictionary interface.
 
 For example: `request.cookies.get('mycookie')`
 
+Cookies are ignored in case of an invalid cookie. (RFC2109)
+
 #### Body
 
 There are a few different interfaces for returning the body of the request:
diff --git a/starlette/requests.py b/starlette/requests.py
index 1f7b09e..0ebeb3f 100644
--- a/starlette/requests.py
+++ b/starlette/requests.py
@@ -91,7 +91,10 @@ class HTTPConnection(Mapping):
             cookie_header = self.headers.get("cookie")
             if cookie_header:
                 cookie = http.cookies.SimpleCookie()  # type: http.cookies.BaseCookie
-                cookie.load(cookie_header)
+                try:
+                    cookie.load(cookie_header)
+                except http.cookies.CookieError:
+                    pass
                 for key, morsel in cookie.items():
                     cookies[key] = morsel.value
             self._cookies = cookies


Test patch:
diff --git a/tests/test_requests.py b/tests/test_requests.py
index defdf3a..3381249 100644
--- a/tests/test_requests.py
+++ b/tests/test_requests.py
@@ -285,6 +285,17 @@ def test_request_cookies():
     assert response.text == "Hello, cookies!"
 
 
+def test_invalid_cookie():
+    async def app(scope, receive, send):
+        request = Request(scope, receive)
+        response = JSONResponse({"cookies": request.cookies})
+        await response(scope, receive, send)
+
+    client = TestClient(app)
+    response = client.get("/", cookies={"invalid/cookie": "test", "valid": "test2"})
+    assert response.json() == {"cookies": {}}
+
+
 def test_chunked_encoding():
     async def app(scope, receive, send):
         request = Request(scope, receive)