Repository: falconry/falcon
Pull request #1104 (2017-08-23 10:01:18)

<fix>(request): Fix unexpected CookieError during cookie parsing
Fix unexpected CookieError by splitting Cookie header into parts and parsing them independently.

codecov[bot]: # [Codecov](https://codecov.io/gh/falconry/falcon/pull/1104?src=pr&el=h1) Report
> Merging [#1104](https://codecov.io/gh/falconry/falcon/pull/1104?src=pr&el=desc) into [master](https://codecov.io/gh/falconry/falcon/commit/d6cc770a99f1f88dab2f984a87daf365f5758a07?src=pr&el=desc) will **not change** coverage.
> The diff coverage is `100%`.

[![Impacted file tree graph](https://codecov.io/gh/falconry/falcon/pull/1104/graphs/tree.svg?width=650&height=150&src=pr&token=zOtkfNQ3h6)](https://codecov.io/gh/falconry/falcon/pull/1104?src=pr&el=tree)

```diff
@@          Coverage Diff           @@
##           master   #1104   +/-   ##
======================================
  Coverage     100%    100%           
======================================
  Files          38      38           
  Lines        2412    2418    +6     
  Branches      340     341    +1     
======================================
+ Hits         2412    2418    +6
```


| [Impacted Files](https://codecov.io/gh/falconry/falcon/pull/1104?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [falcon/request.py](https://codecov.io/gh/falconry/falcon/pull/1104?src=pr&el=tree#diff-ZmFsY29uL3JlcXVlc3QucHk=) | `100% <100%> (ø)` | :arrow_up: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/falconry/falcon/pull/1104?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/falconry/falcon/pull/1104?src=pr&el=footer). Last update [d6cc770...e749b29](https://codecov.io/gh/falconry/falcon/pull/1104?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).

yasek: @kgriffs Also, is it possible to include this fix into current release?

Patch:
diff --git a/falcon/request.py b/falcon/request.py
index f7ee338..fc69641 100644
--- a/falcon/request.py
+++ b/falcon/request.py
@@ -896,7 +896,13 @@ class Request(object):
             # NOTE(tbug): We might want to look into parsing
             # cookies ourselves. The SimpleCookie is doing a
             # lot if stuff only required to SEND cookies.
-            parser = SimpleCookie(self.get_header('Cookie'))
+            cookie_header = self.get_header('Cookie', default='')
+            parser = SimpleCookie()
+            for cookie_part in cookie_header.split('; '):
+                try:
+                    parser.load(cookie_part)
+                except http_cookies.CookieError:
+                    pass
             cookies = {}
             for morsel in parser.values():
                 cookies[morsel.key] = morsel.value


Test patch:
diff --git a/tests/test_cookies.py b/tests/test_cookies.py
index 14b8ffc..8842b9d 100644
--- a/tests/test_cookies.py
+++ b/tests/test_cookies.py
@@ -263,6 +263,30 @@ def test_request_cookie_parsing():
     assert '_octo' in req.cookies
 
 
+def test_invalid_cookies_are_ignored():
+    headers = [
+        (
+            'Cookie',
+            """
+            good_cookie=foo;
+            bad{cookie=bar
+            """
+        ),
+    ]
+
+    environ = testing.create_environ(headers=headers)
+    req = falcon.Request(environ)
+
+    assert req.cookies['good_cookie'] == 'foo'
+    assert 'bad{cookie' not in req.cookies
+
+
+def test_cookie_header_is_missing():
+    environ = testing.create_environ(headers={})
+    req = falcon.Request(environ)
+    assert req.cookies == {}
+
+
 def test_unicode_inside_ascii_range():
     resp = falcon.Response()