Skip to content

http.cookiejar.http2time raises ValueError instead of returning None for a strict-format fake month #153677

Description

@tonghuaroot

Bug description

http.cookiejar.http2time() documents that it returns None for an
unrecognized date format, but its STRICT_DATE_RE fast path raises a raw
ValueError when the month field matches the pattern [JFMASOND][a-z][a-z]
yet names a month that does not exist:

>>> from http.cookiejar import http2time
>>> http2time('Wed, 09 Foo 1994 22:23:32 GMT')
Traceback (most recent call last):
  ...
ValueError: 'foo' is not in list
>>> http2time('Wed, 09 Feb 1994 22:23:32 GMT')   # a real month still works
760832612.0

The slower parser (_str2time) already handles the same input via
try/except and returns None; only the strict fast path leaks. It is
reachable from parse_ns_headers() through a cookie's expires= attribute,
e.g. Set-Cookie: x=y; expires=Wed, 09 Foo 1994 22:23:32 GMT.

gh-60385 previously established the "returns None, never raises" contract
for a different http2time code path; the later STRICT_DATE_RE fast path
reintroduced a leak on this separate path.

CPython versions tested on

3.13, 3.14, 3.15

Operating systems tested on

Linux, macOS

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    stdlibStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or error

    Fields

    No fields configured for issues without a type.

    Projects

    Status
    No status

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions