gh-82039: Relax cookiejar.py case-sensitive regex for the inconsequential first line of the cookie file (GH-15673)

globalshrug · arhadthedev · serhiy-storchaka · web-flow · commit 1cf7d8982879 · 2026-08-11T17:01:52.000Z
Co-authored-by: Oleg Iarygin &lt;oleg@arhadthedev.net&gt;
Co-authored-by: Serhiy Storchaka &lt;storchaka@gmail.com&gt;
diff --git a/Lib/http/cookiejar.py b/Lib/http/cookiejar.py
@@ -53,7 +53,8 @@ def _debug(*args):
 HTTPONLY_ATTR = "HTTPOnly"
 HTTPONLY_PREFIX = "#HttpOnly_"
 DEFAULT_HTTP_PORT = str(http.client.HTTP_PORT)
-NETSCAPE_MAGIC_RGX = re.compile("#( Netscape)? HTTP Cookie File")
+NETSCAPE_MAGIC_RGX = re.compile("#( Netscape)? HTTP Cookie File",
+                                re.IGNORECASE | re.ASCII)
 MISSING_FILENAME_TEXT = ("a filename was not supplied (nor was the CookieJar "
                          "instance initialised with one)")
 NETSCAPE_HEADER_TEXT =  """\
diff --git a/Lib/test/test_http_cookiejar.py b/Lib/test/test_http_cookiejar.py
@@ -459,6 +459,31 @@ def test_bad_magic(self):
         finally:
             os_helper.unlink(filename)
 
+    def test_magic_ignores_case(self):
+        filename = os_helper.TESTFN
+        self.addCleanup(os_helper.unlink, filename)
+        for magic in ("# Netscape HTTP Cookie File",
+                      "# netscape http cookie file",
+                      "# HTTP Cookie File",
+                      "# http cookie file"):
+            with self.subTest(magic=magic):
+                with open(filename, "w") as f:
+                    f.write(magic + "\n")
+                MozillaCookieJar().load(filename)
+
+    def test_magic_is_not_unicode(self):
+        # Unicode case folding must not be used: 'ſ' (U+017F) and 'K'
+        # (U+212A) are case-insensitively equal to 's' and 'k' in Unicode.
+        filename = os_helper.TESTFN
+        self.addCleanup(os_helper.unlink, filename)
+        for magic in ("# Netſcape HTTP Cookie File",
+                      "# Netscape HTTP CooKie File"):
+            with self.subTest(magic=magic):
+                with open(filename, "w", encoding="utf-8") as f:
+                    f.write(magic + "\n")
+                self.assertRaises(LoadError, MozillaCookieJar().load, filename)
+
+
 class CookieTests(unittest.TestCase):
     # XXX
     # Get rid of string comparisons where not actually testing str / repr.
diff --git a/Misc/ACKS b/Misc/ACKS
@@ -748,6 +748,7 @@ Peter Harris
 Jonathan Hartley
 Travis B. Hartwell
 Henrik Harutyunyan
+Ashley Harvey
 Shane Harvey
 Larry Hastings
 Tim Hatch
diff --git a/Misc/NEWS.d/next/Library/2023-02-11-09-49-49.gh-issue-82039.caTE7O.rst b/Misc/NEWS.d/next/Library/2023-02-11-09-49-49.gh-issue-82039.caTE7O.rst
@@ -0,0 +1,2 @@
+:meth:`http.cookiejar.FileCookieJar.load` now checks the first, format
+signature line in a case-insensitive manner. Patch by Ashley Harvey.

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	+:meth:`http.cookiejar.FileCookieJar.load` now checks the first, format
	`2`	`+signature line in a case-insensitive manner. Patch by Ashley Harvey.`