diff --git a/Lib/http/cookiejar.py b/Lib/http/cookiejar.py index 13e5b104a81ea2b..58a53b424daf51a 100644 --- a/Lib/http/cookiejar.py +++ b/Lib/http/cookiejar.py @@ -262,10 +262,15 @@ def http2time(text): m = STRICT_DATE_RE.search(text) if m: g = m.groups() - mon = MONTHS_LOWER.index(g[1].lower()) + 1 - tt = (int(g[2]), mon, int(g[0]), - int(g[3]), int(g[4]), float(g[5])) - return _timegm(tt) + try: + mon = MONTHS_LOWER.index(g[1].lower()) + 1 + except ValueError: + # Not a real month name; fall through to the slower parser. + pass + else: + tt = (int(g[2]), mon, int(g[0]), + int(g[3]), int(g[4]), float(g[5])) + return _timegm(tt) # No, we need some messy parsing... diff --git a/Lib/test/test_http_cookiejar.py b/Lib/test/test_http_cookiejar.py index 04cb440cd4ccf66..1691029f5cb2635 100644 --- a/Lib/test/test_http_cookiejar.py +++ b/Lib/test/test_http_cookiejar.py @@ -121,6 +121,11 @@ def test_http2time_formats(self): '08-01-3697739', '09 Feb 19942632 22:23:32 GMT', 'Wed, 09 Feb 1994834 22:23:32 GMT', + # Strictly formatted string with a non-existent month name. The + # month field matches the STRICT_DATE_RE fast path but is not a + # real month, and must not leak a ValueError. + 'Wed, 09 Foo 1994 22:23:32 GMT', + 'Mon, 01 Aaa 2000 00:00:00 GMT', ]) def test_http2time_garbage(self, test): self.assertIsNone(http2time(test)) diff --git a/Misc/NEWS.d/next/Library/2026-07-13-10-30-00.gh-issue-153677.dIxjOG.rst b/Misc/NEWS.d/next/Library/2026-07-13-10-30-00.gh-issue-153677.dIxjOG.rst new file mode 100644 index 000000000000000..9faf1efd1071dbf --- /dev/null +++ b/Misc/NEWS.d/next/Library/2026-07-13-10-30-00.gh-issue-153677.dIxjOG.rst @@ -0,0 +1,3 @@ +:func:`!http.cookiejar.http2time` now returns ``None`` instead of raising +:exc:`ValueError` for a strictly-formatted date with a non-existent month +name. Patch by tonghuaroot.